Thanks a lot for your help. I installed FC4T3 to learn from its ftpd policy. However its policy seems not working well. After 'service vsftpd start', I cannot make ftp connection to it. Error messages are: ... 331 Please specify the password. Password: Error sending status request (Operation not permitted) Login failed. ftp> ls 230 Login successful. Passive mode address scan failure. Shouldn't happen! ftp> bye 215 UNIX Type: L8 I go through the targeted policy for ftpd and write my own policy for vsftpd on FC3. vsftpd.te ################################# # # Rules for the vsftpd_t domain. # daemon_domain(vsftpd, `, auth_chkpwd') etc_domain(vsftpd) can_network(vsftpd_t) vsftpd.fc ################################# /usr/sbin/vsftpd -- system_u:object_r:vsftpd_exec_t /var/run/vsftpd.pid -- system_u:object_r:vsftpd_var_run_t /etc/vsftpd/vsftpd.conf -- system_u:object_r:vsftpd_etc_t I know they are lots of scenarios missing here, like actions related to nfs and samba. I plan to keep adding more rules into these two files based on parsing avc error messages. Currently, the above policy works well on my home pc for both anonymous and non-anonymous ftp services without generating even one AVC error message. Interesting ?! James -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-selinux-list
