Bug 498375 - Selinux prevents access to /var/run/proftpd.score
Selinux prevents access to /var/run/proftpd.score
Status: CLOSED ERRATA
Product: Fedora EPEL
Classification: Fedora
Component: proftpd (Show other bugs)
el5
All Linux
low Severity medium
: ---
: ---
Assigned To: Paul Howarth
Fedora Extras Quality Assurance
ActualBug
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-04-30 03:44 EDT by Christian Nolte
Modified: 2009-09-22 18:25 EDT (History)
3 users (show)

See Also:
Fixed In Version: 1.3.2a-5.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-09-22 18:25:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Christian Nolte 2009-04-30 03:44:30 EDT
This is much rather a selinux problem, but I don't know how the policy for EPEL is to report these problems (should these be reported to RHEL5-selinux?), so I am reporting this here:

The default selinux context for proftd.score is:

system_u:object_r:var_run_t

It must be:

system_u:object_r:ftpd_var_run_t

# rpm -q selinux-policy
selinux-policy-2.4.6-203.el5
Comment 1 Paul Howarth 2009-05-12 02:44:51 EDT
Try changing ScoreboardFile in your proftpd.conf to
/var/run/proftpd/proftpd.score
Comment 2 Christian Nolte 2009-05-12 05:15:23 EDT
Yes this works, but a default installation of proftpd does use /var/proftpd/proftpd.scoreboard

If we want to get this to work out-of-the-box (TM) we should either

 - add "ScoreboardFile /var/run/proftpd/proftpd.score" to the default proftpd.conf

or

 - change the selinux context for the default proftpd.conf
Comment 3 Paul Howarth 2009-05-12 05:58:34 EDT
Fixing the ScoreboardFile config item is the easiest fix since that's something that's already in the config file (pointing to /var/run/proftpd.score).

Fixing the SELinux context would also require a type transition rule adding to policy to ensure that if a new scoreboard file got created, it would have the correct context type.
Comment 4 Paul Howarth 2009-06-26 10:29:20 EDT
Easiest fix is actually just to remove the ScoreboardFile config item from proftpd.conf altogether; the default value of /var/run/proftpd/proftpd.scoreboard is fine as far as SELinux is concerned.

I'll do this in the next release, which I'm working on now.
Comment 5 Fedora Update System 2009-08-03 11:44:55 EDT
proftpd-1.3.2a-2.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/proftpd-1.3.2a-2.el5
Comment 6 Fedora Update System 2009-08-03 22:27:16 EDT
proftpd-1.3.2a-2.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update proftpd'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/EL-5/FEDORA-EPEL-2009-0175
Comment 7 Fedora Update System 2009-08-19 18:51:52 EDT
proftpd-1.3.2a-3.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/proftpd-1.3.2a-3.el5
Comment 8 Fedora Update System 2009-08-20 11:00:23 EDT
proftpd-1.3.2a-3.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update proftpd'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/EL-5/FEDORA-EPEL-2009-0320
Comment 9 Fedora Update System 2009-09-02 07:05:41 EDT
proftpd-1.3.2a-4.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/proftpd-1.3.2a-4.el5
Comment 10 Fedora Update System 2009-09-02 16:54:16 EDT
proftpd-1.3.2a-4.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update proftpd'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/EL-5/FEDORA-EPEL-2009-0382
Comment 11 Fedora Update System 2009-09-07 11:12:57 EDT
proftpd-1.3.2a-5.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/proftpd-1.3.2a-5.el5
Comment 12 Fedora Update System 2009-09-08 18:58:46 EDT
proftpd-1.3.2a-5.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update proftpd'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/EL-5/FEDORA-EPEL-2009-0397
Comment 13 Fedora Update System 2009-09-22 18:25:17 EDT
proftpd-1.3.2a-5.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.