Master tunable index:
Module:
abrt
Layer:
contrib
abrt_anon_write
(Default: false)
Allow ABRT to modify public files
used for public file transfer services.
Module:
abrt
Layer:
contrib
abrt_handle_event
(Default: false)
Allow ABRT to run in abrt_handle_event_t domain
to handle ABRT event scripts
Module:
amavis
Layer:
contrib
amavis_use_jit
(Default: false)
Allow amavis to use JIT compiler
Module:
antivirus
Layer:
contrib
antivirus_can_scan_system
(Default: false)
Allow antivirus programs to read non security files on a system
Module:
authlogin
Layer:
system
authlogin_nsswitch_use_ldap
(Default: false)
Allow users to resolve user passwd entries directly from ldap rather then using a sssd server
Module:
authlogin
Layer:
system
authlogin_radius
(Default: false)
Allow users to login using a radius server
Module:
authlogin
Layer:
system
authlogin_yubikey
(Default: false)
Allow users to login using a yubikey server
Module:
awstats
Layer:
contrib
awstats_purge_apache_log
(Default: false)
Allow awstats to purge Apache logs
Module:
cdrecord
Layer:
contrib
cdrecord_read_content
(Default: false)
Allow cdrecord to read various content.
nfs, samba, removable devices, user temp
and untrusted content files
Module:
clamav
Layer:
contrib
clamd_use_jit
(Default: false)
Allow clamd to use JIT compiler
Module:
clamav
Layer:
contrib
clamscan_can_scan_system
(Default: false)
Allow clamscan to non security files on a system
Module:
clamav
Layer:
contrib
clamscan_read_user_content
(Default: false)
Allow clamscan to read user content
Module:
cobbler
Layer:
contrib
cobbler_anon_write
(Default: false)
Allow Cobbler to modify public files
used for public file transfer services.
Module:
cobbler
Layer:
contrib
cobbler_can_network_connect
(Default: false)
Allow Cobbler to connect to the
network using TCP.
Module:
cobbler
Layer:
contrib
cobbler_use_cifs
(Default: false)
Allow Cobbler to access cifs file systems.
Module:
cobbler
Layer:
contrib
cobbler_use_nfs
(Default: false)
Allow Cobbler to access nfs file systems.
Module:
collectd
Layer:
contrib
collectd_can_network_connect
(Default: false)
Allow collectd to connect to the
network using TCP.
Module:
condor
Layer:
contrib
condor_domain_can_network_connect
(Default: false)
Allow codnor domain to connect to the network using TCP.
Module:
cron
Layer:
contrib
cron_can_relabel
(Default: false)
Allow system cron jobs to relabel filesystem
for restoring file contexts.
Module:
cvs
Layer:
contrib
cvs_read_shadow
(Default: false)
Allow cvs daemon to read shadow
Module:
init
Layer:
system
daemons_dump_core
(Default: false)
Allow all daemons to write corefiles to /
Module:
init
Layer:
system
daemons_use_tcp_wrapper
(Default: false)
Allow all daemons to use tcp wrappers.
Module:
init
Layer:
system
daemons_use_tty
(Default: false)
Allow all daemons the ability to read/write terminals
Module:
dbadm
Layer:
contrib
dbadm_manage_user_files
(Default: false)
Allow dbadm to manage files in users home directories
Module:
dbadm
Layer:
contrib
dbadm_read_user_files
(Default: false)
Allow dbadm to read files in users home directories
Global
deny_execmem
(Default: false)
Deny user domains applications to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla
Global
deny_ptrace
(Default: false)
Allow sysadm to debug or ptrace all processes.
