## <summary>File transfer protocol service</summary>

#######################################

## <summary>

##	The per user domain template for the ftp module.

## </summary>

## <desc>

##	

##	This template allows ftpd to manage files in

##	a user home directory, creating files with the

##	correct type.

##	

##	

##	This template is invoked automatically for each user, and

##	generally does not need to be invoked directly

##	by policy writers.

##	

## </desc>

## <param name="userdomain_prefix">

##	<summary>

##	The prefix of the user domain (e.g., user

##	is the prefix for user_t).

##	</summary>

## </param>

#

template(`ftp_per_userdomain_template',`

	tunable_policy(`ftpd_is_daemon',`

		userdom_manage_user_home_subdir_files($1,ftpd_t)

		userdom_manage_user_home_subdir_symlinks($1,ftpd_t)

		userdom_manage_user_home_subdir_sockets($1,ftpd_t)

		userdom_manage_user_home_subdir_pipes($1,ftpd_t)

		userdom_filetrans_user_home($1,ftpd_t,{ dir file lnk_file sock_file fifo_file })

	')

')

########################################

## <summary>

##      Use ftp by connecting over TCP.

## </summary>

## <param name="domain">

##	<summary>

##      Domain allowed access.

##	</summary>

## </param>

#

interface(`ftp_tcp_connect',`

	gen_require(`

		type ftpd_t;

	')

	allow $1 ftpd_t:tcp_socket { connectto recvfrom };

	allow ftpd_t $1:tcp_socket { acceptfrom recvfrom };

	kernel_tcp_recvfrom($1)

')

########################################

## <summary>

##      Read ftpd etc files

## </summary>

## <param name="domain">

##	<summary>

##      Domain allowed access.

##	</summary>

## </param>

#

interface(`ftp_read_config',`

	gen_require(`

		type ftpd_etc_t;

	')

	files_search_etc($1)

	allow $1 ftpd_etc_t:file { getattr read };

')

########################################

## <summary>

##      Execute FTP daemon entry point programs.

## </summary>

## <param name="domain">

##	<summary>

##      Domain allowed access.

##	</summary>

## </param>

#

interface(`ftp_check_exec',`

	gen_require(`

		type ftpd_exec_t;

	')

	corecmd_search_sbin($1)

	allow $1 ftpd_exec_t:file x_file_perms;

')

########################################

## <summary>

##      Read FTP transfer logs

## </summary>

## <param name="domain">

##	<summary>

##      Domain allowed access.

##	</summary>

## </param>

#

interface(`ftp_read_log',`

	gen_require(`

		type xferlog_t;

	')

	logging_search_logs($1)

	allow $1 xferlog_t:file r_file_perms;

')