On 3 October 2010 21:49, Dominick Grift <domg472@xxxxxxxxx> wrote:
The above access vector (ftpd_t self:capability sys_admin;) should be allowed indeed.On Sun, Oct 03, 2010 at 09:17:58PM +0100, Aaron Gray wrote:
> On 3 October 2010 21:03, Dominick Grift <domg472@xxxxxxxxx> wrote:
>
> > On Sun, Oct 03, 2010 at 08:48:59PM +0100, Aaron Gray wrote:
> > > Hi,
> > >
> > > I had a fresh F11 server install, but with out VSFTPD, then I installed
> > > VSFTPD, but it is blocked by SELinux.
> > >
> > > I turn off enforcement and FTP runs fine.
> > >
> > > Is there some script or proceedure I can run to allow VSFTPD on F11 or do
> > I
> > > have to do a reinstall of Fedora ?
> > >
> > > Many thanks in advance,
> >
> > Can you enclose the AVC denials that you are seeying. With those you should
> > be able to fix any issues. AVC denials are (usually) logged to
> > /var/log/audit/audit.log and can easily be listed with ausearch command.
> >
> >
> First initial syscall :-
>
> time->Sun Oct 3 21:12:24 2010
> type=SYSCALL msg=audit(1286136744.107:21351): arch=40000003 syscall=120
> success=no exit=-1 a0=28000011 a1=0 a2=6f4334 a3=6f4334 items=0 ppid=1
> pid=1903 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=(none) ses=5 comm="vsftpd" exe="/usr/sbin/vsftpd"
> subj=unconfined_u:system_r:ftpd_t:s0 key=(null)
> type=AVC msg=audit(1286136744.107:21351): avc: denied { sys_admin } for
> pid=1903 comm="vsftpd" capability=21
> scontext=unconfined_u:system_r:ftpd_t:s0
> tcontext=unconfined_u:system_r:ftpd_t:s0 tclass=capability
You can do this by piping the AVC denial line into the imput stream of the audit2allow command with the -M option and module name parameter:
echo "avc: denied { sys_admin } for pid=1903 comm="vsftpd" capability=21 scontext=unconfined_u:system_r:ftpd_t:s0 tcontext=unconfined_u:system_r:ftpd_t:s0 tclass=capability" | audit2allow -M myftpd
Then you can install the generated custom module with the semodule command with the -i option and the module parameter:
semodule -i myftpd.pp
Not the i prefix the module name with "my". This is done that this module will not overwrite the existing ftpd module.
Any more AVC denials shown?
Wow, thanks, I will try this when I get the time and the right head on. Get back to you later.
Thanks,
Aaron
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
