Allowing vsftpd access for user's home directory

[Ketut Mahaindra]

Hello all,

I have installation of FC5.
I want to make vsftpd run with chroot environment of user home directory.
So far it does not work because SELinux prevents the vsftpd to access the
home directory.

What's the best way to configure SELinux for this purpose?
I don't want to disable it.
I have been googling it around but so far has not came up with any easy
solution.

Any help will be appreciated.

P.S.
- I have the following AVC error messages:
  avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
tclass=capability
  avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd" capability=2
scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
tclass=capability  
 
-- 
Best regards,
 
Ketut Mahaindra (Ito)

[Kayvan A. Sylvan]

On Thu, May 11, 2006 at 01:17:28PM +0800, Ketut Mahaindra wrote:
>  Hello all,
>  
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>  
>  What's the best way to configure SELinux for this purpose?
>  I don't want to disable it.
>  I have been googling it around but so far has not came up with any easy
>  solution.
>  
>  Any help will be appreciated.
>  
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd" capability=2
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability   
You can use audit2allow and the local.te file to allow what you want.

See http://www.samag.com/documents/s=9820/sam0508a/0508a.htm

Best regards,

			---Kayvan
-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)

[Ketut Mahaindra]

Hello,

I tried your suggestion in conjunction with the FC5 SELinux FAQ:
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2958106

So, I did the following
# audit2allow -m local -l -i /var/log/audit/audit.log

Which give me something like:

module local 1.0;
require {
        class capability { dac_override dac_read_search };

        type ftpd_t;
};
allow ftpd_t self:capability { dac_override dac_read_search };

So, naturally I want it to be inside a file for compilation.
Then I did:

# audit2allow -m local -l -i /var/log/audit/audit.log > local.te
# checkmodule -M -m -o local.mod local.te
# semodule_package -o local.pp -m local.mod
# semodule -i local.pp

But, on that last step I get an error message "semodule:  Could not read
file 'local.pp':"
It's strange, because the file local.pp is created normally by the
semodule_package command.

Did I miss anything?

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: Kayvan A. Sylvan [mailto:[e-mail]] 
Sent: Thursday, May 11, 2006 1:29 PM
To: Ketut Mahaindra
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Allowing vsftpd access for user's home directory

On Thu, May 11, 2006 at 01:17:28PM +0800, Ketut Mahaindra wrote:
>  Hello all,
>  
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>  
>  What's the best way to configure SELinux for this purpose?
>  I don't want to disable it.
>  I have been googling it around but so far has not came up with any easy
>  solution.
>  
>  Any help will be appreciated.
>  
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd"
capability=2
>  scontext=system_u:system_r:ftpd_t:s0
> tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability   
You can use audit2allow and the local.te file to allow what you want.

See http://www.samag.com/documents/s=9820/sam0508a/0508a.htm

Best regards,

			---Kayvan
-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena
(8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)

[Paul Howarth]

On Thu, 2006-05-11 at 14:32 +0800, Ketut Mahaindra wrote:
>   Hello,
>  
>  I tried your suggestion in conjunction with the FC5 SELinux FAQ:
>  http://fedora.redhat.com/docs/selinux-faq-fc5/#id2958106
>  
>  So, I did the following
>  # audit2allow -m local -l -i /var/log/audit/audit.log
>  
>  Which give me something like:
>  
>  module local 1.0;
>  require {
>          class capability { dac_override dac_read_search };
>  
>          type ftpd_t;
>  };
>  allow ftpd_t self:capability { dac_override dac_read_search };
>  
>  So, naturally I want it to be inside a file for compilation.
>  Then I did:
>  
>  # audit2allow -m local -l -i /var/log/audit/audit.log > local.te
>  # checkmodule -M -m -o local.mod local.te
>  # semodule_package -o local.pp -m local.mod
>  # semodule -i local.pp
>  
>  But, on that last step I get an error message "semodule:  Could not read
>  file 'local.pp':"
>  It's strange, because the file local.pp is created normally by the
>  semodule_package command.
>  
>  Did I miss anything? 
Try this:

Move the files you've used for this process (the .te/.pp files etc.) to
a new, empty directory (I used /root/selinux.local) and change to that
directory. Then do:

# chcon -Rh -t usr_t .

Then try the semanage command again.

Paul.

[Ketut Mahaindra]

Hello,

Tried that as well, I am using ~/selinux/local
After the change by chcon

# ls -Z ~/selinux
drwxr-xr-x  root     root     user_u:object_r:usr_t            local

# ls -Z ~/selinux/local
-rw-r--r--  root     root     user_u:object_r:usr_t            local.mod
-rw-r--r--  root     root     user_u:object_r:usr_t            local.pp
-rw-r--r--  root     root     user_u:object_r:usr_t            local.te

# semodule -i local.pp
libsemanage.semanage_commit_sandbox: Could not remove previous backup
/etc/selinux/targeted/modules/previous.

