Attachment 311565 Details for Bug 454945 – ftpd_selinux.8.diff

[patch] ftpd_selinux.8.diff

ftpd_selinux.8.diff (text/plain), 4.29 KB, created by Dominick Grift on 2008-07-11 11:42:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dominick Grift

Created: 2008-07-11 11:42:07 UTC

Size: 4.29 KB

patch

obsolete

>Index: /home/domg472/Workspace/refpolicy_trunk/man/man8/ftpd_selinux.8
>===================================================================
>--- /home/domg472/Workspace/refpolicy_trunk/man/man8/ftpd_selinux.8	(revision 2758)
>+++ /home/domg472/Workspace/refpolicy_trunk/man/man8/ftpd_selinux.8	(working copy)
>@@ -1,52 +1,65 @@
>-.TH  "ftpd_selinux"  "8"  "17 Jan 2005" "dwalsh@redhat.com" "ftpd Selinux Policy documentation"
>+.TH  "ftpd_selinux"  "8"  "17 Jan 2005" "dwalsh@redhat.com" "ftpd SELinux policy documentation"
> .SH "NAME"
>-ftpd_selinux \- Security Enhanced Linux Policy for the ftp daemon
>+.PP
>+ftpd_selinux \- Security-Enhanced Linux policy for ftp daemons.
> .SH "DESCRIPTION"
>-
>-Security-Enhanced Linux secures the ftpd server via flexible mandatory access
>-control.  
>+.PP
>+Security-Enhanced Linux provides security for ftp daemons via flexible mandatory access control.
> .SH FILE_CONTEXTS
>-SELinux requires files to have an extended attribute to define the file type. 
>-Policy governs the access daemons have to these files. 
>-If you want to share files anonymously, you must label the files and directories public_content_t.  So if you created a special directory /var/ftp, you would need to label the directory with the chcon tool.
>+.PP
>+SELinux requires files to have a file type. File types may be specified with semanage and are restored with restorecon.  Policy governs the access that daemons have to files.
> .TP
>-chcon -R -t public_content_t /var/ftp
>+Allow ftp servers to read the /var/ftp directory by adding the public_content_t file type to the directory and by restoring the file type.
>+.PP
>+.B
>+semanage fcontext -a -t public_content_t "/var/ftp(/.*)?"
> .TP
>-If you want to setup a directory where you can upload files to you must label the files and directories public_content_rw_t.  So if you created a special directory /var/ftp/incoming, you would need to label the directory with the chcon tool.
>+.B
>+restorecon -R -v /var/ftp
> .TP
>-chcon -t public_content_rw_t /var/ftp/incoming
>+Allow ftp servers to read and write /var/tmp/incoming by adding the public_content_rw_t type to the directory and by restoring the file type.  This also requires the allow_ftpd_anon_write boolean to be set.
>+.PP
>+.B
>+semanage fcontext -a -t public_content_rw_t "/var/ftp/incoming(/.*)?"
> .TP
>-You must also turn on the boolean allow_ftpd_anon_write.
>+.B
>+restorecon -R -v /var/ftp/incoming
>+
>+.SH BOOLEANS
>+.PP
>+SELinux policy is based on least privilege required and may also be customizable by setting a boolean with setsebool.
> .TP
>-setsebool -P allow_ftpd_anon_write=1
>+Allow ftp servers to read and write files with the public_content_rw_t file type.
>+.PP
>+.B
>+setsebool -P allow_ftpd_anon_write on
> .TP
>-If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
>+Allow ftp servers to read or write files in the user home directories.
>+.PP
>+.B
>+setsebool -P ftp_home_dir on
> .TP
>-/etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
>-.br
>-/var/ftp(/.*)? system_u:object_r:public_content_t
>-/var/ftp/incoming(/.*)? system_u:object_r:public_content_rw_t
>-
>-.SH BOOLEANS
>-SELinux ftp daemon policy is customizable based on least access required.  So by 
>-default SElinux does not allow users to login and read their home directories.
>-.br
>-If you are setting up this machine as a ftpd server and wish to allow users to access their home
>-directorories, you need to set the ftp_home_dir boolean. 
>+Allow ftp servers to login and read or write all files on the system.
>+.PP
>+.B
>+setsebool -P allow_ftpd_full_access on
> .TP
>-setsebool -P ftp_home_dir 1
>+Allow ftp servers to use cifs for public file transfer services.
>+.PP
>+.B
>+setsebool -P allow_ftpd_use_cifs on
> .TP
>-ftpd can run either as a standalone daemon or as part of the xinetd domain.  If you want to run ftpd as a daemon you must set the ftpd_is_daemon boolean.
>+Allow ftp servers to use nfs for public file transfer services.
>+.PP
>+.B
>+setsebool -P allow_ftpd_use_nfs on
> .TP
>-setsebool -P ftpd_is_daemon 1
>-.br
>-service vsftpd restart
>-.TP
> system-config-selinux is a GUI tool available to customize SELinux policy settings.
>-.SH AUTHOR	
>+.SH AUTHOR
>+.PP
> This manual page was written by Dan Walsh <dwalsh@redhat.com>.
> 
> .SH "SEE ALSO"
>-selinux(8), ftpd(8), chcon(1), setsebool(8)
>+.PP
> 
>-
>+selinux(8), ftpd(8), setsebool(8), semanage(8), restorecon(8)

Actions: View | Diff

Attachments on bug 454945: 311521 | 311557 | 311565 | 312074