Re: [Proftpd-user] SElinux question on 1.3.6

> On Nov 14, 2017, at 2:39 AM, Paul Howarth <[email protected]> wrote:
> 
> On 2017-11-13 20:52, Philip Prindeville wrote:
>> Hi all (and TJ and Paul in particular),
>> I’m running 1.3.6 on a Fedora 26 host, with the SElinux targeted policy.
>> mod_delay is trying to open /var/proftpd/delay.tab but failing.  Looks
>> like missing policy:
>> type=AVC msg=audit(1510602554.692:3357): avc:  denied  { write } for
>> pid=29681 comm="proftpd" name="proftpd" dev="sda6" ino=4456449
>> scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
>> tcontext=unconfined_u:object_r:var_t:s0 tclass=dir permissive=0
>> what are the correct settings?  I’ll try to test them then submit a
>> fix for Fedora/RHEL/Centos/EPEL.
> 
> Not missing policy, missing configuration. The default delay table location isn't going to play well with SELinux; try this:
> 
>  DelayTable                    /run/proftpd/proftpd.delay
> 
> Here's what I have for mod_delay:
> 
> # Login delays to slow down clients using multiple logins
> <IfModule mod_delay.c>
>  # This gets cleared on reboot
>  DelayTable                    /run/proftpd/proftpd.delay
> 
>  # Allow root to use "ftpdctl delay ..."
>  DelayControlsACLS             all allow user root
> 
>  # Configure successful logins to be delayed by 2 secs
>  DelayOnEvent                  PASS 2000ms
> 
>  # Configure failed logins to be delayed by 5 secs
>  DelayOnEvent                  FailedLogin 5s
> </IfModule>
> 
> Cheers, Paul.


Are you sure this is adequate?  I’m looking at:

http://www.proftpd.org/docs/modules/mod_delay.html

where it says (about DelayTable):

"Note that timing data is kept across daemon stop/starts.”

and assuming that includes reboots, which implies that it can’t be /run since that’s a tmpfs on Fedora.

-Philip



------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html