You can usually find selinux denials in /var/log/messages. Try this (as root):
grep avc /var/log/messages | grep ftp
Review the output and decide whether the denials are erroneous, given your desired configuration. Tune the grep statements as necessary to whiddle the information down to only the statements you want to fix. It's often useful to temporarily put the system in permissive mode (
setenforce 0), then perform the operations you expect to need.
/var/log/messages will amass a list of errors that need to be fixed in your SELinux policy. Once you're satisfied with the list of denials that need to be fixed, generate a new policy using the following:
# ensure you have audit2allow
# if no audit2allow, install it:
yum install policycoreutils-python
# replace the following with your tuned grep (if necessary)
grep avc /var/log/message | grep ftp | audit2allow -M my_vsftp
In your current directory, there will be two new files:
*.te file is readable, the
*.pp is compiled. Review the *.te file to ensure it is appropriate.
Be careful here, as opening up too many SELinux rules can leave you vulnerable. It is highly recommended to read up on SELinux.
If the policy looks appropriate, install and activate it:
mv my_vsftp.* /usr/share/selinux/packages/my_vsftp/
semodule -i /usr/share/selinux/packages/my_vsftp/my_vsftp.pp
Ensure the system is enforcing (
setenforce 1), and test your FTP server, monitoring
/var/log/messages for denials.