Merge remote-tracking branch 'githubalt/admx_network_shares_samba_control' into Polkit_Group_policies

Author: SokolovValy

BaseALT.admx

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <!--  (c) 2019 BaseALT, Ltd.  -->
 <policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    revision="1.1" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
@@ -134,6 +134,9 @@
       <parentCategory ref="ALT_Windows_Manager_Marco" />
     </category>
     <category name="ALT_Polkit" displayName="$(string.ALT_Polkit)" explainText="$(string.ALT_Polkit_Help)">
+    <parentCategory ref="ALT_Services" />
+    </category>
+    <category name="ALT_SambaOptions" displayName="$(string.ALT_SambaOptions)"  explainText="$(string.ALT_SambaOptions_Help)" >
       <parentCategory ref="ALT_Services" />
     </category>
     <category name="ALT_Udisks2" displayName="$(string.ALT_Udisks2)" explainText="$(string.ALT_Udisks2_Help)">

BaseALTControl.admx

@@ -1254,6 +1254,76 @@
           </item>
         </enum>
       </elements>
+    </policy>
+       <policy class="Machine" displayName="$(string.smb-conf-usershares)" explainText="$(string.smb-conf-usershares_help)" key="Software\BaseALT\Policies\Control" valueName="smb-conf-usershares" name="smb-conf-usershares">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
+    </policy>
+    <policy class="Machine" displayName="$(string.role-usershares)" explainText="$(string.role-usershares_help)" key="Software\BaseALT\Policies\Control" valueName="role-usershares" name="role-usershares">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
+    </policy>
+    <policy class="Machine" displayName="$(string.role-sambashare)" explainText="$(string.role-sambashare_help)" key="Software\BaseALT\Policies\Control" valueName="role-sambashare" name="role-sambashare">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
+    </policy>
+    <policy class="Machine" displayName="$(string.smb-conf-usershare-allow-guests)" explainText="$(string.smb-conf-usershare-allow-guests_help)" key="Software\BaseALT\Policies\Control" valueName="smb-conf-usershare-allow-guests" name="smb-conf-usershare-allow-guests">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
+    </policy>
+    <policy class="Machine" displayName="$(string.smb-conf-usershare-allow-list)" explainText="$(string.smb-conf-usershare-allow-list_help)" key="Software\BaseALT\Policies\Control" valueName="smb-conf-usershare-allow-list" name="smb-conf-usershare-allow-list">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
+    </policy>
+    <policy class="Machine" displayName="$(string.smb-conf-usershare-deny-list)" explainText="$(string.smb-conf-usershare-deny-list_help)" key="Software\BaseALT\Policies\Control" valueName="smb-conf-usershare-deny-list" name="smb-conf-usershare-deny-list">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
+    </policy>
+    <policy class="Machine" displayName="$(string.smb-conf-usershare-owner-only)" explainText="$(string.smb-conf-usershare-owner-only_help)" key="Software\BaseALT\Policies\Control" valueName="smb-conf-usershare-owner-only" name="smb-conf-usershare-owner-only">
+      <parentCategory ref="system:ALT_SambaOptions"/>
+      <supportedOn ref="system:SUPPORTED_AltP10"/>
+      <enabledValue>
+        <string>enabled</string>
+      </enabledValue>
+      <disabledValue>
+        <string>disabled</string>
+      </disabledValue>
     </policy>
   </policies>
 </policyDefinitions>

en-US/basealt.adml

@@ -58,6 +58,8 @@
       <string id="ALT_Windows_Manager_Marco_Help">Windows manager Marco settings</string>
       <string id="ALT_Windows_Manager_Marco_Keyboard">Keyboard settings</string>
       <string id="ALT_Windows_Manager_Marco_Keyboard_Help">Keyboard settings</string>
+      <string id="ALT_SambaOptions">Samba options</string>
+      <string id="ALT_SambaOptions_Help">Samba options</string>
       <string id="ALT_Polkit">Polkit Policies</string>
       <string id="ALT_Polkit_Help">Polkit Policies</string>
       <string id="ALT_PackageKit">PackageKit permissions</string>

