# vim:syntax=apparmor
# Last Modified: Wed Jun 20 13:34:25 2007
#include <tunables/global>

/usr/sbin/smbd flags=(complain) {
  #include <abstractions/authentication>
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/cups-client>
  #include <abstractions/nameservice>
  #include <abstractions/samba>
  #include <abstractions/user-tmp>

  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_resource,
  capability sys_tty_config,

  /etc/mtab r,
  /etc/printcap r,
  /etc/passwd m,
  /etc/shadow m,
  /etc/group m,
  /proc/*/mounts r,
  /usr/sbin/smbd mr,
  /var/cache/samba/** rwk,
  /var/cache/samba/printing/printers.tdb mrw,
  /var/lib/samba/** rk,
  /var/lib/samba/printers/** rw,
  /var/run/cups/cups.sock rw,
  /var/run/samba/** rwk,
  /var/run/samba/smbd.pid rw,
  /var/log/samba/cores/smbd/ rw,
  /var/log/samba/cores/smbd/** rw,

  @{HOMEDIRS}/** lrw,
  /srv/backups/music/*/ rwk,
   /srv/backups/music/**/ rwk,

}