1

I have a ProFTPd server on Centos 6.3 with SELinux Enforcing. My users are virtual users in a flat file. The users are chrooted to directories mounted via NFS. I've already set the following policy:

/usr/sbin/semanage boolean -m --on allow_ftpd_use_nfs
/usr/sbin/semanage boolean -m --on allow_ftpd_anon_write

The users can read and write files without problem. However, they cannot create directories. I get this in audit.log:

type=AVC msg=audit(1364763704.972:25268): avc:  denied  { create } for  pid=2971 comm="proftpd" name="test4" scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir

Is there away to keep SELinux on but allow directory creation?

2

That looks like a policy error. Try adding this policy by doing the following..

  1. Create a new directory called "localftpd"
  2. Place the content below into a file called "localftpd.te" inside of this new directory.
  3. Run make -f /usr/share/selinux/devel/Makefile load

This is the policy amendment you need.

policy_module(localftpd, 1.0.0)

require {
    type ftpd_t;
    type nfs_t;
}

tunable_policy(`allow_ftpd_use_nfs && allow_ftpd_anon_write', `
    create_dirs_pattern(ftpd_t, nfs_t, nfs_t)
    delete_dirs_pattern(ftpd_t, nfs_t, nfs_t)
    rename_dirs_pattern(ftpd_t, nfs_t, nfs_t)
');
| improve this answer | |
  • awesome, that totally worked. Thanks! It also got me to start learning this custom module business. – Doug Apr 1 '13 at 21:12
  • In case anyone else runs into this, I needed to make some changes to make this work, but the above answer led me on the right path: tunable_policy(allow_ftpd_use_nfs && allow_ftpd_anon_write', fs_manage_nfs_files(ftpd_t) fs_manage_nfs_dirs(ftpd_t) '); – Doug Apr 11 '13 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.