Attachment 457112 Details for Bug 688040

update-apparmor-samba-profile

update-apparmor-samba-profile (text/plain), 2.14 KB, created by Christian Boltz on 2011-10-17 20:18:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christian Boltz

Created: 2011-10-17 20:18:49 UTC

Size: 2.14 KB

patch

obsolete

>#!/bin/bash
>
># update apparmor profile sniplet based on samba configuration
>#
># This script creates and updates a profile sniplet with permissions for all 
># samba shares, except
># - paths with variables (anything containing a % sign)
># - "/" - if someone is insane enough to share his complete filesystem, he'll have 
>#   to modify the apparmor profile himself
>
># (c) Christian Boltz 2011
># This script is licensed under the GPL v2 or, at your choice, any later version.
>
>
># exit silently - used if no profile update is needed
>silentexit() {
>	# echo "$@"
>	exit 0
>}
>
># exit with an error message
>verboseexit() {
>	echo "$@" >&2
>	exit 1
>}
>
>
>versionstring="${0##*/} 1.0"
>
>aastatus="/usr/sbin/aa-status"
>aaparser="/sbin/apparmor_parser"
>loadedprofiles="/sys/kernel/security/apparmor/profiles"
>
>smbconf="/etc/samba/smb.conf"
>smbd_profile="/etc/apparmor.d/usr.sbin.smbd"
>profilesniplet="/etc/apparmor.d/local/usr.sbin.smbd-shares"
>tmp_profilesniplet="/etc/apparmor.d/local/usr.sbin.smbd-shares.new"
>
># test -x "$aastatus" || silentexit "apparmor not installed"
># "$aastatus" --enabled || silentexit "apparmor not loaded (or not running as root)"
>test -e "$loadedprofiles" || silentexit "apparmor not loaded"
>test -r "$loadedprofiles" || verboseexit "no read permissions for $loadedprofiles - not running as root?"
>grep -q '^/usr/sbin/smbd (' /sys/kernel/security/apparmor/profiles || silentexit "smbd profile not loaded"
>
>grep -q "$versionstring" "$profilesniplet" && {
>	test "$smbconf" -nt "$profilesniplet" || silentexit "smb.conf is older than the AppArmor profile sniplet"
>}
>
>{
>	echo "# autogenerated by $versionstring at samba start - do not edit!"
>	echo ""
>	testparm -s 2>/dev/null |sed -n '/^[ \t]*path[ \t]*=[ \t]*[^% \t]\{2,\}/ s§^[ \t]*path[ \t]*=[ \t]*$.*$$§\1/   rk,\n\1/** rwkl,§p'
>} > "$tmp_profilesniplet"
>
>diff "$profilesniplet" "$tmp_profilesniplet" >/dev/null && {
>	rm -f "$tmp_profilesniplet"
>	touch "$profilesniplet" # update timestamp - otherwise we'll have to check again on the next run
>	silentexit "profile sniplet unchanged"
>}
>
>echo "Updating AppArmor profile for Samba..."
>
>mv -f "$tmp_profilesniplet" "$profilesniplet" 
>
># reload profile
>"$aaparser" -r "$smbd_profile"
>

Actions: View

Attachments on bug 688040: 457112 | 457113