ftpd and PAM

[Paul Howarth]

Daniel J Walsh wrote:
> Paul Howarth wrote:
>> Paul Howarth wrote:
>>> The PAM config files for vsftpd and prpftpd look like this:
>>>
>>> #%PAM-1.0
>>> session    optional     pam_keyinit.so    force revoke
>>> auth       required     pam_listfile.so item=user sense=deny 
>>> file=/etc/vsftpd/ftpusers onerr=succeed
>>> auth       required     pam_shells.so
>>> auth       include      system-auth
>>> account    include      system-auth
>>> session    include      system-auth
>>> session    required     pam_loginuid.so
>>>
>>> So it makes sense for ftpd_t to be able to set the login uid and 
>>> create a session keyring:
>>>
>>> logging_set_loginuid(ftpd_t)
>>> allow ftpd_t self:key { write search link };
>>>
>>>
>>> Curiously, I've done this locally but still get this AVC when logging 
>>> in on proftpd, with an open dovecot IMAP session on the same server:
>>>
>>> type=AVC msg=audit(1182853960.377:103383): avc:  denied  { link } for 
>>> pid=24601 comm="proftpd" scontext=root:system_r:ftpd_t:s0 
>>> tcontext=root:system_r:dovecot_t:s0 tclass=key
>>
>> FWIW, I'm also getting in /var/log/secure:
>>
>> Jun 26 12:09:42 goalkeeper proftpd: PAM audit_log_user_message() 
>> failed: Operation not permitted
>> Jun 26 12:09:42 goalkeeper proftpd[25559]: 
>> goalkeeper.intra.city-fan.org 
>> (::ffff:192.168.2.20[::ffff:192.168.2.20]) - PAM(setcred): System error
>> Jun 26 12:09:42 goalkeeper proftpd: pam_unix(proftpd:session): session 
>> closed for user paul
>> Jun 26 12:09:42 goalkeeper proftpd[25559]: 
>> goalkeeper.intra.city-fan.org 
>> (::ffff:192.168.2.20[::ffff:192.168.2.20]) - PAM(close_session): 
>> System error
>> Jun 26 12:09:42 goalkeeper proftpd[25559]: 
>> goalkeeper.intra.city-fan.org 
>> (::ffff:192.168.2.20[::ffff:192.168.2.20]) - FTP session closed.
>>
>> I don't see any AVCs to go with these, and adding:
>>
>> logging_send_audit_msg(ftpd_t)
>>
>> doesn't seem to help.
>>
>> Paul.
>>
> This could be caused by proftp not running as root and not having the 
> auth_write capability.  So a DAC error could be causing this problem.

Proftpd runs as nobody out of the box; what would I need to change to 
fix this? Which object's DAC permissions are the problem?

> type=AVC msg=audit(1182853960.377:103383): avc:  denied  { link } for 
> pid=24601 comm="proftpd" scontext=root:system_r:ftpd_t:s0 
> tcontext=root:system_r:dovecot_t:s0 tclass=key
> 
> I have no idea what this even means.  :^) One of these days I need to 
> investigate the kernel keyring.

It doesn't seem to cause any problem, but I would like to know what it 
is if you ever figure it out.

Cheers, Paul.