CODEWITHSUNDEEP
centosrhelselinuxsecurity-context
dman
dman

Reputation: 11064

Selinux - File Contexts Look Good, But Selinux Won't Allow Write

I am trying to learn Selinux. With a sandbox and using VSFTPD to experiment with, I have a vsfptd server running in Centos. I have annonmous users to place files in /var/ftp/incoming. On a remote machine I can have the user successfully log in but could not place the file on the remove vsftpd server:

$ftp mysql_server
Connected to mysql_server (192.168.1.31).
220 Welcome to blah FTP service.
Name (mysql_server:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer ftp> put atd 
local: atd remote: atd
227 Entering Passive Mode (192,168,1,31,19,161).
553 Could not create file.
ftp>

On the VSFTPD server, aureport -a report shows:

[root@mysql_server ftp]# aureport -a

AVC Report
========================================================
# date time comm subj syscall class permission obj event
========================================================
4. 04/08/2013 13:30:36 vsftpd unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 21 dir write system_u:object_r:public_content_t:s0 denied 28
5. 04/08/2013 13:34:57 vsftpd unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 2 dir write system_u:object_r:public_content_t:s0 denied 47

I checked the directory and the file contexts look good, so I don't understand why Selinux won't allow vsftpd to write to the incoming directory:

[root@mysql_server ftp]# ls -Z
drwx-wx---. root ftp  system_u:object_r:public_content_t:s0 incoming
drwxr-xr-x. root root system_u:object_r:public_content_t:s0 pub
[root@mysql_server ftp]#

Upvotes: 3

Views: 3096

Answers (2)

VictorV
VictorV

Reputation: 1059

You need to run the following commands to allow in SELinux upload and edit files:

setsebool -P allow_ftpd_full_access on
setsebool -P ftp_home_dir on

Upvotes: 4

Martin Strejc
Martin Strejc

Reputation: 4347

Your SELinux type is not correct. Use 'public_content_rw_t' instead of 'public_content_t'. Read more on http://beginlinux.com/blog/2008/11/vsftpd-and-selinux-on-centos/

Upvotes: 1

Related Questions