## File transfer protocol service ####################################### ## ## The per role template for the ftp module. ## ## ##

## This template allows ftpd to manage files in ## a user home directory, creating files with the ## correct type. ##

##

## This template is invoked automatically for each user, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## # template(`ftp_per_role_template',` tunable_policy(`ftpd_is_daemon',` userdom_manage_user_home_content_files($1,ftpd_t) userdom_manage_user_home_content_symlinks($1,ftpd_t) userdom_manage_user_home_content_sockets($1,ftpd_t) userdom_manage_user_home_content_pipes($1,ftpd_t) userdom_user_home_dir_filetrans_user_home_content($1,ftpd_t,{ dir file lnk_file sock_file fifo_file }) ') ') ######################################## ## ## Use ftp by connecting over TCP. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`ftp_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Read ftpd etc files ## ## ## ## Domain allowed access. ## ## # interface(`ftp_read_config',` gen_require(` type ftpd_etc_t; ') files_search_etc($1) allow $1 ftpd_etc_t:file { getattr read }; ') ######################################## ## ## Execute FTP daemon entry point programs. ## ## ## ## Domain allowed access. ## ## # interface(`ftp_check_exec',` gen_require(` type ftpd_exec_t; ') corecmd_search_sbin($1) allow $1 ftpd_exec_t:file x_file_perms; ') ######################################## ## ## Read FTP transfer logs ## ## ## ## Domain allowed access. ## ## # interface(`ftp_read_log',` gen_require(` type xferlog_t; ') logging_search_logs($1) allow $1 xferlog_t:file r_file_perms; ') ######################################## ## ## Execute the ftpdctl program in the ftpdctl domain. ## ## ## ## Domain allowed access. ## ## # interface(`ftp_domtrans_ftpdctl',` gen_require(` type ftpdctl_t, ftpdctl_exec_t; ') corecmd_search_bin($1) domain_auto_trans($1, ftpdctl_exec_t, ftpdctl_t) allow ftpdctl_t $1:fd use; allow ftpdctl_t $1:fifo_file rw_file_perms; allow ftpdctl_t $1:process sigchld; ')