Fixing selinux denials

[Daniel J Walsh]

Gordon Charrick wrote:
> I have selinux set to mode permissive and I'm using FC6.
>
> I have another machine that ftp's a bunch of files periodically to 
> create a web site. I put the files in a directory under /var/www/html. 
> Every time the ftp runs, I get a series of these messages:
>
> Nov  8 09:15:24 gmc kernel: audit(1163006124.532:1745): avc:  denied  
> { append } for  pid=32479 comm="vsftpd" name="nlasvegas.html" dev=dm-4 
> ino=96584 scontext=system_u:system_r:ftpd_t:s0 
> context=user_u:object_r:httpd_sys_content_t:s0 tclass=file
>
> I don't have any experience playing around with selinux yet so I don't 
> know the proper way to fix this. At this point I can understand that 
> vsftpd runs with a ftpd_t context and the directory I'm putting the 
> files into has a httpd_sys_content_t context. How do I put it together 
> to get no more messages?
>
chcon -t public_content_rw_t /var/www/html
setsebool -P allow_ftpd_anon_write=0

Should do it.


man ftpd_selinux
man httpd_selinux