I've set up vsftpd on my Fedora 12 server, and I'd like to have the following configuration. Each user should have access to:
- his home directory (/home/USER);
- the web directory I created for him (/web/USER).
To achieve this, I first configured vsftpd to chroot each user to his home directory. Then, I created
/web/USER with the correct permissions, and used
mount --bind /web/USER /home/USER/Web so that the user may have access to
I also turned on the SELinux boolean
ftp_home_dir so that vsftpd is allowed to write in users' home directories.
This works very well, except that when a user tries to upload or rename a file in
/home/USER/Web, SELinux forbids it because the change must also be done to
/web/USER, and SELinux doesn't give vsftpd permission to write anything to that directory.
I know that I could solve the problem by turning on the SELinux boolean
ftpd_disable_trans. I also tried to use audit2allow to generate a policy, but what it does is generate a policy that gives ftpd write access to directories of type
public_content_t; this is equivalent to turning on
allow_ftpd_full_access, if I understood it correctly.
I'd like to know if it's possible to configure SELinux to allow FTP write access to the specific directory
/web/USER and its contents, instead of disabling SELinux's FTP controls entirely.