Bug 465219 - man page ftpd_selinux bugs
man page ftpd_selinux bugs
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
5.1
All Linux
high Severity medium
: rc
: ---
Assigned To: Daniel Walsh
BaseOS QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-10-02 04:47 EDT by Lutz Lange
Modified: 2009-01-20 16:29 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-01-20 16:29:53 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Lutz Lange 2008-10-02 04:47:35 EDT
Description of problem:
this man page states that you should do this:
If you want to make this permanant, i.e. survive a relabel, you must  add
       an entry to the file_contexts.local file.

       /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
              /var/ftp(/.*)? system_u:object_r:public_content_t  /var/ftp/incom-
              ing(/.*)? system_u:object_r:public_content_rw_t

There are two problems here.
1. this shows one line to put into file_contexts.local. This will result in an error, since it actually is two lines. 
Suggested Action: add a newline between ...:public_content_t /var/ft...

2. on rhel5 this does not actually do what you want, since the now first line allready exists and confilicts with an existing poklicy.
Suggested action: rewrite the man page to reflect this. Something like: add only the last line if your default policy includes a preset context for /var/ftp(/.*)? already.



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Daniel Walsh 2008-10-10 15:14:57 EDT
Fixed in selinux-policy-2.4.6-164.el5
Comment 5 Lutz Lange 2008-10-17 05:24:20 EDT
Today i found out that you should indeed not edit  /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
manually since it is managed dynamically by libsemanage.

Instead i should use: 
semanage fcontext -a -t public_content_rw_t /var/ftp/incoming(/.*)?

If this is already in your fix, please disregard this comment.
Comment 6 Daniel Walsh 2008-10-17 08:43:34 EDT
That is what the man page says.
Comment 9 errata-xmlrpc 2009-01-20 16:29:53 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-0163.html

Note You need to log in before you can comment on or make changes to this bug.