Module:
sysnetwork
Layer:
system
dhcpc_exec_iptables
(Default: false)
Allow dhcpc client applications to execute iptables commands
Module:
dhcp
Layer:
contrib
dhcpd_use_ldap
(Default: false)
Allow DHCP daemon to use LDAP backends
Module:
domain
Layer:
kernel
domain_fd_use
(Default: true)
Allow all domains to use other domains file descriptors
Module:
domain
Layer:
kernel
domain_kernel_load_modules
(Default: false)
Allow all domains to have the kernel load modules
Module:
entropyd
Layer:
contrib
entropyd_use_audio
(Default: false)
Allow the use of the audio devices as the source for the entropy feeds
Module:
exim
Layer:
contrib
exim_can_connect_db
(Default: false)
Allow exim to connect to databases (postgres, mysql)
Module:
exim
Layer:
contrib
exim_manage_user_files
(Default: false)
Allow exim to create, read, write, and delete
unprivileged user files.
Module:
exim
Layer:
contrib
exim_read_user_files
(Default: false)
Allow exim to read unprivileged user files.
Module:
cron
Layer:
contrib
fcron_crond
(Default: false)
Enable extra rules in the cron domain
to support fcron.
Module:
rhcs
Layer:
contrib
fenced_can_network_connect
(Default: false)
Allow fenced domain to connect to the network using TCP.
Module:
rhcs
Layer:
contrib
fenced_can_ssh
(Default: false)
Allow fenced domain to execute ssh.
Module:
domain
Layer:
kernel
fips_mode
(Default: true)
Allow all domains to execute in fips_mode
Module:
ftp
Layer:
contrib
ftp_home_dir
(Default: false)
Allow ftp to read and write files in the user home directories
Module:
ftp
Layer:
contrib
ftpd_anon_write
(Default: false)
Allow ftp servers to upload files, used for public file
transfer services. Directories must be labeled
public_content_rw_t.
Module:
ftp
Layer:
contrib
ftpd_connect_all_unreserved
(Default: false)
Allow ftp servers to connect to all ports > 1023
Module:
ftp
Layer:
contrib
ftpd_connect_db
(Default: false)
Allow ftp servers to connect to mysql database ports
Module:
ftp
Layer:
contrib
ftpd_full_access
(Default: false)
Allow ftp servers to login to local users and
read/write all files on the system, governed by DAC.
Module:
ftp
Layer:
contrib
ftpd_use_cifs
(Default: false)
Allow ftp servers to use cifs
used for public file transfer services.
Module:
ftp
Layer:
contrib
ftpd_use_nfs
(Default: false)
Allow ftp servers to use nfs
used for public file transfer services.
Module:
ftp
Layer:
contrib
ftpd_use_passive_mode
(Default: false)
Allow ftp servers to use bind to all unreserved ports for passive mode
Module:
git
Layer:
contrib
git_cgi_enable_homedirs
(Default: false)
Determine whether Git CGI
can search home directories.
Module:
git
Layer:
contrib
git_cgi_use_cifs
(Default: false)
Determine whether Git CGI
can access cifs file systems.
Module:
git
Layer:
contrib
git_cgi_use_nfs
(Default: false)
Determine whether Git CGI
can access nfs file systems.
Module:
git
Layer:
contrib
git_session_bind_all_unreserved_ports
(Default: false)
Determine whether Git session daemon
can bind TCP sockets to all
unreserved ports.
Module:
git
Layer:
contrib
git_session_users
(Default: false)
Determine whether calling user domains
can execute Git daemon in the
git_session_t domain.
Module:
git
Layer:
contrib
git_system_enable_homedirs
(Default: false)
Determine whether Git system daemon
can search home directories.
Module:
git
Layer:
contrib
git_system_use_cifs
(Default: false)
Determine whether Git system daemon
can access cifs file systems.
Module:
git
Layer:
contrib
git_system_use_nfs
(Default: false)
Determine whether Git system daemon
can access nfs file systems.
Module:
gitosis
Layer:
contrib
gitosis_can_sendmail
(Default: false)
Allow gitisis daemon to send mail
Global
global_ssp
(Default: false)
Enable reading of urandom for all domains.
This should be enabled when all programs
are compiled with ProPolice/SSP
stack smashing protection. All domains will
be allowed to read from /dev/urandom.
