Skip to content

Fix some DENIES for smbd when honouring pam restrictions

Noel Power requested to merge npower/apparmor:boo1220032 into master

with smbd.conf param 'obey pam restrictions = yes'

on tumbleweed we get some new DENIES (which can prevent login)

e.g.

type=AVC msg=audit(1709113104.674:533): apparmor="DENIED" operation="exec" class="file" profile="smbd" name="/usr/sbin/unix_chkpwd" pid=3509 comm="smbd[127.0.0.1]" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 type=AVC msg=audit(1709110904.602:345): apparmor="DENIED" operation="open" class="file" profile="smbd" name="/usr/etc/security/limits.d/" pid=3746 comm="smbd[127.0.0.1]" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1709110904.602:346): apparmor="DENIED" operation="open" class="file" profile="smbd" name="/proc/3746/loginuid" pid=3746 comm="smbd[127.0.0.1]" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 type=AVC msg=audit(1709110904.602:347): apparmor="DENIED" operation="open" class="file" profile="smbd" name="/usr/etc/environment" pid=3746 comm="smbd[127.0.0.1]" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1220032

Signed-off-by: Noel Power noel.power@suse.com

Merge request reports