Hi, Samba maintainer here ...
2018-03-19 15:10 GMT+01:00 Marvin Renich <m...@renich.org>: [...] > As a side note, my laptop runs testing, and I allowed apparmor to be > enabled when that change hit testing. The only issue I have noticed so > far is that smbd would not have access to some (intentionally public, > not in /home) shares if it were in enforce mode, rather than complain > mode. If I were not aware of apparmor, and if smbd were in enforce > mode, I would have had a difficult time tracking this down. > > Is there a way that an app (e.g. smbd) whose file access requirements > change dynamically through admin and user configuration can at least > inspect its own apparmor profile and give the user a clue that the admin > must update the profile? For Samba, perhaps at least a comment in > /etc/samba/smb.conf at "Share Definitions" giving a reminder that if any > LSM is enabled, the LSM config may need to be updated to reflect changes > to shares. I'm balanced about this as AppArmor logs denied access. Merge request [1] welcome, either for debian/smb.conf or debian/README.Debian. [1] https://salsa.debian.org/samba-team/samba/merge_requests Regards -- Mathieu Parent