Module:
gpg
Layer:
contrib
gpg_agent_env_file
(Default: false)
Allow usage of the gpg-agent --write-env-file option.
This also allows gpg-agent to manage user files.
Module:
gpg
Layer:
contrib
gpg_web_anon_write
(Default: false)
Allow gpg web domain to modify public files
used for public file transfer services.
Module:
rpc
Layer:
contrib
gssd_read_tmp
(Default: true)
Allow gssd to read temp directory. For access to kerberos tgt.
Module:
apache
Layer:
contrib
httpd_anon_write
(Default: false)
Allow Apache to modify public files
used for public file transfer services. Directories/Files must
be labeled public_content_rw_t.
Module:
apache
Layer:
contrib
httpd_builtin_scripting
(Default: false)
Allow httpd to use built in scripting (usually php)
Module:
apache
Layer:
contrib
httpd_can_check_spam
(Default: false)
Allow http daemon to check spam
Module:
apache
Layer:
contrib
httpd_can_connect_ftp
(Default: false)
Allow httpd to act as a FTP client
connecting to the ftp port and ephemeral ports
Module:
apache
Layer:
contrib
httpd_can_connect_ldap
(Default: false)
Allow httpd to connect to the ldap port
Module:
apache
Layer:
contrib
httpd_can_connect_zabbix
(Default: false)
Allow http daemon to connect to zabbix
Module:
apache
Layer:
contrib
httpd_can_network_connect
(Default: false)
Allow HTTPD scripts and modules to connect to the network using TCP.
Module:
apache
Layer:
contrib
httpd_can_network_connect_cobbler
(Default: false)
Allow HTTPD scripts and modules to connect to cobbler over the network.
Module:
apache
Layer:
contrib
httpd_can_network_connect_db
(Default: false)
Allow HTTPD scripts and modules to connect to databases over the network.
Module:
apache
Layer:
contrib
httpd_can_network_memcache
(Default: false)
Allow httpd to connect to memcache server
Module:
apache
Layer:
contrib
httpd_can_network_relay
(Default: false)
Allow httpd to act as a relay
Module:
apache
Layer:
contrib
httpd_can_sendmail
(Default: false)
Allow http daemon to send mail
Module:
apache
Layer:
contrib
httpd_dbus_avahi
(Default: false)
Allow Apache to communicate with avahi service via dbus
Module:
apache
Layer:
contrib
httpd_enable_ftp_server
(Default: false)
Allow httpd to act as a FTP server by
listening on the ftp port.
Module:
apache
Layer:
contrib
httpd_enable_homedirs
(Default: false)
Allow httpd to read home directories
Module:
apache
Layer:
contrib
httpd_execmem
(Default: false)
Allow httpd scripts and modules execmem/execstack
Module:
apache
Layer:
contrib
httpd_graceful_shutdown
(Default: false)
Allow HTTPD to connect to port 80 for graceful shutdown
Module:
apache
Layer:
contrib
httpd_manage_ipa
(Default: false)
Allow httpd processes to manage IPA content
Module:
apache
Layer:
contrib
httpd_mod_auth_ntlm_winbind
(Default: false)
Allow Apache to use mod_auth_ntlm_winbind
Module:
apache
Layer:
contrib
httpd_mod_auth_pam
(Default: false)
Allow Apache to use mod_auth_pam
Module:
apache
Layer:
contrib
httpd_read_user_content
(Default: false)
Allow httpd to read user content
Module:
apache
Layer:
contrib
httpd_run_stickshift
(Default: false)
Allow Apache to run in stickshift mode, not transition to passenger
Module:
apache
Layer:
contrib
httpd_setrlimit
(Default: false)
Allow httpd daemon to change its resource limits
Module:
apache
Layer:
contrib
httpd_ssi_exec
(Default: false)
Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
Module:
apache
Layer:
contrib
httpd_sys_script_anon_write
(Default: false)
Allow apache scripts to write to public content, directories/files must be labeled public_rw_content_t.
