.TH  "ftpd_selinux"  "8"  "17 Jan 2005" "dwalsh@redhat.com" "ftpd SELinux policy documentation"

.SH "NAME"

.PP

ftpd_selinux \- Security-Enhanced Linux policy for ftp daemons.

.SH "DESCRIPTION"

.PP

Security-Enhanced Linux provides security for ftp daemons via flexible mandatory access control.

.SH FILE_CONTEXTS

.PP

SELinux requires files to have a file type. File types may be specified with semanage and are restored with restorecon.  Policy governs the access that daemons have to files.

.TP

Allow ftp servers to read the /var/ftp directory by adding the public_content_t file type to the directory and by restoring the file type.

.PP

.B

semanage fcontext -a -t public_content_t "/var/ftp(/.*)?"

.TP

.B

restorecon -F -R -v /var/ftp

.TP

Allow ftp servers to read and write /var/tmp/incoming by adding the public_content_rw_t type to the directory and by restoring the file type.  This also requires the allow_ftpd_anon_write boolean to be set.

.PP

.B

semanage fcontext -a -t public_content_rw_t "/var/ftp/incoming(/.*)?"

.TP

.B

restorecon -F -R -v /var/ftp/incoming

.SH BOOLEANS

.PP

SELinux policy is based on least privilege required and may also be customizable by setting a boolean with setsebool.

.TP

Allow ftp servers to read and write files with the public_content_rw_t file type.

.PP

.B

setsebool -P allow_ftpd_anon_write on

.TP

Allow ftp servers to read or write files in the user home directories.

.PP

.B

setsebool -P ftp_home_dir on

.TP

Allow ftp servers to read or write all files on the system.

.PP

.B

setsebool -P allow_ftpd_full_access on

.TP

Allow ftp servers to use cifs for public file transfer services.

.PP

.B

setsebool -P allow_ftpd_use_cifs on

.TP

Allow ftp servers to use nfs for public file transfer services.

.PP

.B

setsebool -P allow_ftpd_use_nfs on

.TP

system-config-selinux is a GUI tool available to customize SELinux policy settings.

.SH AUTHOR	

.PP

This manual page was written by Dan Walsh <dwalsh@redhat.com>.

.SH "SEE ALSO"

.PP

selinux(8), ftpd(8), setsebool(8), semanage(8), restorecon(8)