This is not the formal FAQ. If you have a question and/or answer you would like to appear in the FAQ. Please put it here. And we will try to answer it.
In Red Hat Enterprise Linux 4, how do I write policy to allow a domain to use pam_unix.so?
Very few domains in the SELinux world are allowed to read the /etc/shadow file. There are constraint rules that prevent policy writers from writing code like.
allow mydomain_t shadow_t:file read;
In RHEL4 you can setup your domain to use the unix_chkpwd command. The easiest way is to use the unix_chkpwd attribute. So if you were writing policy for an ftpd daemon you would write something like daemon_domain(vsftpd, auth_chkpwd'). This would create a context where vsftpd_t -> chkpwd_exec_t -> system_chkpwd_t which can read /etc/shadow, while vsftpd_t is not able to read it.
In FC5/RHEL5 you will add the rule
auth_domtrans_chk_passwd(vsftpd_t)
How do I make directories available via anonymous ftp ?
- ) more work required.
gedit /etc/vsftpd/vsftpd.conf
add anon_root=/home/my_anonymous_ftp_directory
file|save
gnome-terminal
ls -lZ -d /home/my_anonymous_ftp_directory/
?? rem: chcon -t public_content_t /home/my_anonymous_ftp_directory/ -R ??
setsebool -P ftp_home_dir=1
How do I configure boot time mounting of iso images so that they can be available for anonymous ftp access ?
By default, selinux-policy-target will block mounting of iso images from /etc/fstab. The following steps are used to mount the iso image with appropriate selinux contexts:
- Create a folder to mount the iso in
mkdir /home/mounted_disc/
- Set the selinux context for mounting
chcon mnt_t /home/mounted_disc/
- Backup your fstab
su -c 'cp /etc/fstab /etc/fstab.before_iso_mount'
- edit fstab
su -c 'gedit /etc/fstab'
- Add a mount command for the iso image:
/home/my_cd_or_dvd_image.iso /home/mounted_disc/ iso9660 \
_netdev,ro,loop,fscontext=system_u:object_r:public_content_t:s0 0 0
- Save and exit gedit
- Test that the mount line is OK
mount /home/my_cd_or_dvd_image.iso
- Test that the mount is automatically available after reboot...
reboot
mount
- Now use the previous ftp share config to set up ftp sharing of the mounted iso
Are there any presentations on using SELinux ?
At Colorado Software Summit, Thomas Cameron gave a presentation entitled 'SELinux for Mere Mortals - Or, Don't turn it off', which is [available as a pdf].