Manage SELinux Booleans

1. get SELinux booleans
   

   [root@deyu ~]# getsebool -a
   abrt_anon_write --> off
   allow_console_login --> on
   allow_corosync_rw_tmpfs --> off
   .......
   xserver_object_manager --> off
   
   [root@deyu ~]# getsebool -a | grep ftp
   allow_ftpd_anon_write --> off
   allow_ftpd_full_access --> off
   allow_ftpd_use_cifs --> off
   allow_ftpd_use_nfs --> off
   ftp_home_dir --> off
   ftpd_connect_db --> off
   httpd_enable_ftp_server --> off
   sftpd_anon_write --> off
   sftpd_enable_homedirs --> off
   sftpd_full_access --> off
   sftpd_write_ssh_home --> off
   tftp_anon_write --> off
   
   [root@deyu ~]# getsebool ftp_home_dir
   ftp_home_dir --> off
   

2. set SELinux booleans
   

   [root@deyu ~]# mkdir /var/ftp/pub/sel
   [root@deyu ~]# touch /var/ftp/pub/sel/a.txt
   
   # 開啟另一終端機，登入kvm4進行測試
   [root@deyu ~]# ssh root@kvm4.deyu.wang
   root@kvm4.deyu.wang's password: 
   Last login: Fri Dec 30 12:14:06 2011
   [root@kvm4 ~]# wget ftp://deyu.wang/pub/sel/a.txt
   --2011-12-30 17:27:25--  ftp://deyu.wang/pub/sel/a.txt
              => “a.txt”
   Resolving deyu.wang... 192.168.122.1
   Connecting to deyu.wang|192.168.122.1|:21... failed: No route to host.
   
   [root@deyu ~]# setsebool ftp_home_dir 1
   [root@deyu ~]# getsebool ftp_home_dir 
   ftp_home_dir --> on
   
   # 再以kvm4進行測試，若還有問題請檢查iptables
   [root@kvm4 ~]# wget ftp://deyu.wang/pub/sel/a.txt
   --2011-12-30 17:32:51--  ftp://deyu.wang/pub/sel/a.txt
              => “a.txt”
   Resolving deyu.wang... 192.168.122.1
   Connecting to deyu.wang|192.168.122.1|:21... connected.
   Logging in as anonymous ... Logged in!
   ==> SYST ... done.    ==> PWD ... done.
   ==> TYPE I ... done.  ==> CWD (1) /pub/sel ... done.
   ==> SIZE a.txt ... done.
   ==> PASV ... done.    ==> RETR a.txt ... done.
   
       [ <=>                                   ] 0           --.-K/s   in 0s      
   
   2011-12-30 17:32:51 (0.00 B/s) - “a.txt” saved [0]
   [root@kvm4 ~]# ll a.txt
   -rw-r--r--. 1 root root 0 Dec 30 17:32 a.txt
   

3. set SELinux booleans as boot-time default
   

   [root@deyu ~]# setsebool -P ftp_home_dir 1
   [root@deyu ~]# getsebool ftp_home_dir 
   ftp_home_dir --> on
   [root@deyu ~]# setsebool -P ftp_home_dir 0
   ftp_home_dir --> off
   

4. get more detailed information
   

   [root@deyu ~]# semanage boolean -l | grep ftp_home_dir
   ftp_home_dir                   -> off   Allow ftp to read and write files in the user home directories