SELinux Write access for vsftpd and samba
This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows machine. I am using ACLs so that permissions work nicely in Windows (I have a two user network). I've found that Samba, though working, is slow for file transfers, so I wanted to try FTP.
I'd like to keep using SELinux to keep things secure, but I'm running into trouble with accessing the files over FTP. I can read the files and write to my home directory. But I cannot write to files in /var/media (with the samba_share_t context).
I thought that allow_ftpd_use_cifs was supposed to handle that. I can get it to work with allow_ftpd_full_access, but I'd prefer to avoid this. What am I missing?
Here is the relevant info:
[mdurak@srv ~]$ ls -Z /var/media
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 docs
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 library
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 photos
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 projects
[mdurak@srv ~]$ sudo semanage boolean -l | grep ftp
ftp_home_dir (on , on) Allow ftp to read and write files in the user home directories
tftp_anon_write (off , off) Allow tftp to modify public files used for public file transfer services.
allow_ftpd_full_access (off , off) Allow ftp servers to login to local users and read/write all files on the system, governed by DAC.
allow_ftpd_use_cifs (on , on) Allow ftp servers to use cifs used for public file transfer services.
allow_ftpd_use_nfs (off , off) Allow ftp servers to use nfs used for public file transfer services.
allow_ftpd_anon_write (on , on) Allow ftp servers to upload files, used for public file transfer services. Directories must be labeled public_content_rw_t.
ftpd_use_passive_mode (off , off) Allow ftp servers to use bind to all unreserved ports for passive mode
ftpd_connect_db (off , off) Allow ftp servers to use connect to mysql database
httpd_enable_ftp_server (off , off) Allow httpd to act as a FTP server by listening on the ftp port.
[mdurak@srv ~]$ sudo semanage boolean -l | grep samba
samba_domain_controller (off , off) Allow samba to act as the domain controller, add users, groups and change passwords.
samba_portmapper (off , off) Allow samba to act as a portmapper
samba_enable_home_dirs (on , on) Allow samba to share users home directories.
samba_export_all_ro (off , off) Allow samba to share any file/directory read only.
samba_export_all_rw (off , off) Allow samba to share any file/directory read/write.
use_samba_home_dirs (off , off) Support SAMBA home directories
samba_create_home_dirs (off , off) Allow samba to create new home directories (e.g. via PAM)
cdrecord_read_content (off , off) Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files
allow_smbd_anon_write (off , off) Allow samba to modify public files used
This should be easy enough I think, but I'm new to SELinux. I have a CentOS 6 file server. I have some LVM file systems at /var/media and I want to use both Samba and FTP to share them with a Windows machine. I am using ACLs so that permissions work nicely in Windows (I have a two user network). I've found that Samba, though working, is slow for file transfers, so I wanted to try FTP.
I'd like to keep using SELinux to keep things secure, but I'm running into trouble with accessing the files over FTP. I can read the files and write to my home directory. But I cannot write to files in /var/media (with the samba_share_t context).
I thought that allow_ftpd_use_cifs was supposed to handle that. I can get it to work with allow_ftpd_full_access, but I'd prefer to avoid this. What am I missing?
Here is the relevant info:
[mdurak@srv ~]$ ls -Z /var/media
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 docs
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 library
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 photos
drwxrwxr-x+ mdurak admins system_u:object_r:samba_share_t:s0 projects
[mdurak@srv ~]$ sudo semanage boolean -l | grep ftp
ftp_home_dir (on , on) Allow ftp to read and write files in the user home directories
tftp_anon_write (off , off) Allow tftp to modify public files used for public file transfer services.
allow_ftpd_full_access (off , off) Allow ftp servers to login to local users and read/write all files on the system, governed by DAC.
allow_ftpd_use_cifs (on , on) Allow ftp servers to use cifs used for public file transfer services.
allow_ftpd_use_nfs (off , off) Allow ftp servers to use nfs used for public file transfer services.
allow_ftpd_anon_write (on , on) Allow ftp servers to upload files, used for public file transfer services. Directories must be labeled public_content_rw_t.
ftpd_use_passive_mode (off , off) Allow ftp servers to use bind to all unreserved ports for passive mode
ftpd_connect_db (off , off) Allow ftp servers to use connect to mysql database
httpd_enable_ftp_server (off , off) Allow httpd to act as a FTP server by listening on the ftp port.
[mdurak@srv ~]$ sudo semanage boolean -l | grep samba
samba_domain_controller (off , off) Allow samba to act as the domain controller, add users, groups and change passwords.
samba_portmapper (off , off) Allow samba to act as a portmapper
samba_enable_home_dirs (on , on) Allow samba to share users home directories.
samba_export_all_ro (off , off) Allow samba to share any file/directory read only.
samba_export_all_rw (off , off) Allow samba to share any file/directory read/write.
use_samba_home_dirs (off , off) Support SAMBA home directories
samba_create_home_dirs (off , off) Allow samba to create new home directories (e.g. via PAM)
cdrecord_read_content (off , off) Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files
allow_smbd_anon_write (off , off) Allow samba to modify public files used
No comments:
Post a Comment