## File transfer protocol service ####################################### ## ## The per role template for the ftp module. ## ## ##

## This template allows ftpd to manage files in ## a user home directory, creating files with the ## correct type. ##

##

## This template is invoked automatically for each user, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## # template(`ftp_per_role_template',` gen_require(` type ftpd_t; ') userdom_manage_user_home_content_files($1,ftpd_t) userdom_manage_user_home_content_symlinks($1,ftpd_t) userdom_manage_user_home_content_sockets($1,ftpd_t) userdom_manage_user_home_content_pipes($1,ftpd_t) userdom_user_home_dir_filetrans_user_home_content($1,ftpd_t,{ dir file lnk_file sock_file fifo_file }) ') ######################################## ## ## Use ftp by connecting over TCP. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`ftp_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Read ftpd etc files ## ## ## ## Domain allowed access. ## ## # interface(`ftp_read_config',` gen_require(` type ftpd_etc_t; ') files_search_etc($1) allow $1 ftpd_etc_t:file { getattr read }; ') ######################################## ## ## Execute FTP daemon entry point programs. ## ## ## ## Domain allowed access. ## ## # interface(`ftp_check_exec',` gen_require(` type ftpd_exec_t; ') corecmd_search_bin($1) allow $1 ftpd_exec_t:file { getattr execute }; ') ######################################## ## ## Read FTP transfer logs ## ## ## ## Domain allowed access. ## ## # interface(`ftp_read_log',` gen_require(` type xferlog_t; ') logging_search_logs($1) allow $1 xferlog_t:file read_file_perms; ') ######################################## ## ## Execute the ftpdctl program in the ftpdctl domain. ## ## ## ## Domain allowed access. ## ## # interface(`ftp_domtrans_ftpdctl',` gen_require(` type ftpdctl_t, ftpdctl_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, ftpdctl_exec_t, ftpdctl_t) ') ######################################## ## ## Execute the ftpdctl program in the ftpdctl domain. ## ## ## ## Domain allowed access. ## ## ## ## ## The role to allow the ftpdctl domain. ## ## ## ## ## The type of the terminal allow the ftpdctl domain to use. ## ## ## # interface(`ftp_run_ftpdctl',` gen_require(` type ftpdctl_t; ') ftp_domtrans_ftpdctl($1) role $2 types ftpdctl_t; allow ftpdctl_t $3:chr_file rw_term_perms; ')