In fact I have now solved the issue.
It involves enabling the boolean as you suggested before :

# setsebool -P ftp_home_dir 1
# setsebool -P ftpd_is_daemon 1

Plus, changing the corresponding user home directory ACL to be less
restrictive than 0700 -> 0755
( thanks to Thomas Bleher for the hint )

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: Paul Howarth
Sent: Thursday, May 11, 2006 2:53 PM
To: Ketut Mahaindra
Cc: fedora-selinux-list(a)redhat.com
Subject: RE: Allowing vsftpd access for user's home directory

On Thu, 2006-05-11 at 14:32 +0800, Ketut Mahaindra wrote:
>   Hello,
>  
>  I tried your suggestion in conjunction with the FC5 SELinux FAQ:
>  http://fedora.redhat.com/docs/selinux-faq-fc5/#id2958106
>  
>  So, I did the following
>  # audit2allow -m local -l -i /var/log/audit/audit.log
>  
>  Which give me something like:
>  
>  module local 1.0;
>  require {
>          class capability { dac_override dac_read_search };
>  
>          type ftpd_t;
>  };
>  allow ftpd_t self:capability { dac_override dac_read_search };
>  
>  So, naturally I want it to be inside a file for compilation.
>  Then I did:
>  
>  # audit2allow -m local -l -i /var/log/audit/audit.log > local.te
>  # checkmodule -M -m -o local.mod local.te
>  # semodule_package -o local.pp -m local.mod
>  # semodule -i local.pp
>  
>  But, on that last step I get an error message "semodule:  Could not read
>  file 'local.pp':"
>  It's strange, because the file local.pp is created normally by the
>  semodule_package command.
>  
>  Did I miss anything? 
Try this:

Move the files you've used for this process (the .te/.pp files etc.) to
a new, empty directory (I used /root/selinux.local) and change to that
directory. Then do:

# chcon -Rh -t usr_t .

Then try the semanage command again.

Paul.

[Ketut Mahaindra]

On the following problem:

# semodule -i local.pp
libsemanage.semanage_commit_sandbox: Could not remove previous backup
/etc/selinux/targeted/modules/previous.
semodule:  Failed!

-----

I found the following on this list April thread to temporarily fix the
issue:

Stephen Smalley wrote:
>  Looks like the type isn't getting preserved
>  on /etc/selinux/$SELINUXTYPE/modules/{active,previous} upon updates -
>  they are reverting from semanage_store_t to selinux_config_t (the type
>  on their parent directory.  We either need to put semanage_store_t
>  on /etc/selinux/$SELINUXTYPE/modules as well or we need to make
>  libsemanage preserve the types.
>   
Aurelien Bompard wrote:
>  OK, so it's something to fix at the main policy level, right (I
> can't do
>  anything about it) ? 
Stephen Smalley wrote:
>  Correct.  You can restorecon -R /etc/selinux/targeted to temporarily
>  fix it, but it will keep reverting on each transaction.  chcon -t
>  semanage_store_t /etc/selinux/targeted/modules may solve the problem
>  with keeping the type on the active and previous subdirectories, but
>  ultimately needs to be applied in the policy.   
-----

So, I did:
# restorecon -R /etc/selinux/targeted
# semodule -i local.pp

And I no longer have the failed message above.
This helps me to solve to make local policy module for ftpd access over
resources with type httpd_sys_content_t
( enabling ftp access over user web resources )

:)

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: fedora-selinux-list-bounces(a)redhat.com
[mailto:[e-mail]] On Behalf Of Ketut Mahaindra
Sent: Thursday, May 11, 2006 4:47 PM
To: fedora-selinux-list(a)redhat.com
Subject: RE: Allowing vsftpd access for user's home directory

 
Hello,

Tried that as well, I am using ~/selinux/local
After the change by chcon

# ls -Z ~/selinux
drwxr-xr-x  root     root     user_u:object_r:usr_t            local

# ls -Z ~/selinux/local
-rw-r--r--  root     root     user_u:object_r:usr_t            local.mod
-rw-r--r--  root     root     user_u:object_r:usr_t            local.pp
-rw-r--r--  root     root     user_u:object_r:usr_t            local.te

# semodule -i local.pp
libsemanage.semanage_commit_sandbox: Could not remove previous backup
/etc/selinux/targeted/modules/previous.

