Re: vsftpd with selinux on FC3

[Daniel J Walsh <dwalsh@xxxxxxxxxx>]

James Z. Li wrote:

> Hi there, 
>
> I am configuring Selinux to protect vsftpd on my FC3 box. I follow the
> procedure of
> Chapter 8 Cutermizing and Writing Policy in Red Hat Enterprise Linux
> SELinux Guide.
>
> Step1: i created a file called 
> /etc/selinux/targeted/src/policy/domains/program/vsftpd.te
> the cotents are
> #################################
> #
> # Rules for the vsftpd_t domain.
> #
> daemon_domain(vsftpd)  
>
> the security context of this file was  root:object_r:policy_src_t
>  
It should stay this.

> I changed it by using
> chcon -u system_u vsftpd.te
>
> Step2: create /etc/selinux/targeted/src/policy/file_contexts/program/vsftpd.fc
> contents are
> /usr/sbin/vsftpd        --      system_u:object_r:vsftpd_exec_t
> /var/run/vsftpd.pid     --      system_u:object_r:vsftpd_var_run_t
> /etc/vsftpd/vsftpd.conf --      system_u:object_r:vsftpd_conf_t
>
> chcon -u system_u vsftpd.fc
>
>  
User context will not matter.

> At this moment, the security context of /etc/vsftpd and vsftpd.conf are:
> # ls -dZ /etc/vsftpd
> drwxr-xr-x  root     root     system_u:object_r:etc_t          /etc/vsftpd
>
> ls -Z /etc/vsftpd/vsftpd.conf
> -rw-------  root     root     system_u:object_r:etc_t         
> /etc/vsftpd/vsftpd.conf
>
> Step3: #make load
> Error message:
> ...
> Validating file_contexts ...
> /usr/sbin/setfiles -q -c /etc/selinux/targeted/policy/policy.18
> /etc/selinux/tar geted/contexts/files/file_contexts
> /usr/sbin/setfiles:  invalid context system_u:object_r:vsftpd_conf_t
> on line num ber 785
> make: *** [install] Error 1
>
>  
First do you want to protect vsftpd_conf_t from other domains reading 
it?  If you don't
set this context it will default to etc_t and almost no other domains 
will be able to write it.
If you want to add a file context you would need to create it in the te 
file.

type vsftpd_conf_t, file_type, sysadmfile;

I would not advise this, and would just leave it etc_t.

> Could anyone help me on this? Thanks a lot!
>
> Btw, should I set the security context of /etc/vsftpd/vsftpd.conf to
> vsftpd_conf_t
> or vsftpd_etc_t? I am confused about some existing context, such as
>
> #ls -dZ /etc/httpd/
> drwxr-xr-x  root     root     system_u:object_r:httpd_config_t /etc/httpd/
> #ls -Z /etc/httpd/conf/httpd.conf
> -rw-r--r--  root     root     system_u:object_r:httpd_config_t
> /etc/httpd/conf/httpd.conf
>
> BUT, 
> # ls -dZ /etc/snmp/
> drwxr-xr-x  root     root     system_u:object_r:etc_t          /etc/snmp/
> # ls -Z /etc/snmp/snmpd.conf
> -rw-r--r--  root     root     system_u:object_r:snmpd_etc_t   
> /etc/snmp/snmpd.conf
>
>  
Usually I would only setup an conf file or etc file if a certain domain 
needs the ability to write to it.

BTW if you look at strict policy, there is a ftpd context that works on 
vsftpd.  I would recommend you
look at the one in rawhide.

> Thanks,
>
> James
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  


--


--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-selinux-list