-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/12/2011 07:37 PM, Ramon de C Valle wrote: >>> But how can I state that ftp has access to the users homedir >>> and not allow access to user_home_t? >> This is a good question. Actually, we shouldn't allow ftpd_t read >> the locale files from within user_home_t directories. But now I'm >> not sure if this will be possible. > A different file context for /home/(.*)/usr/share/zoneinfo(/.*) in > vsftpd policy module would be a feasible solution? Will ftpd_t > honour this when creating new files? > If you want to prevent apps from reading zoneinfo files that a user can write and read files a user can write, you will loose.
Why are you setting up the chroot with content a user can write too? If you simply prevent him from writing to /usr/share, won't that solve the problem? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk7nm8MACgkQrlYvE4MpobPNTQCfVp6Dqqq/1M6IID8bmQ+WckxA ocQAoMluitPtotAwImWn2dKLguz4u5VF =vX9u -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