en-US/basealtcontrol.adml

@@ -741,6 +741,84 @@ Only root — Only superuser (root) is permitted to run /usr/bin/Xorg
       <string id="xorg-server_public">Any user</string>
       <string id="xorg-server_xgrp">Group xgrp</string>
       <string id="xorg-server_restricted">Only root</string>
+     <string id="role-usershares">Access for members of the «users» group to Network Shares</string>
+      <string id="role-usershares_help">Allow members of the «users» group to access Network Shares through the privileges of the «usershares» group.
+
+Disabled - access to Network Share s is allowed only to members of the «usershares» group;
+
+Enabled - the privileges of the «usershares» group to access Network Shares apply to users included in the «users» group.
+      </string>
+      <string id="role-sambashare">Access for members of the «sambashare» group to Network Shares</string>
+      <string id="role-sambashare_help">Allow members of the «sambashare» group to access Network Shares.
+
+Disabled - deny access to Network Shares to members of the «sambashare» group;
+
+Enabled - allow access to Network Shares to members of the «sambashare» group;
+
+Default - allow access to Network Shares to members of the «sambashare» group.
+      </string>
+      <string id="smb-conf-usershare-allow-guests">Guest access to Network Shares</string>
+      <string id="smb-conf-usershare-allow-guests_help">Allow access to Network Shares without authentication.
+
+The policy controls the «usershare allow guests» setting in smb.conf or usershares.conf, allowing the setting to be set to «yes» or «no». Since the parameter is security sensitive, its default value is «no».
+
+Disabled - deny access to Network Shares without authentication;
+
+Enabled - allow access to Network Shares without authentication;
+
+Default - deny access to Network Shares without authentication.
+      </string>
+      <string id="smb-conf-usershare-allow-list">Permission to create Network Shares in root directory folders</string>
+      <string id="smb-conf-usershare-allow-list_help">The policy defines the folders in the root directory where the user is allowed to create Network Shares.
+
+If the absolute path to the user's Network Shares does not include one of the listed folders in its name, access to the Network Share will be denied.
+This limits the list of folders in the root directory in which it is possible to create user Network Shares. By default, the root folders are set (/home /srv /mnt /media /var).
+If a «usershare prefix deny list» is configured, the deny list is processed first, and then the allow list.
+The policy controls the «usershare prefix allow list» setting in the usershares.conf file - opening or closing this setting with a comment.
+
+Disabled - prohibit the creation of Network Shares in system folders from the list;
+
+Enabled - allow creation of Network Shares in system folders from the list.
+      </string>
+      <string id="smb-conf-usershare-deny-list">Prohibit the creation of Network Shares in folders in the root directory</string>
+      <string id="smb-conf-usershare-deny-list_help">The policy defines folders in the root directory where the user is not allowed to create Network Shares.
+
+If the absolute path to the user's public directory starts with one of the listed folders, access to the public directory in that folder will be denied.
+Any other path that does not contain one of the listed folders in the name will allow the creation of the Network Shares.
+This limits the list of folders in the root directory in which it is possible to create user Network Shares. By default, the root folders are set (/etc /dev /sys /proc).
+If a «usershare prefix deny list» and a «usershare prefix allow list» are configured, the deny list is processed first, and then the allow list.
+The policy controls the «usershare prefix deny list» setting in the usershares.conf file - opening or closing this setting with a comment.
+
+Disabled - allow creation of Network Shares in system folders from the list;
+
+Enabled - prohibit the creation of Network Shares in system folders from the list.
+      </string>
+      <string id="smb-conf-usershare-owner-only">Access to Network Shares of other users</string>
+      <string id="smb-conf-usershare-owner-only_help">The policy controls the user's right to access a Network Shares if the user is not the owner of that directory.
+
+If the policy is enabled, the system will check the access rights to the Network Shares and deny access to those users who do not own it.
+If the policy is disabled, this check will not be performed and any directory can be shared, regardless of who owns it. The policy changes the «usershare owner only» setting in the usershares.conf file.
+
+Disabled - open access to Network Shares of other users;
+
+Enabled - restrict public access, leaving access only to Network Shares owned by the user;
+
+Default - access to shared directories is limited - only those Network Shares that he created are available to the user.
+      </string>
+      <string id="smb-conf-usershares">Limit on Network Shares</string>
+      <string id="smb-conf-usershares_help">Controls the number of Network Shares that users who belong to the usershares group can create.
+
+By default, the «usershare max shares» setting is zero, and user shares are ignored.
+The usershares directory is for creating Network Shares. The usershares directory is owned by the usershares group and the users belonging to this group.
+The «usershare max shares» parameter sets the number of shares that the specified users can create.
+The policy controls the «usershare max shares» setting in the smb.conf file.
+
+Disabled - disable access to the user's Network Shares; «usershare max shares» parameter = 0;
+
+Enabled - enable access to the user's Network Shares; «usershare max shares» parameter = 100;
+
+Default - disable access to Network Shares the parameter «usershare max shares» is closed by a comment.
+      </string>
     </stringTable>
     <presentationTable>
       <presentation id="at">

ru-RU/basealt.adml

@@ -58,6 +58,8 @@
       <string id="ALT_Windows_Manager_Marco_Help">Настройки оконного менеджера Marco</string>
       <string id="ALT_Windows_Manager_Marco_Keyboard">Настройки клавиатуры</string>
       <string id="ALT_Windows_Manager_Marco_Keyboard_Help">Настройки клавиатуры</string>
+      <string id="ALT_SambaOptions">Samba опции</string>
+      <string id="ALT_SambaOptions_Help">Samba опции</string>
       <string id="ALT_Polkit">Управление Polkit правилами</string>
       <string id="ALT_Polkit_Help">правление Polkit правилами</string>
       <string id="ALT_PackageKit">Разрешения PackageKit</string>