SELinux, vsftpd, ftp_home_dir difference from 5.5 to 6.1

Support for security such as Firewalls and securing linux
Post Reply
KenGreen
Posts: 12
Joined: 2009/11/20 13:31:46

SELinux, vsftpd, ftp_home_dir difference from 5.5 to 6.1

Post by KenGreen » 2012/02/23 22:09:26

I'm trying to get my head around the behaviour of vsftpd with respect to file that originate in a users home directory.

On 5.5 if I login as me and touch a file in my home directory it gets labelled as "user_u:object_r:user_home_t".
If I then mv the file into /var/ftp/pub then try and point an ftp client at it directory the file in invisible and I get nice warnings in the messages file that SELinux is preventing access. If I then poke the ftp_home_dir boolean, I can make the file appear and disappear at will.

When I try the same procedure under 6.1 I get a totally different result.
The labelling is different, the files now show up as "unconfined_u:object_r:user_home_t:s0"
But when I move them into the /var/ftp/pub directory they are accessible all the time, regardless the ftp_home_dir boolean.

The vsftpd is labelled

[root@station1 ip]# ps -Zp 1485
LABEL PID TTY TIME CMD
unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 1485 ? 00:00:00 vsftpd

If for instance I miss-label a file in pub as being an http file, such as

chcon system_u:object_r:httpd_sys_content_t:s0 example.file

This will then not be accessible.

Have I misunderstood the role of the ftp_home_dir boolean (quite likely, I'm good at misunderstanding) or in one of the version of the OS acting improperly?

Thanks for any light anyone can shed on this.

User avatar
TrevorH
Site Admin
Posts: 33218
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

SELinux, vsftpd, ftp_home_dir difference from 5.5 to 6.1

Post by TrevorH » 2012/02/23 22:28:59

What does `sestatus` say on the 6.x system?

KenGreen
Posts: 12
Joined: 2009/11/20 13:31:46

Re: SELinux, vsftpd, ftp_home_dir difference from 5.5 to 6.1

Post by KenGreen » 2012/02/23 23:42:51

Sorry, I forget to say I was using "targeted"

[root@kgcc70 isos]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted

Thanks in advance

Post Reply