I need a FTP server on my machine, a Fedora 23. I want a simple setup, and I decided for ProFTPd and authentication with mod_auth_unix.c (this is just about my machine).I installed ProFTPd and configured it. I had some problem in logging in from the local machine, and eventually I realized the problem was related to SeLinux (by simply tring to set it as Permissive).I'm trying (and failing) to figure out how to change the SELinux configuration in order to add the permission I need. This is what I've done so far:From the Audit I got:denied  { dac_read_search } for  pid=16049  comm=proftpd  capability=2  scontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023  tcontext=system_u:system_r:ftpd_t:s0-s0:c0.c1023  tclass=capability  permissive=0According to this article I need to enable the ftp_home_dir and allow_ftpd_full_access booleans. I started by setting the first one, and obtaining a different situation:Still failure to log, but no audit message/var/log/secure says:proftpd[16070]: 127.0.0.1 (::1[::1]) - USER dave (Login failed): No such user foundApparently there's no allow_ftpd_full_access in my semanage boolean -l. I can enable it anyway, but without getting a different behaviour.None of the following not-always related booleans seem to work (tried all of them, just for good measure):sftpd_full_accessftpd_anon_writeftpd_connect_dbftpd_full_accessftpd_use_cifssftpd_enable_homedirsftpd_connect_all_unreservedsftpd_write_ssh_homeftpd_use_passive_modesftpd_anon_writeftpd_use_nfsftpd_use_fusefsIt must be a selinux problem because it works if I set it to permissive. Weirdly enough, however, the Audit log is not reporting SELinux activity.I believe the FTP server is forbidden to access /etc/passwd or /etc/shadow.Any hint or idea?
SELinux, ProFTPd and the silent log
fedora;logs;selinux;proftpd
Answering my own question:I was able to solve the problem by restoring the configuration of my /etc/proftpd.conf toAuthOrder mod_auth_pam.c* mod_auth_unix.cSELinux was configured by setting the following flags:setsebool ftpd_full_access 1setsebool ftp_home_dir 1Apparently the problem was related with mod_auth_unix.c which is forbidden by SELinux to work, while mod_auth_pam.c can do it just fine. A case of PEBCAK.The only think I cannot figure out at this point is why nothing was reported in /var/log/audit/audit.log: I'm positive that SELinux prevented the login, since I was able to login while in Permissive mode.