denied despite allow rule

Daniel J Walsh dwalsh at redhat.com
Mon Apr 2 15:43:12 UTC 2012


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/02/2012 10:42 AM, Maria Iano wrote:
> I'm confused about a situation where I'm getting denied avc messages even
> though there is an allow rule in place. What am I missing?
> 
> This is on RHEL 5.8 using the targeted policy. Here's an example. I have
> this avc message from this morning:
> 
> type=AVC msg=audit(1333372681.227:20002): avc:  denied  { append } for
> pid=3480 comm="vsftpd" 
> path="/LTS/eng-ng/snip/2012/03/20/STORY_Letters_for_Sun._3-4_1_66_610389Z/IMG_Cartoon_for_3-4.jpg_1_1_8F1363GR/IMG_Cartoon_for_3-4.jpg_1_1_8F1363GR.xml"
>
> 
dev=dm-8 ino=227640612 scontext=system_u:system_r:ftpd_t:s0
> tcontext=system_u:object_r:public_content_t:s0 tclass=file
> 
> but when I do sesearch it shows a matching allow rule:
> 
> # sesearch -s ftpd_t -t public_content_t -c file -p append -a Found 1 av
> rules: allow ftpd_t public_content_t : file { ioctl read write create
> getattr setattr lock append unlink link rename };
> 
> Found 5 role allow rules: allow system_r sysadm_r ; allow user_r sysadm_r
> ; allow user_r system_r ; allow sysadm_r user_r ; allow sysadm_r system_r
> ;
> 
> Thanks for any help you can give, Maria
> 
> -- selinux mailing list selinux at lists.fedoraproject.org 
> https://admin.fedoraproject.org/mailman/listinfo/selinux

If you want to make this work, you should label the content as
public_content_rw_t and then turn on allow_ftpd_anon_write boolean.

man ftpd_selinux
/SHARING
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk95yRAACgkQrlYvE4MpobMegQCg4/xlgVh8EQwhleE6O8e5n3VN
PKYAoL8la9SAVDzkNcHNvhYOjMkWTky/
=LOFt
-----END PGP SIGNATURE-----


More information about the selinux mailing list