# semanage fcontext -a -t public_content_rw_t "/myftp/pub(/.*)?"
Be sure to include the (/.*)?
at the end of the directory name.
I also tried to use audit2allow to generate a policy, but what it does is generate a policy that gives ftpd write access to directories of type public_content_t; this is equivalent to turning on allow_ftpd_full_access, if I understood it correctly
Essentially, yes; since SELinux allows directories/files labeled with public_content_t
to be shared between different services. However, further access control is in place through the use of sebooleans
(or sebool
, more precisely).
Giving "ftpd full access", doesn't mean giving it the rights to do/read/write what and where it wants. SELinux has designated policies in place for the services on your system; meaning, ftpd
is allowed to read files if the directory's file context (fcontext
) is public_content_t
. SELinux gives write permissions to the ftp server if the directory's fcontext is public_content_rw_t
; other services such as samba, apache, etc. have to be allowed write permissions to those directories through the booleans, according to the pertaining RedHat Documentation. If your "local policy" gives ftpd write access in directories labelled public_content_t
, it essentially strips away a layer of security. Therefore, I suggest labeling the directory with the public_content_rw_t
context, and removing your custom generated local policy.
For further information and details, please see the SELinux wiki pages.
Best Answer
Make sure you have
write_enable=yes
in your vsftpd.conf. It's off by default so by default your FTP site is a read-only site.