Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following policy:

/usr/sbin/semanage boolean -m --on allow_ftpd_use_nfs
/usr/sbin/semanage boolean -m --on allow_ftpd_anon_write

The users can read and write files without problem. However, they cannot create directories. I get this in audit.log:

type=AVC msg=audit(1364763704.972:25268): avc:  denied  { create } for  pid=2971 comm="proftpd" name="test4" scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir

Is there away to keep SELinux on but allow directory creation?

share|improve this question
up vote 2 down vote accepted

That looks like a policy error. Try adding this policy by doing the following..

  1. Create a new directory called "localftpd"
  2. Place the content below into a file called "localftpd.te" inside of this new directory.
  3. Run make -f /usr/share/selinux/devel/Makefile load

This is the policy amendment you need.

policy_module(localftpd, 1.0.0)

require {
    type ftpd_t;
    type nfs_t;

tunable_policy(`allow_ftpd_use_nfs && allow_ftpd_anon_write', `
    create_dirs_pattern(ftpd_t, nfs_t, nfs_t)
    delete_dirs_pattern(ftpd_t, nfs_t, nfs_t)
    rename_dirs_pattern(ftpd_t, nfs_t, nfs_t)
share|improve this answer
awesome, that totally worked. Thanks! It also got me to start learning this custom module business. – Doug Apr 1 '13 at 21:12
In case anyone else runs into this, I needed to make some changes to make this work, but the above answer led me on the right path: tunable_policy(allow_ftpd_use_nfs && allow_ftpd_anon_write', fs_manage_nfs_files(ftpd_t) fs_manage_nfs_dirs(ftpd_t) '); – Doug Apr 11 '13 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.