Re: [Proftpd-user] SElinux question on 1.3.6

On 2017-11-14 22:10, Philip Prindeville wrote:
>> On Nov 14, 2017, at 2:39 AM, Paul Howarth <[email protected]> wrote:
>> 
>> On 2017-11-13 20:52, Philip Prindeville wrote:
>>> Hi all (and TJ and Paul in particular),
>>> I’m running 1.3.6 on a Fedora 26 host, with the SElinux targeted 
>>> policy.
>>> mod_delay is trying to open /var/proftpd/delay.tab but failing.  
>>> Looks
>>> like missing policy:
>>> type=AVC msg=audit(1510602554.692:3357): avc:  denied  { write } for
>>> pid=29681 comm="proftpd" name="proftpd" dev="sda6" ino=4456449
>>> scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
>>> tcontext=unconfined_u:object_r:var_t:s0 tclass=dir permissive=0
>>> what are the correct settings?  I’ll try to test them then submit a
>>> fix for Fedora/RHEL/Centos/EPEL.
>> 
>> Not missing policy, missing configuration. The default delay table 
>> location isn't going to play well with SELinux; try this:
>> 
>>  DelayTable                    /run/proftpd/proftpd.delay
>> 
>> Here's what I have for mod_delay:
>> 
>> # Login delays to slow down clients using multiple logins
>> <IfModule mod_delay.c>
>>  # This gets cleared on reboot
>>  DelayTable                    /run/proftpd/proftpd.delay
>> 
>>  # Allow root to use "ftpdctl delay ..."
>>  DelayControlsACLS             all allow user root
>> 
>>  # Configure successful logins to be delayed by 2 secs
>>  DelayOnEvent                  PASS 2000ms
>> 
>>  # Configure failed logins to be delayed by 5 secs
>>  DelayOnEvent                  FailedLogin 5s
>> </IfModule>
>> 
>> Cheers, Paul.
> 
> 
> Are you sure this is adequate?  I’m looking at:
> 
> http://www.proftpd.org/docs/modules/mod_delay.html
> 
> where it says (about DelayTable):
> 
> "Note that timing data is kept across daemon stop/starts.”
> 
> and assuming that includes reboots, which implies that it can’t be
> /run since that’s a tmpfs on Fedora.

Well, you're right about that and it would depend on how important for 
your use case it would be to preserve the data across a reboot. If you 
need it to do that, you could create another directory on persistent 
storage (the default, /var/proftpd, or maybe a more FHS-friendly 
/var/lib/proftpd) and use that. You'd need to make its file context the 
same as /run/proftpd:

# mkdir /var/proftpd
# chmod 755 /var/proftpd
# semanage fcontext -a -e /run/proftpd /var/proftpd
# restorecon -rvF /var/proftpd

Cheers, Paul.





------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html