Re: vsftpd using mysql

[Maria Iano <maria iano org>]

Thank you so much Dominick - sesearch is a fantastic tool! It tells me  
exactly which booleans will do what I need. Either one of two booleans  
will provide two of the things I need. So there is only one extra  
allow rule that I need to create.

# sesearch --allow -s ftpd_t -t mysqld_var_run_t -c sock_file -p write  
-C
Found 2 av rules:
DT allow ftpd_t mysqld_var_run_t : sock_file { ioctl read write create  
getattr setattr lock append unlink link rename };  
[ allow_ftpd_full_access ]
DT allow ftpd_t mysqld_var_run_t : sock_file { ioctl read write create  
getattr setattr lock append unlink link rename }; [ ftp_home_dir ]

# sesearch --allow -s ftpd_t -t mysqld_db_t -c dir -p search -C
Found 2 av rules:
DT allow ftpd_t mysqld_db_t : dir { ioctl read write create getattr  
setattr lock unlink link rename add_name remove_name reparent search  
rmdir }; [ allow_ftpd_full_access ]
DT allow ftpd_t mysqld_db_t : dir { ioctl read write create getattr  
setattr lock unlink link rename add_name remove_name reparent search  
rmdir }; [ ftp_home_dir ]

So I can get
allow ftpd_t mysqld_var_run_t:sock_file write;
and
allow ftpd_t mysqld_db_t:dir search;
with booleans.

The only one that I can't get that way is:
allow ftpd_t mysqld_t:unix_stream_socket connectto;

Thanks!
Maria

On Feb 6, 2009, at 5:05 AM, Dominick Grift wrote:

> Op donderdag 05-02-2009 om 18:57 uur [tijdzone -0500], schreef Maria
> Iano
> > I notice there is a boolean for httpd to talk to mysql, which makes  
> > me
> > think there might be one for vsftpd. Does anyone know if such a one
> > exists?
>
> There is no such boolean for ftpd_t yet i think. One can verify this
> using: sesearch --allow -s ftpd_t | grep mysql
>
> There is also a manual page for ftpd_t: man ftpd_selinux
>
> One can easily implement a boolean using the policy you've generated.
> You might consider reporting a feature request to  
> bugzilla.redhat.com in
> the selinux-policy component
>
> hth, Dominick
>
> > Thanks,
> > Maria
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list redhat com
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list