Module:
apache
Layer:
contrib
httpd_tmp_exec
(Default: false)
Allow Apache to execute tmp content.
Module:
apache
Layer:
contrib
httpd_tty_comm
(Default: false)
Unify HTTPD to communicate with the terminal.
Needed for entering the passphrase for certificates at
the terminal.
Module:
apache
Layer:
contrib
httpd_unified
(Default: false)
Unify HTTPD handling of all content files.
Module:
apache
Layer:
contrib
httpd_use_cifs
(Default: false)
Allow httpd to access cifs file systems
Module:
apache
Layer:
contrib
httpd_use_fusefs
(Default: false)
Allow httpd to access FUSE file systems
Module:
apache
Layer:
contrib
httpd_use_nfs
(Default: false)
Allow httpd to access nfs file systems
Module:
apache
Layer:
contrib
httpd_use_oddjob
(Default: false)
Allow httpd to communicate with oddjob to start up a service
Module:
apache
Layer:
contrib
httpd_use_openstack
(Default: false)
Allow httpd to access openstack ports
Module:
apache
Layer:
contrib
httpd_verify_dns
(Default: false)
Allow Apache to query NS records
Module:
icecast
Layer:
contrib
icecast_connect_any
(Default: false)
Allow icecast to connect to all ports, not just
sound ports.
Module:
irc
Layer:
contrib
irssi_use_full_network
(Default: false)
Allow the Irssi IRC Client to connect to any port,
and to bind to any unreserved port.
Module:
java
Layer:
contrib
java_execstack
(Default: false)
Allow java executable stack
Module:
kerberos
Layer:
contrib
kerberos_enabled
(Default: false)
Allow confined applications to run with kerberos.
Module:
ksmtuned
Layer:
contrib
ksmtuned_use_cifs
(Default: false)
Allow ksmtuned to use cifs/Samba file systems
Module:
ksmtuned
Layer:
contrib
ksmtuned_use_nfs
(Default: false)
Allow ksmtuned to use nfs file systems
Module:
logging
Layer:
system
logging_syslogd_can_sendmail
(Default: false)
Allow syslogd daemon to send mail
Module:
logging
Layer:
system
logging_syslogd_use_tty
(Default: false)
Allow syslogd the ability to read/write terminals
Global
login_console_enabled
(Default: true)
Allow logging in and using the system from /dev/console.
Module:
domain
Layer:
kernel
mmap_low_allowed
(Default: false)
Control the ability to mmap a low area of the address space,
as configured by /proc/sys/kernel/mmap_min_addr.
Module:
mock
Layer:
contrib
mock_enable_homedirs
(Default: false)
Allow mock to read files in home directories.
Module:
mount
Layer:
system
mount_anyfile
(Default: false)
Allow the mount command to mount any directory or file.
Module:
mozilla
Layer:
contrib
mozilla_plugin_can_network_connect
(Default: false)
Allow mozilla plugin domain to connect to the network using TCP.
Module:
mozilla
Layer:
contrib
mozilla_plugin_enable_homedirs
(Default: false)
Allow mozilla_plugins to create random content in the users home directory
Module:
mozilla
Layer:
contrib
mozilla_read_content
(Default: false)
Allow confined web browsers to read home directory content
Module:
mplayer
Layer:
contrib
mplayer_execstack
(Default: false)
Allow mplayer executable stack
Module:
mysql
Layer:
contrib
mysql_connect_any
(Default: false)
Allow mysqld to connect to all ports
Module:
bind
Layer:
contrib
named_bind_http_port
(Default: false)
Allow BIND to bind apache port.
Module:
bind
Layer:
contrib
named_write_master_zones
(Default: false)
Allow BIND to write the master zone files.
Generally this is used for dynamic DNS or zone transfers.
Global
nfs_export_all_ro
(Default: false)
Allow any files/directories to be exported read/only via NFS.
