diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index f10b4ec..d939d4f 100644
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -1,3 +1,4 @@
+- Add ftpdctl domain to ftp, from Paul Howarth.
- Fix build system to not move type declarations out of optionals.
- Add gcc-config domain to portage.
- Add packet object class and support in corenetwork.
diff --git a/refpolicy/policy/modules/services/ftp.fc b/refpolicy/policy/modules/services/ftp.fc
index 2967dd7..5ea69a0 100644
--- a/refpolicy/policy/modules/services/ftp.fc
+++ b/refpolicy/policy/modules/services/ftp.fc
@@ -7,6 +7,8 @@
#
# /usr
#
+/usr/bin/ftpdctl -- gen_context(system_u:object_r:ftpdctl_exec_t,s0)
+
/usr/kerberos/sbin/ftpd -- gen_context(system_u:object_r:ftpd_exec_t,s0)
/usr/sbin/ftpwho -- gen_context(system_u:object_r:ftpd_exec_t,s0)
diff --git a/refpolicy/policy/modules/services/ftp.if b/refpolicy/policy/modules/services/ftp.if
index 9b89315..113e56c 100644
--- a/refpolicy/policy/modules/services/ftp.if
+++ b/refpolicy/policy/modules/services/ftp.if
@@ -109,3 +109,26 @@ interface(`ftp_read_log',`
logging_search_logs($1)
allow $1 xferlog_t:file r_file_perms;
')
+
+########################################
+##
+## Execute the ftpdctl program in the ftpdctl domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`ftp_domtrans_ftpdctl',`
+ gen_require(`
+ type ftpdctl_t, ftpdctl_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domain_auto_trans($1, ftpdctl_exec_t, ftpdctl_t)
+
+ allow ftpdctl_t $1:fd use;
+ allow ftpdctl_t $1:fifo_file rw_file_perms;
+ allow ftpdctl_t $1:process sigchld;
+')
diff --git a/refpolicy/policy/modules/services/ftp.te b/refpolicy/policy/modules/services/ftp.te
index 7ef0911..fb09648 100644
--- a/refpolicy/policy/modules/services/ftp.te
+++ b/refpolicy/policy/modules/services/ftp.te
@@ -26,12 +26,19 @@ files_tmpfs_file(ftpd_tmpfs_t)
type ftpd_var_run_t;
files_pid_file(ftpd_var_run_t)
+type ftpdctl_t;
+type ftpdctl_exec_t;
+init_system_domain(ftpdctl_t,ftpdctl_exec_t)
+
+type ftpdctl_tmp_t;
+files_tmp_file(ftpdctl_tmp_t)
+
type xferlog_t;
logging_log_file(xferlog_t)
########################################
#
-# Local policy
+# ftpd local policy
#
allow ftpd_t self:capability { chown fowner fsetid setgid setuid sys_chroot sys_nice sys_resource };
@@ -40,7 +47,7 @@ allow ftpd_t self:process signal_perms;
allow ftpd_t self:process { getcap setcap setsched setrlimit };
allow ftpd_t self:fifo_file rw_file_perms;
allow ftpd_t self:unix_dgram_socket { sendto create_socket_perms };
-allow ftpd_t self:unix_stream_socket create_socket_perms;
+allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
allow ftpd_t self:tcp_socket create_stream_socket_perms;
allow ftpd_t self:udp_socket create_socket_perms;
@@ -62,6 +69,12 @@ allow ftpd_t ftpd_var_run_t:dir rw_dir_perms;
allow ftpd_t ftpd_var_run_t:sock_file manage_file_perms;
files_pid_filetrans(ftpd_t,ftpd_var_run_t,file)
+# proftpd requires the client side to bind a socket so that
+# it can stat the socket to perform access control decisions,
+# since getsockopt with SO_PEERCRED is not available on all
+# proftpd-supported OSs
+allow ftpd_t ftpdctl_tmp_t:sock_file { getattr unlink };
+
# Create and modify /var/log/xferlog.
allow ftpd_t xferlog_t:dir search_dir_perms;
allow ftpd_t xferlog_t:file create_file_perms;
@@ -234,3 +247,28 @@ optional_policy(`
optional_policy(`
udev_read_db(ftpd_t)
')
+
+########################################
+#
+# ftpdctl local policy
+#
+
+# Allow ftpdctl to talk to ftpd over a socket connection
+allow ftpdctl_t ftpd_t:unix_stream_socket connectto;
+allow ftpdctl_t ftpd_var_run_t:dir search;
+allow ftpdctl_t ftpd_var_run_t:sock_file write;
+
+# ftpdctl creates a socket so that the daemon can perform
+# access control decisions (see comments in ftpd_t rules above)
+allow ftpdctl_t ftpdctl_tmp_t:sock_file { create setattr };
+files_tmp_filetrans(ftpdctl_t, ftpdctl_tmp_t, sock_file)
+
+# Allow ftpdctl to read config files
+files_read_etc_files(ftpdctl_t)
+
+libs_use_ld_so(ftpdctl_t)
+libs_use_shared_libs(ftpdctl_t)
+
+ifdef(`targeted_policy',`
+ term_use_generic_ptys(ftpdctl_t)
+')
diff --git a/refpolicy/policy/modules/system/unconfined.te b/refpolicy/policy/modules/system/unconfined.te
index 1f83eff..d8509df 100644
--- a/refpolicy/policy/modules/system/unconfined.te
+++ b/refpolicy/policy/modules/system/unconfined.te
@@ -106,6 +106,10 @@ ifdef(`targeted_policy',`
')
optional_policy(`
+ ftp_domtrans_ftpdctl(unconfined_t)
+ ')
+
+ optional_policy(`
inn_domtrans(unconfined_t)
')