In fact I have now solved the issue.
It involves enabling the boolean as you suggested before :

# setsebool -P ftp_home_dir 1
# setsebool -P ftpd_is_daemon 1

Plus, changing the corresponding user home directory ACL to be less
restrictive than 0700 -> 0755
( thanks to Thomas Bleher for the hint )

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: Paul Howarth
Sent: Thursday, May 11, 2006 2:53 PM
To: Ketut Mahaindra
Cc: fedora-selinux-list(a)redhat.com
Subject: RE: Allowing vsftpd access for user's home directory

On Thu, 2006-05-11 at 14:32 +0800, Ketut Mahaindra wrote:
>   Hello,
>  
>  I tried your suggestion in conjunction with the FC5 SELinux FAQ:
>  http://fedora.redhat.com/docs/selinux-faq-fc5/#id2958106
>  
>  So, I did the following
>  # audit2allow -m local -l -i /var/log/audit/audit.log
>  
>  Which give me something like:
>  
>  module local 1.0;
>  require {
>          class capability { dac_override dac_read_search };
>  
>          type ftpd_t;
>  };
>  allow ftpd_t self:capability { dac_override dac_read_search };
>  
>  So, naturally I want it to be inside a file for compilation.
>  Then I did:
>  
>  # audit2allow -m local -l -i /var/log/audit/audit.log > local.te
>  # checkmodule -M -m -o local.mod local.te
>  # semodule_package -o local.pp -m local.mod
>  # semodule -i local.pp
>  
>  But, on that last step I get an error message "semodule:  Could not read
>  file 'local.pp':"
>  It's strange, because the file local.pp is created normally by the
>  semodule_package command.
>  
>  Did I miss anything? 
Try this:

Move the files you've used for this process (the .te/.pp files etc.) to
a new, empty directory (I used /root/selinux.local) and change to that
directory. Then do:

# chcon -Rh -t usr_t .

Then try the semanage command again.

Paul.


--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Paul Howarth]

On Thu, 2006-05-11 at 13:17 +0800, Ketut Mahaindra wrote:
>  Hello all,
>  
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>  
>  What's the best way to configure SELinux for this purpose?
>  I don't want to disable it.
>  I have been googling it around but so far has not came up with any easy
>  solution.
>  
>  Any help will be appreciated.
>  
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd" capability=2
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability   
Have you set the ftp_home_dir boolean as suggested in "man
ftpd_selinux"?

Paul.

[Ketut Mahaindra]

Hello,

Yes, I have tried to do the following as recommended by man ftpd_selinux
# setsebool -P ftp_home_dir 1
# setsebool -P ftpd_is_daemon 1

But I still get the same AVC error messages each time an FTP client attempt
to connect.

Here is what the audit.log give me:

type=USER_AUTH msg=audit(1147327523.025:325): user pid=3608 uid=0 auid=500
msg='PAM: authentication acct=kmahaindra : exe="/usr/sbin/vsftpd"
(hostname=172.27.77.156, addr=172.27.77.156, terminal=? res=success)'
type=USER_ACCT msg=audit(1147327523.025:326): user pid=3608 uid=0 auid=500
msg='PAM: accounting acct=kmahaindra : exe="/usr/sbin/vsftpd"
(hostname=172.27.77.156, addr=172.27.77.156, terminal=? res=success)'
type=CRED_ACQ msg=audit(1147327523.029:327): user pid=3608 uid=0 auid=500
msg='PAM: setcred acct=kmahaindra : exe="/usr/sbin/vsftpd"
(hostname=172.27.77.156, addr=172.27.77.156, terminal=? res=success)'
type=AVC msg=audit(1147327523.029:328): avc:  denied  { dac_override } for
pid=3612 comm="vsftpd" capability=1 scontext=user_u:system_r:ftpd_t:s0
tcontext=user_u:system_r:ftpd_t:s0 tclass=capability
type=AVC msg=audit(1147327523.029:328): avc:  denied  { dac_read_search }
for  pid=3612 comm="vsftpd" capability=2 scontext=user_u:system_r:ftpd_t:s0
tcontext=user_u:system_r:ftpd_t:s0 tclass=capability
type=SYSCALL msg=audit(1147327523.029:328): arch=40000003 syscall=61
success=no exit=-13 a0=66c6f6 a1=0 a2=6732dc a3=1 items=1 pid=3612 auid=500
uid=0 gid=0 euid=0 suid=500 fsuid=0 egid=0 sgid=500 fsgid=0 comm="vsftpd"
exe="/usr/sbin/vsftpd"
type=CWD msg=audit(1147327523.029:328):  cwd="/home/kmahaindra"
type=PATH msg=audit(1147327523.029:328): item=0 name="." flags=3

Any other clues?
Or perhaps I was missing something / some steps?

