SELinux, ProFTPd and the silent log

Question

I need a FTP server on my machine, a Fedora 23. I want a simple setup, and I decided for ProFTPd and authentication with mod_auth_unix.c (this is just about my machine).

I installed ProFTPd and configured it. I had some problem in logging in from the local machine, and eventually I realized the problem was related to SeLinux (by simply tring to set it as Permissive).

I'm trying (and failing) to figure out how to change the SELinux configuration in order to add the permission I need. This is what I've done so far:

1. From the Audit I got:

   denied  { dac_read_search } for
     pid=16049
     comm="proftpd"
     capability=2
     scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
     tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023
     tclass=capability
     permissive=0
   

2. According to this article I need to enable the ftp_home_dir and allow_ftpd_full_access booleans. I started by setting the first one, and obtaining a different situation:

   • Still failure to log, but no audit message

   • /var/log/secure says:

     proftpd[16070]: 127.0.0.1 (::1[::1]) - USER dave (Login failed): No such user found
     

3. Apparently there's no allow_ftpd_full_access in my semanage boolean -l. I can enable it anyway, but without getting a different behaviour.

4. None of the following not-always related booleans seem to work (tried all of them, just for good measure):

   sftpd_full_access
   ftpd_anon_write
   ftpd_connect_db
   ftpd_full_access
   ftpd_use_cifs
   sftpd_enable_homedirs
   ftpd_connect_all_unreserved
   sftpd_write_ssh_home
   ftpd_use_passive_mode
   sftpd_anon_write
   ftpd_use_nfs
   ftpd_use_fusefs
   

It must be a selinux problem because it works if I set it to permissive. Weirdly enough, however, the Audit log is not reporting SELinux activity.

I believe the FTP server is forbidden to access /etc/passwd or /etc/shadow.

Any hint or idea?

Answer 1

Answering my own question:

I was able to solve the problem by restoring the configuration of my /etc/proftpd.conf to

AuthOrder mod_auth_pam.c* mod_auth_unix.c

SELinux was configured by setting the following flags:

setsebool ftpd_full_access 1
setsebool ftp_home_dir 1

Apparently the problem was related with mod_auth_unix.c which is forbidden by SELinux to work, while mod_auth_pam.c can do it just fine. A case of PEBCAK.

The only think I cannot figure out at this point is why nothing was reported in /var/log/audit/audit.log: I'm positive that SELinux prevented the login, since I was able to login while in Permissive mode.

Answer 2

I believe the FTP server is forbidden to access /etc/passwd or /etc/shadow.

This is not true. From the AVC message, you see

tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023

which is some part of ftpd_t, not shadow or passwd (these files have different context, as you can see from ls -Z /etc/passwd).

It is not complete solution, but moving forward. You did all things according to the article? Also the groups settings?