Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: vsftpd with selinux on FC3: msg#00133
|
Subject: |
Re: vsftpd with selinux on FC3 |
James Z. Li wrote:
Thanks a lot for your help.
I installed FC4T3 to learn from its ftpd policy. However its policy seems
not working well. After 'service vsftpd start', I cannot make ftp connection
to it. Error messages are:
...
331 Please specify the password.
Password:
Error sending status request (Operation not permitted)
Login failed.
ftp> ls
230 Login successful.
Passive mode address scan failure. Shouldn't happen!
ftp> bye
215 UNIX Type: L8
I go through the targeted policy for ftpd and write my own policy for vsftpd
on FC3.
vsftpd.te
#################################
#
# Rules for the vsftpd_t domain.
#
daemon_domain(vsftpd, `, auth_chkpwd')
etc_domain(vsftpd)
can_network(vsftpd_t)
vsftpd.fc
#################################
/usr/sbin/vsftpd -- system_u:object_r:vsftpd_exec_t
/var/run/vsftpd.pid -- system_u:object_r:vsftpd_var_run_t
/etc/vsftpd/vsftpd.conf -- system_u:object_r:vsftpd_etc_t
I know they are lots of scenarios missing here, like actions related to nfs and
samba. I plan to keep adding more rules into these two files based on parsing
avc error messages. Currently, the above policy works well on my home pc
for both anonymous and non-anonymous ftp services without generating even
one AVC error message. Interesting ?!
James
Yes we have made some modifications to ftpd.te this past week to fix
this problem.
Could you grab the latest policy off of
ftp://people.redhat.com/dwalsh/SELinux/Fedora
Which should make it into FC4/Final.
--
|
| |