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: Paul Howarth [mailto:[e-mail]] 
Sent: Thursday, May 11, 2006 1:52 PM
To: Ketut Mahaindra
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Allowing vsftpd access for user's home directory

On Thu, 2006-05-11 at 13:17 +0800, Ketut Mahaindra wrote:
>  Hello all,
>  
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>  
>  What's the best way to configure SELinux for this purpose?
>  I don't want to disable it.
>  I have been googling it around but so far has not came up with any easy
>  solution.
>  
>  Any help will be appreciated.
>  
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd"
capability=2
>  scontext=system_u:system_r:ftpd_t:s0
> tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability   
Have you set the ftp_home_dir boolean as suggested in "man
ftpd_selinux"?

Paul.

[Thomas Bleher]

* Ketut Mahaindra <kmahaindra(a)axalto.com&gt; [2006-05-11 07:19]:
>  Hello all,
>  
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>  
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd" capability=2
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability   
This means that vsftpd can't access some files or directories because it
does not have DAC rights on it. Probably some home directory is mode
0700. Either you change the rights on the directory or you allow the
capabilities as discussed in this thread.

Thomas

[Ketut Mahaindra]

Hello,

Thanks a lot, that solves it!
Of course prior to that I need to enable the corresponding boolean
# setsebool -P ftp_home_dir 1
# setsebool -P ftpd_is_daemon 1

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: Thomas Bleher
Sent: Thursday, May 11, 2006 3:17 PM
To: Ketut Mahaindra
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Allowing vsftpd access for user's home directory

* Ketut Mahaindra <kmahaindra(a)axalto.com&gt; [2006-05-11 07:19]:
>  Hello all,
>  
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>  
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd"
capability=2
>  scontext=system_u:system_r:ftpd_t:s0
> tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability   
This means that vsftpd can't access some files or directories because it
does not have DAC rights on it. Probably some home directory is mode
0700. Either you change the rights on the directory or you allow the
capabilities as discussed in this thread.

Thomas

[Thomas Bleher]

* Thomas Bleher <bleher(a)informatik.uni-muenchen.de&gt; [2006-05-11 09:16]:
>  * Ketut Mahaindra <kmahaindra(a)axalto.com&gt; [2006-05-11 07:19]:
>  > - I have the following AVC error messages:
>  >   avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  > scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  > tclass=capability
>  >   avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd"
> capability=2
>  > scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  > tclass=capability  
>  
>  This means that vsftpd can't access some files or directories because it
>  does not have DAC rights on it. Probably some home directory is mode
>  0700. Either you change the rights on the directory or you allow the
>  capabilities as discussed in this thread. 
BTW: Is there some way to get more information out of the kernel about
which file is being accessed? This would be really helpful in debugging
why an application needs dac_override.

Thomas

[Stephen Smalley]

On Thu, 2006-05-11 at 10:57 +0200, Thomas Bleher wrote:
>  * Thomas Bleher <bleher(a)informatik.uni-muenchen.de&gt; [2006-05-11
> 09:16]:
>  > * Ketut Mahaindra <kmahaindra(a)axalto.com&gt; [2006-05-11 07:19]:
>  > > - I have the following AVC error messages:
>  > >   avc:  denied  { dac_override } for  pid=9099 comm="vsftpd"
> capability=1
>  > > scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  > > tclass=capability
>  > >   avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd"
> capability=2
>  > > scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  > > tclass=capability  
>  > 
>  > This means that vsftpd can't access some files or directories because it
>  > does not have DAC rights on it. Probably some home directory is mode
>  > 0700. Either you change the rights on the directory or you allow the
>  > capabilities as discussed in this thread.
>  
>  BTW: Is there some way to get more information out of the kernel about
>  which file is being accessed? This would be really helpful in debugging
>  why an application needs dac_override. 
If you have syscall auditing enabled, then a syscall audit record should
be emitted at syscall exit that includes the path data whenever an AVC
audit record was generated during the syscall processing.  

-- 
Stephen Smalley
National Security Agency

[Daniel J Walsh]

Ketut Mahaindra wrote:
>  Hello all,
>
>  I have installation of FC5.
>  I want to make vsftpd run with chroot environment of user home directory.
>  So far it does not work because SELinux prevents the vsftpd to access the
>  home directory.
>
>  What's the best way to configure SELinux for this purpose?
>  I don't want to disable it.
>  I have been googling it around but so far has not came up with any easy
>  solution.
>
>  Any help will be appreciated.
>
>  P.S.
>  - I have the following AVC error messages:
>    avc:  denied  { dac_override } for  pid=9099 comm="vsftpd" capability=1
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability
>    avc:  denied  { dac_read_search } for  pid=9099 comm="vsftpd" capability=2
>  scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:system_r:ftpd_t:s0
>  tclass=capability  
>   
>     
I added these to policy when homedirs are used. 

You might want to look at man ftpd_selinux.

IF you want to share files between ftp and html you might want to label 
them public_content_t.