Samba: Update Samba add-on to allow selectively enabling folders

samba/CHANGELOG.md

@@ -1,4 +1,12 @@
 # Changelog
+## 13.0.0
+
+This change enhances security and user control, but may require updating your configuration
+to access shares that contain potentially sensitive information.
+
+- Default shares reduced to 'media' and 'share'
+- Add ability to selectively enable exposed shares.
+
 ## 12.3.2
 
 - Suppress benign idmap logged error

samba/DOCS.md

@@ -85,6 +85,59 @@ when you absolutely need it and understand the possible consequences.
 
 Defaults to `false`.
 
+### Option: `enable_addons`
+
+Setting this option to `true` will allow Samba to expose the 'addons' folder,
+which is used for installing custom local plugins.
+
+Defaults to `false`.
+
+### Option: `enable_addon_configs`
+
+Setting this option to `true` will allow Samba to expose the 'addon_configs' folder,
+which is used for setting configuration of plugins.
+
+defaults to `false`.
+
+### Option: `enable_backups`
+
+Setting this option to `true` will allow Samba to expose the 'backup' folder,
+which is where HomeAssistant places its backups.  These backups can contain any information
+stored in your configurations for Homeassistant or any add-on, including secrets.
+
+Defaults to `false`.
+
+### Option: `enable_configs`
+
+Setting this option to `true` will allow Samba to expose the 'config' folder,
+which is where HomeAssistant stores it core configuration files and databases.  This
+includes secrets.
+
+Defaults to `false`.
+
+### Option: `enable_media`
+
+This option will allow Samba to expose the 'media' folder, which is where HomeAssistant
+expects you to store any local media files.  This is generally safe to expose.
+
+Defaults to `true`.  If you want to not allow this access, change to `false`.
+
+### Option: `enable_share`
+
+This option will allow Samba to expose the 'share' folder, which is where HomeAssistant
+stores information it expects to be shared between different plugins and HomeAssistant.
+
+Defaults to `true`.  If you want to not allow this access, change to `false`.
+
+### Option: `enable_ssl`
+
+Setting this option to `true` will allow Samba to expose the 'ssl' folder,
+which is where HomeAssistant stores its public and private SSL keys.  These are considered
+sensitive because anyone who gets ahold of both parts can impersonante your HomeAssistant server,
+including using that to collect credentials.
+
+Defaults to `false`.
+
 ## Support
 
 Got questions?

samba/config.yaml

@@ -1,5 +1,5 @@
 ---
-version: 12.3.2
+version: 13.0.0
 slug: samba
 name: Samba share
 description: Expose Home Assistant folders with SMB/CIFS
@@ -41,6 +41,13 @@ options:
     - 169.254.0.0/16
     - fe80::/10
     - fc00::/7
+  allow_addons: false
+  allow_addon_configs: false
+  allow_backup: false
+  allow_config: false
+  allow_media: true
+  allow_share: true
+  allow_ssl: false
 schema:
   username: str
   password: password
@@ -50,4 +57,11 @@ schema:
     - str
   allow_hosts:
     - str
+  allow_addons: bool
+  allow_addon_configs: bool
+  allow_backup: bool
+  allow_config: bool
+  allow_media: bool
+  allow_share: bool
+  allow_ssl: bool
 startup: services

samba/rootfs/etc/s6-overlay/s6-rc.d/init-smbd/run

@@ -12,6 +12,12 @@ if ! bashio::config.has_value 'username' || ! bashio::config.has_value 'password
     bashio::exit.nok "Setting a username and password is required!"
 fi
 
+if bashio::config.false 'enable_addons' && bashio::config.false 'enable_addon_configs' && bashio::config.false 'enable_backup' && \
+ bashio::config.false 'enable_config' && bashio::config.false 'enable_media' && bashio::config.false 'enable_share' && \
+ bashio::config.false 'enable_ssl'; then
+    bashio::exit.nok "No shares enabled for Samba to present!"
+fi
+
 # Read hostname from API or setting default "hassio"
 HOSTNAME=$(bashio::info.hostname)
 if bashio::var.is_empty "${HOSTNAME}"; then

samba/rootfs/usr/share/tempio/smb.gtpl

@@ -26,6 +26,7 @@
    dos charset = CP850
    unix charset = UTF-8
 
+{{ if .allow_config }}
 [config]
    browseable = yes
    writeable = yes
@@ -36,7 +37,9 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}
 
+{{ if .allow_addons }}
 [addons]
    browseable = yes
    writeable = yes
@@ -47,7 +50,9 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}
 
+{{ if .allow_addon_configs }}
 [addon_configs]
    browseable = yes
    writeable = yes
@@ -58,7 +63,9 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}
 
+{{ if .allow_ssl }}
 [ssl]
    browseable = yes
    writeable = yes
@@ -69,7 +76,9 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}
 
+{{ if .allow_share }}
 [share]
    browseable = yes
    writeable = yes
@@ -80,7 +89,9 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}
 
+{{ if .allow_backup }}
 [backup]
    browseable = yes
    writeable = yes
@@ -91,7 +102,9 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}
 
+{{ if .allow_media }}
 [media]
    browseable = yes
    writeable = yes
@@ -102,3 +115,4 @@
    force group = root
    veto files = /{{ .veto_files | join "/" }}/
    delete veto files = {{ eq (len .veto_files) 0 | ternary "no" "yes" }}
+{{ end }}

samba/translations/en.yaml

@@ -21,3 +21,37 @@ configuration:
   allow_hosts:
     name: Allowed Hosts
     description: List of hosts/networks allowed to access the shared folders.
+  allow_addons:
+    name: Allow Add-Ons folder
+    description: >-
+      Allow SMB access to the Add-ons folder.
+      This is disabled by default.
+  allow_addon_configs:
+    name: Allow Add-On Configs folder
+    description: >-
+      Allow SMB access to the Add-on Configurations folder.
+      This is disabled by default.
+  allow_backup:
+    name: Allow Backups folder
+    description: >-
+      Allow SMB access to the folder where HomeAssistant keeps its backups.
+      This is disabled by default.
+  allow_config:
+    name: Allow Configs folder
+    description: >-
+      Allow SMB access to the HomeAssistant Core configuration folder.
+      This is disabled by default.
+  allow_media:
+    name: Allow Media folder
+    description: >-
+      Allow SMB access to the Media folder
+  allow_share:
+    name: Allow Share folders
+    description: >-
+      Allow SMB access to the Share folder (which is shared with all
+      HomeAssistant Add-ons).
+  allow_ssl:
+    name: Allow SSL folder
+    description: >-
+      Allow SMB access to the ssl folder, where HomeAssistant keeps SSL Keys.
+      This is disabled by default.