F11 VSFTPD post install problem

[Aaron Gray]

On 3 October 2010 21:49, Dominick Grift <domg472 at gmail.com> wrote:

> On Sun, Oct 03, 2010 at 09:17:58PM +0100, Aaron Gray wrote:
> > On 3 October 2010 21:03, Dominick Grift <domg472 at gmail.com> wrote:
> >
> > > On Sun, Oct 03, 2010 at 08:48:59PM +0100, Aaron Gray wrote:
> > > > Hi,
> > > >
> > > > I had a fresh F11 server install, but with out VSFTPD, then I
> installed
> > > > VSFTPD, but it is blocked by SELinux.
> > > >
> > > > I turn off enforcement and FTP runs fine.
> > > >
> > > > Is there some script or proceedure I can run to allow VSFTPD on F11
> or do
> > > I
> > > > have to do a reinstall of Fedora ?
> > > >
> > > > Many thanks in advance,
> > >
> > > Can you enclose the AVC denials that you are seeying. With those you
> should
> > > be able to fix any issues. AVC denials are (usually) logged to
> > > /var/log/audit/audit.log and can easily be listed with ausearch
> command.
> > >
> > >
> > First initial syscall :-
> >
> > time->Sun Oct  3 21:12:24 2010
> > type=SYSCALL msg=audit(1286136744.107:21351): arch=40000003 syscall=120
> > success=no exit=-1 a0=28000011 a1=0 a2=6f4334 a3=6f4334 items=0 ppid=1
> > pid=1903 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> > tty=(none) ses=5 comm="vsftpd" exe="/usr/sbin/vsftpd"
> > subj=unconfined_u:system_r:ftpd_t:s0 key=(null)
> > type=AVC msg=audit(1286136744.107:21351): avc:  denied  { sys_admin } for
> >  pid=1903 comm="vsftpd" capability=21
> > scontext=unconfined_u:system_r:ftpd_t:s0
> > tcontext=unconfined_u:system_r:ftpd_t:s0 tclass=capability
>
> The above access vector (ftpd_t self:capability sys_admin;) should be
> allowed indeed.
>
> You can do this by piping the AVC denial line into the imput stream of the
> audit2allow command with the -M option and module name parameter:
>
> echo "avc:  denied  { sys_admin } for pid=1903 comm="vsftpd" capability=21
> scontext=unconfined_u:system_r:ftpd_t:s0
> tcontext=unconfined_u:system_r:ftpd_t:s0 tclass=capability" | audit2allow -M
> myftpd
>
> Then you can install the generated custom module with the semodule command
> with the -i option and the module parameter:
>
> semodule -i myftpd.pp
>
> Not the i prefix the module name with "my". This is done that this module
> will not overwrite the existing ftpd module.
>
> Any more AVC denials shown?
>
> Wow, thanks, I will try this when I get the time and the right head on. Get
back to you later.

Thanks,

Aaron
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/selinux/attachments/20101004/eb7081c2/attachment.html