Arch Linux

Description:
The default apparmor profiles for Samba do not appear to be working properly, preventing clients from accessing Samba shares (I tested with usershares).
Here are all the denial issues I encountered:

1. samba-dcerpcd complains about being denied access to /var/cache/samba/names.tdb.
Workaround: Add "/var/cache/samba/** rwk," to:
* /etc/apparmor.d/local/samba-dcerpcd
* /etc/apparmor.d/local/samba-rpcd
* /etc/apparmor.d/local/samba-rpcd-classic

2. After adding an exception for that, it then started to complain about not being able to access /run/samba-dcerpcd.pid
Workaround: Add "@{run}/samba-dcerpcd.pid wk," to /etc/apparmor.d/local/samba-dcerpcd

3. There's also denials when Samba attempts to log to /var/log/samba/log.rpcd_classic. This happens whenever a share is browsed.


I believe these 3 issues are bugs with the AppArmor profile. They should not happen out of the box with the default samba profiles IMHO.


Doing the workarounds for the first 2 items seems to allow clients to connect. However, I ran into another issue where shares were not visible unless I added those directories as exceptions in:
* /etc/apparmor.d/local/samba-rpcd-classic
* /etc/apparmor.d/local/usr.sbin.smbd

ArchWiki only mentions to add exceptions to the latter though, so I am confused whether I am doing this properly. Are we expected to now add exceptions in both these files instead of just one?


Additional info:
* apparmor 3.1.2-1, samba 4.17.4-2