I use proftpd for virtual FTP hosting with MySQL.
I've started writing fine-grained SELinux policies and found that it's trying to access my.cnf files.
Question is what for and why?
type=AVC msg=audit(1378191337.059:153431): avc: denied { getattr } for pid= comm="proftpd" path="/etc/my.cnf" dev="dm-1" ino=1180081 scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mysqld_etc_t:s0 tclass=file
type=AVC msg=audit(1378191337.059:153432): avc: denied { read } for pid=50590 comm="proftpd" name="my.cnf" dev="dm-1" ino=1180081 scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mysqld_etc_t:s0 tclass=file
type=AVC msg=audit(1378191337.059:153432): avc: denied { open } for pid=50590 comm="proftpd" path="/etc/my.cnf" dev="dm-1" ino=1180081 scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mysqld_etc_t:s0 tclass=file
Output of ps auxwf|grep 50590
is empty now - process doesn't exist anymore. Looks like it's trying to do that on every login attempt.
Update: Filed bug/feature request, patch submitted by developer: http://bugs.proftpd.org/show_bug.cgi?id=3971
mod_sql
?proftpd
might be trying to readmy.cnf
files because of that.mod_sql
andmod_sql_mysql
, WHY does it try to read itproftpd.conf
asSQLConnectInfo
. It's checking my.cnf for that anyway by default?