Summary: SELinux is preventing /usr/sbin/vsftpd "net_raw" access. Detailed Description: SELinux denied access requested by vsftpd. It is not expected that this access is required by vsftpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 Target Context unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 Target Objects None [ capability ] Source vsftpd Source Path /usr/sbin/vsftpd Port <Unknown> Host (removed) Source RPM Packages vsftpd-2.2.0-5.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-35.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.31.5-96.fc12.i686 #1 SMP Fri Oct 23 19:53:24 EDT 2009 i686 i686 Alert Count 0 First Seen Fri 30 Oct 2009 11:24:13 PM COT Last Seen Fri 30 Oct 2009 11:24:13 PM COT Local ID 8b7a8a22-c148-4195-8969-adefea8a5b59 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1256963053.500:21344): avc: denied { net_raw } for pid=28750 comm="vsftpd" capability=13 scontext=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability node=(removed) type=SYSCALL msg=audit(1256963053.500:21344): arch=40000003 syscall=120 success=no exit=-1 a0=40000011 a1=0 a2=fd1338 a3=fd1338 items=0 ppid=0 pid=28750 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=10 comm="vsftpd" exe="/usr/sbin/vsftpd" subj=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 key=(null) Hash String generated from selinux-policy-3.6.32-35.fc12,catchall,vsftpd,ftpd_t,ftpd_t,capability,net_raw audit2allow suggests: #============= ftpd_t ============== allow ftpd_t self:capability net_raw;
Why does vsftpd need raw access to the network?
There is no SOCK_RAW or SOCK_PACKET option (Vsftpd uses SOCK_STREAM only). Selinux blocks reading ftp command. There is no change in opening socket between vsftpd 2.1.2 (F11) and 2.2.0 (F12). I'm currently investigating differences between the versions cos 2.1.2 isn't affected.
The difference is known now. Vsftpd supports new option (unfortunately true by default) that switches forking process. The new option is: isolate_network (YES by default) Setting NO adjusts vsftpd behaviour to previous releases. The main difference is usage: - fork() (isolate_network=NO) - clone() (isolate_network=YES) Usage clone() creates cloned process sharing memory space. Is it an intention to block it with selinux?
Not sure what this has to do with using raw_network? Might be a kernel problem. Turning up ftp protection should not force me to give ftp a dangerous permission. Eric?
<unrelated> Dan, can we get setroubleshoot to show ausearch -i rather than the raw log data? </unrelated> node=(removed) type=SYSCALL msg=audit(10/31/2009 00:24:13.500:21344) : arch=i386 syscall=clone success=no exit=-1(Operation not permitted) a0=40000011 a1=0 a2=fd1338 a3=fd1338 items=0 ppid=0 pid=28750 auid=paris uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=10 comm=vsftpd exe=/usr/sbin/vsftpd subj=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 key=(null) node=(removed) type=AVC msg=audit(10/31/2009 00:24:13.500:21344) : avc: denied { net_raw } for pid=28750 comm=vsftpd capability=net_raw scontext=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 tclass=capability I definitely happened during the clone() syscall. I don't see it in the kernel, but I'm looking for why it happened. Seems very odd.
Sure send me a patch. :^)
Kernel issue. Note that vsftpd is not going to need CAP_SYS_ADMIN and that is correct behaviour :( http://marc.info/?l=linux-netdev&m=125727935613278&w=2
This bug appears to have been reported against 'rawhide' during the Fedora 12 development cycle. Changing version to '12'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
*** This bug has been marked as a duplicate of bug 537428 ***