[Pkg-samba-maint] Bug#896080: [pkg-apparmor] Improve samba/AppArmor integration

Christian Boltz debian-bugs at cboltz.de
Thu Feb 21 23:39:29 GMT 2019


Am Donnerstag, 21. Februar 2019, 21:26:58 CET schrieb Mathieu Parent:
> As a last-minute fix for buster, I want to fix "#896080 samba: Improve
> AppArmor integration" [SambaAppArmor].
> I've prepared the fixes [Diff], inspired by what is done in Suse. But
> they also patch apparmor-profiles [AppArmor-Patch]. This solution does
> not conforms to policy as a file owned by a package could not be
> changed by another one (/etc/apparmor.d/local/usr.sbin.smbd-shares
> owned by apparmor-profiles, changed by samba).
> I can add in samba's README the need to add "#include
> <local/usr.sbin.smbd-shares>" in /etc/apparmor.d/usr.sbin.smbd, but
> maybe you have a better solution? Maybe use dpkg-diversion?

To simplify things, I'd propose to apply a slightly modified version of
to the usr.sbin.smbd profile in the apparmor-profiles package:

Instead of   #include   you {c,sh]ould use   #include if exists
so that it doesn't matter if   local/usr.sbin.smbd-shares   exists or 
which package creates it.

That might even be an upstream-able solution because it doesn't break 
distributions without the autogenerated samba profile sniplet (or without
the package owning that file installed).

The local/usr.sbin.smbd file can then be owned by whatever package
(probably samba, because that also owns the script changing the file).

BTW: Minor nitpicking on 

Can you please change the changelog to "Christian Boltz (openSUSE)" 
(instead of "SUSE")? ;-)


Christian Boltz
[vordefinierte Perlvariablen $_, $>, $[ usw.]
>Steht eigentlich in $§ die Lizenz? ;-)))
$ perl -we 'print $§'
Use of uninitialized value in print at -e line 1.
[> Christian Boltz und David Haller in fontlinge-devel]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-samba-maint/attachments/20190222/a261d05a/attachment.sig>

More information about the Pkg-samba-maint mailing list