Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following policy:

/usr/sbin/semanage boolean -m --on allow_ftpd_use_nfs
/usr/sbin/semanage boolean -m --on allow_ftpd_anon_write

The users can read and write files without problem. However, they cannot create directories. I get this in audit.log:

type=AVC msg=audit(1364763704.972:25268): avc:  denied  { create } for  pid=2971 comm="proftpd" name="test4" scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir

Is there away to keep SELinux on but allow directory creation?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

That looks like a policy error. Try adding this policy by doing the following..

  1. Create a new directory called "localftpd"
  2. Place the content below into a file called "localftpd.te" inside of this new directory.
  3. Run make -f /usr/share/selinux/devel/Makefile load

This is the policy amendment you need.

policy_module(localftpd, 1.0.0)

require {
    type ftpd_t;
    type nfs_t;
}

tunable_policy(`allow_ftpd_use_nfs && allow_ftpd_anon_write', `
    create_dirs_pattern(ftpd_t, nfs_t, nfs_t)
    delete_dirs_pattern(ftpd_t, nfs_t, nfs_t)
    rename_dirs_pattern(ftpd_t, nfs_t, nfs_t)
');
share|improve this answer
    
awesome, that totally worked. Thanks! It also got me to start learning this custom module business. –  Doug Apr 1 '13 at 21:12
    
In case anyone else runs into this, I needed to make some changes to make this work, but the above answer led me on the right path: tunable_policy(allow_ftpd_use_nfs && allow_ftpd_anon_write', fs_manage_nfs_files(ftpd_t) fs_manage_nfs_dirs(ftpd_t) '); –  Doug Apr 11 '13 at 17:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.