1*4882a593SmuzhiyunFrom 7c58f2508efc115dea03e18e1fa611ebf81f6ee6 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Fabrice Fontaine <fontaine.fabrice@gmail.com> 3*4882a593SmuzhiyunDate: Wed, 4 Aug 2021 11:12:01 +0200 4*4882a593SmuzhiyunSubject: [PATCH] policy/modules/services/samba.te: make crack optional 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunMake crack optional to avoid the following build failure: 7*4882a593Smuzhiyun 8*4882a593Smuzhiyun Compiling targeted policy.31 9*4882a593Smuzhiyun env LD_LIBRARY_PATH="/tmp/instance-5/output-1/host/lib:/tmp/instance-5/output-1/host/usr/lib" /tmp/instance-5/output-1/host/usr/bin/checkpolicy -c 31 -U deny -S -O -E policy.conf -o policy.31 10*4882a593Smuzhiyun policy/modules/services/samba.te:399:ERROR 'type crack_db_t is not within scope' at token ';' on line 360232: 11*4882a593Smuzhiyun allow smbd_t crack_db_t:dir { getattr search open }; 12*4882a593Smuzhiyun #line 399 13*4882a593Smuzhiyun checkpolicy: error(s) encountered while parsing configuration 14*4882a593Smuzhiyun 15*4882a593SmuzhiyunFixes: 16*4882a593Smuzhiyun - http://autobuild.buildroot.org/results/ab7098948d1920e42fa587e07f0513f23ba7fc74 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunSigned-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> 19*4882a593Smuzhiyun[Upstream status: https://github.com/SELinuxProject/refpolicy/pull/407] 20*4882a593Smuzhiyun--- 21*4882a593Smuzhiyun policy/modules/services/samba.te | 32 ++++++++++++++++++-------------- 22*4882a593Smuzhiyun 1 file changed, 18 insertions(+), 14 deletions(-) 23*4882a593Smuzhiyun 24*4882a593Smuzhiyundiff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te 25*4882a593Smuzhiyunindex 9d4665ae6..6c37625a9 100644 26*4882a593Smuzhiyun--- a/policy/modules/services/samba.te 27*4882a593Smuzhiyun+++ b/policy/modules/services/samba.te 28*4882a593Smuzhiyun@@ -396,8 +396,6 @@ userdom_signal_all_users(smbd_t) 29*4882a593Smuzhiyun userdom_home_filetrans_user_home_dir(smbd_t) 30*4882a593Smuzhiyun userdom_user_home_dir_filetrans_user_home_content(smbd_t, { dir file lnk_file sock_file fifo_file }) 31*4882a593Smuzhiyun 32*4882a593Smuzhiyun-usermanage_read_crack_db(smbd_t) 33*4882a593Smuzhiyun- 34*4882a593Smuzhiyun ifdef(`hide_broken_symptoms',` 35*4882a593Smuzhiyun files_dontaudit_getattr_default_dirs(smbd_t) 36*4882a593Smuzhiyun files_dontaudit_getattr_boot_dirs(smbd_t) 37*4882a593Smuzhiyun@@ -413,18 +411,6 @@ tunable_policy(`samba_create_home_dirs',` 38*4882a593Smuzhiyun userdom_create_user_home_dirs(smbd_t) 39*4882a593Smuzhiyun ') 40*4882a593Smuzhiyun 41*4882a593Smuzhiyun-tunable_policy(`samba_domain_controller',` 42*4882a593Smuzhiyun- gen_require(` 43*4882a593Smuzhiyun- class passwd passwd; 44*4882a593Smuzhiyun- ') 45*4882a593Smuzhiyun- 46*4882a593Smuzhiyun- usermanage_domtrans_passwd(smbd_t) 47*4882a593Smuzhiyun- usermanage_kill_passwd(smbd_t) 48*4882a593Smuzhiyun- usermanage_domtrans_useradd(smbd_t) 49*4882a593Smuzhiyun- usermanage_domtrans_groupadd(smbd_t) 50*4882a593Smuzhiyun- allow smbd_t self:passwd passwd; 51*4882a593Smuzhiyun-') 52*4882a593Smuzhiyun- 53*4882a593Smuzhiyun tunable_policy(`samba_enable_home_dirs',` 54*4882a593Smuzhiyun userdom_manage_user_home_content_dirs(smbd_t) 55*4882a593Smuzhiyun userdom_manage_user_home_content_files(smbd_t) 56*4882a593Smuzhiyun@@ -505,6 +491,24 @@ optional_policy(` 57*4882a593Smuzhiyun seutil_sigchld_newrole(smbd_t) 58*4882a593Smuzhiyun ') 59*4882a593Smuzhiyun 60*4882a593Smuzhiyun+optional_policy(` 61*4882a593Smuzhiyun+ usermanage_read_crack_db(smbd_t) 62*4882a593Smuzhiyun+') 63*4882a593Smuzhiyun+ 64*4882a593Smuzhiyun+optional_policy(` 65*4882a593Smuzhiyun+ tunable_policy(`samba_domain_controller',` 66*4882a593Smuzhiyun+ gen_require(` 67*4882a593Smuzhiyun+ class passwd passwd; 68*4882a593Smuzhiyun+ ') 69*4882a593Smuzhiyun+ 70*4882a593Smuzhiyun+ usermanage_domtrans_passwd(smbd_t) 71*4882a593Smuzhiyun+ usermanage_kill_passwd(smbd_t) 72*4882a593Smuzhiyun+ usermanage_domtrans_useradd(smbd_t) 73*4882a593Smuzhiyun+ usermanage_domtrans_groupadd(smbd_t) 74*4882a593Smuzhiyun+ allow smbd_t self:passwd passwd; 75*4882a593Smuzhiyun+ ') 76*4882a593Smuzhiyun+') 77*4882a593Smuzhiyun+ 78*4882a593Smuzhiyun ######################################## 79*4882a593Smuzhiyun # 80*4882a593Smuzhiyun # Nmbd Local policy 81*4882a593Smuzhiyun-- 82*4882a593Smuzhiyun2.30.2 83*4882a593Smuzhiyun 84