ftp server with apparmor support and change_profile

[martinhruska]

Hi,

I would like to secure my multiuser ftp server. Many users can log in and they are locked to their home dirs, where they could read and write files.

But what happens if there is a bug inside ftp server, which let users leave their homedirs?? So I would like to secure this situation with AppArmor.

I though that I will be able to create different AppArmor profile for every user, which will force their access only into their homedir. But how to do it? I can create only one profile for ftp server, which will allow access to every homedir!

But there is that change_hat and change_profile funcionality. I think that if there's a ftp server, which call these functions based on the logged in user, I will be able to get what I want: different AppArmor profile for every user.

It seems that this would require to change ftp server source somehow or that there should be some ftp server with AppArmor support.

So my question is: am I right? Is there any ftp server with AppArmor support? Or can be some ftp server modified to call change_profile funciton? Or I am not right and there is other way to do what I need?

Thanks for any hint..