I compiled the latest version of pure-ftpd with LDAP and SSL support. Works fine. I'd like to confine the process using SELinux but having a hard time. OS: Centos 5 updated to 5.2 I guess is the latest.

Pure-ftpd runs as root. I've found some rpms out there that have a pureftpd.pp policy file and installed the policy (semodule -i pureftpd.pp), but something is not running correctly. I don't get any error messages in audit.log and when I do a ps -ZC pure-ftpd it shows:
[root@ftp2 ~]# ps -ZC pure-ftpd
LABEL PID TTY TIME CMD
root:system_r:unconfined_t:SystemLow-SystemHigh 4122 ? 00:00:00 pure-ftpd

I don't think the policy file or the context that the process is running as is correct. I have used audit2allow to modify some local policies but this seems to not have the right context so I don't get error messages.

Any help would be appreciated.

Vary quickly - have you tested the setup with SELinux disabled?

Yes it work fine with SELinux disabled. It also works fine with SELinux enabled. I think the problems is the policy matches an rpm version (that's where I got the pureftpd.pp) and the version of pureftpd that I'm using is a compiled version -> 1.0.21.
Here's my configure options:

./configure '--prefix=/opt/pure-ftpd' '--with-pam' '--with-tls' '--with-certfile=/etc/pki/tls/private/pure-ftpd.pem' '--with-puredb' '--with-ldap' '--with-quotas' '--with-throttling' '--with-ratios'

Kent

The pureftpd.pp (which RPM exactly?) is a "binary module" for SE Linux. It may or may not work. You could try building a policy yourself: install "selinux-policy-devel" and from that follow instructions running 'policygentool appname /path/to/binary'.

I didn't realize there was an rpm out there, same version as the compiled version I'm using:
pure-ftpd-1.0.21-15.el5.i386.rpm
pure-ftpd-selinux-1.0.21-15.el5.i386.rpm

I dumped my compiled version, which is the same version as above.

Works with LDAP, SSL.

I still had to tweek the policies using audit2allow and setsebool (ftp_home_dir --> on) to get auto create home directory to work, but everything is working fine now.

[root@ftp2 ~]# ps -ZC pure-ftpd
LABEL PID TTY TIME CMD
root:system_r:ftpd_t 8632 ? 00:00:00 pure-ftpd
root:system_r:ftpd_t 8723 ? 00:00:00 pure-ftpd
root:system_r:ftpd_t 8724 ? 00:00:00 pure-ftpd


I did get the selinux-policy-devel package. I have some other servers with daemons that are not confined by SELinux. I will try to make policy packages with the development tools.

Thanks for your help.