abi <abi/3.0>,

include <tunables/global>

profile nmbd /usr/{bin,sbin}/nmbd flags=(complain) {
  include <abstractions/base>
  include <abstractions/nameservice>
  include <abstractions/samba>

  capability net_bind_service,

  @{PROC}/sys/kernel/core_pattern r,

  /usr/{bin,sbin}/nmbd mr,

  /var/cache/samba/gencache.tdb rwk,
  /var/cache/samba/gencache_notrans.tdb rwk,
  /var/cache/samba/names.tdb rwk,
  /var/{cache,lib}/samba/browse.dat* rw,
  /var/{cache,lib}/samba/gencache.dat rw,
  /var/{cache,lib}/samba/wins.dat* rw,
  /var/{cache,lib}/samba/smb_krb5/ rw,
  /var/{cache,lib}/samba/smb_krb5/krb5.conf* rw,
  /var/{cache,lib}/samba/smb_tmp_krb5.* rw,
  /var/{cache,lib}/samba/sync.* rw,
  /var/{cache,lib}/samba/unexpected rw,
  /var/cache/samba/msg/ rw,
  /var/cache/samba/msg/* w,

  @{run}/nmbd.pid rwk,
  @{run}/samba/** rwk,
  @{run}/systemd/notify w,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.sbin.nmbd>
}