On 12/06/2010 06:47 AM, Daniel J Walsh wrote:
I agree, and would like to look at the AVC's to understand what could have broken the labeling
Well - since it happened again this morning, here you go. On further investigation in backups, I previously had the user account that I use for the FTP based update with its home directory set to a location inside the /var/www/html tree. Since that unknowingly passed this rule, it silently worked. It was changed to a /home/ based directory instead a while ago - tripping this rule. But not consistently: FTP appears to at least partially work outside the home tree even with the rule active.
I *really* dislike landmines when doing routine system tasks.
Dec 7 07:14:19 10.96.1.9 setroubleshoot: SELinux is preventing the ftp daemon from writing files outside the home directory (./upgrade). For complete SELinux messages. run sealert -l e7787694-644e-4e4e-9b45-bd86c7eb33ce
sealert -l e7787694-644e-4e4e-9b45-bd86c7eb33ce
Summary:
SELinux is preventing the ftp daemon from writing files outside the home directory (./upgrade).
Detailed Description:
SELinux has denied the ftp daemon write access to directories outside the home directory (./upgrade). Someone has logged in via your ftp daemon and is trying to create or write a file. If you only setup ftp to allow anonymous ftp, this could signal a intrusion attempt.
Allowing Access:
If you do not want SELinux preventing ftp from writing files anywhere on the system you need to turn on the allow_ftpd_full_access boolean: "setsebool -P allow_ftpd_full_access=1"
The following command will allow this access:
setsebool -P allow_ftpd_full_access=1
Additional Information:
Source Context system_u:system_r:ftpd_t Target Context system_u:object_r:httpd_sys_content_t Target Objects ./upgrade [ dir ] Source vsftpd Source Path /usr/sbin/vsftpd Port <Unknown> Host XXXXXXXXXXXXXX Source RPM Packages vsftpd-2.1.0-2 Target RPM Packages Policy RPM selinux-policy-2.4.6-279.el5_5.2 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_ftpd_full_access Host Name XXXXXXXXXXXXX Platform Linux XXXXXXXXXXXX 2.6.18-194.26.1.el5 #1 SMP Tue Nov 9 12:54:40 EST 2010 i686 i686 Alert Count 17 First Seen Thu Dec 2 12:10:14 2010 Last Seen Tue Dec 7 07:14:19 2010 Local ID e7787694-644e-4e4e-9b45-bd86c7eb33ce Line Numbers
Raw Audit Messages
host=XXXXXXXXXXXXXXXXXXXX type=AVC msg=audit(1291734859.344:6678): avc: denied { write } for pid=1018 comm="vsftpd" name="upgrade" dev=dm-5 ino=1926503 scontext=system_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
host=XXXXXXXXXXXXXXXXXXXX type=SYSCALL msg=audit(1291734859.344:6678): arch=40000003 syscall=39 success=no exit=-13 a0=8e340d0 a1=1ff a2=802330 a3=1 items=0 ppid=1014 pid=1018 auid=502 uid=502 gid=100 euid=502 suid=502 fsuid=502 egid=100 sgid=100 fsgid=100 tty=(none) ses=1017 comm="vsftpd" exe="/usr/sbin/vsftpd" subj=system_u:system_r:ftpd_t:s0 key=(null)