How can I tell SELinux to give vsftpd write access in a specific directory?
- by Arcturus
Hello.
I've set up vsftpd on my Fedora 12 server, and I'd like to have the following configuration. Each user should have access to:
his home directory (/home/USER);
the web directory I created for him (/web/USER).
To achieve this, I first configured vsftpd to chroot each user to his home directory. Then, I created /web/USER with the correct permissions, and used mount --bind /web/USER /home/USER/Web so that the user may have access to /web/USER through /home/USER/Web.
I also turned on the SELinux boolean ftp_home_dir so that vsftpd is allowed to write in users' home directories.
This works very well, except that when a user tries to upload or rename a file in /home/USER/Web, SELinux forbids it because the change must also be done to /web/USER, and SELinux doesn't give vsftpd permission to write anything to that directory.
I know that I could solve the problem by turning on the SELinux boolean allow_ftpd_full_access, or ftpd_disable_trans. I also tried to use audit2allow to generate a policy, but what it does is generate a policy that gives ftpd write access to directories of type public_content_t; this is equivalent to turning on allow_ftpd_full_access, if I understood it correctly.
I'd like to know if it's possible to configure SELinux to allow FTP write access to the specific directory /web/USER and its contents, instead of disabling SELinux's FTP controls entirely.