Global
nfs_export_all_rw
(Default: false)
Allow any files/directories to be exported read/write via NFS.
Module:
rpc
Layer:
contrib
nfsd_anon_write
(Default: false)
Allow nfs servers to modify public files
used for public file transfer services. Files/Directories must be
labeled public_content_rw_t.
Global
nis_enabled
(Default: false)
Allow system to run with NIS
Module:
nscd
Layer:
contrib
nscd_use_shm
(Default: false)
Allow confined applications to use nscd shared memory.
Module:
nsplugin
Layer:
contrib
nsplugin_can_network
(Default: true)
Allow nsplugin code to connect to unreserved ports
Module:
nsplugin
Layer:
contrib
nsplugin_execmem
(Default: false)
Allow nsplugin code to execmem/execstack
Module:
openvpn
Layer:
contrib
openvpn_enable_homedirs
(Default: false)
Allow openvpn to read home directories
Module:
pacemaker
Layer:
contrib
pacemaker_use_execmem
(Default: false)
Allow pacemaker memcheck-amd64- to use executable memory
Module:
piranha
Layer:
contrib
piranha_lvs_can_network_connect
(Default: false)
Allow piranha-lvs domain to connect to the network using TCP.
Module:
polipo
Layer:
contrib
polipo_connect_all_unreserved
(Default: false)
Allow polipo to connect to all ports > 1023
Module:
polipo
Layer:
contrib
polipo_session_bind_all_unreserved_ports
(Default: false)
Determine whether Polipo session daemon
can bind tcp sockets to all unreserved ports.
Module:
polipo
Layer:
contrib
polipo_session_users
(Default: false)
Determine whether calling user domains
can execute Polipo daemon in the
polipo_session_t domain.
Module:
polipo
Layer:
contrib
polipo_use_cifs
(Default: false)
Determine whether polipo can
access cifs file systems.
Module:
polipo
Layer:
contrib
polipo_use_nfs
(Default: false)
Determine whether Polipo can
access nfs file systems.
Global
polyinstantiation_enabled
(Default: false)
Enable polyinstantiated directory support.
Module:
portage
Layer:
contrib
portage_use_nfs
(Default: false)
Allow the portage domains to use NFS mounts (regular nfs_t)
Module:
postfix
Layer:
contrib
postfix_local_write_mail_spool
(Default: true)
Allow postfix_local domain full write access to mail_spool directories
Module:
postgresql
Layer:
services
postgresql_can_rsync
(Default: false)
Allow postgresql to use ssh and rsync for point-in-time recovery
Module:
postgresql
Layer:
services
postgresql_selinux_transmit_client_label
(Default: false)
Allow transmit client label to foreign database
Module:
postgresql
Layer:
services
postgresql_selinux_unconfined_dbadm
(Default: true)
Allow database admins to execute DML statement
Module:
postgresql
Layer:
services
postgresql_selinux_users_ddl
(Default: true)
Allow unprivileged users to execute DDL statement
Module:
ppp
Layer:
contrib
pppd_can_insmod
(Default: false)
Allow pppd to load kernel modules for certain modems
Module:
ppp
Layer:
contrib
pppd_for_user
(Default: false)
Allow pppd to be run for a regular user
Module:
privoxy
Layer:
contrib
privoxy_connect_any
(Default: false)
Allow privoxy to connect to all ports, not just
HTTP, FTP, and Gopher ports.
Module:
puppet
Layer:
contrib
puppet_manage_all_files
(Default: false)
Allow Puppet client to manage all file
types.
Module:
puppet
Layer:
contrib
puppetmaster_use_db
(Default: false)
Allow Puppet master to use connect to MySQL and PostgreSQL database
Module:
qemu
Layer:
contrib
qemu_full_network
(Default: false)
Allow qemu to connect fully to the network
Module:
qemu
Layer:
contrib
qemu_use_cifs
(Default: true)
Allow qemu to use cifs/Samba file systems
Module:
qemu
Layer:
contrib
qemu_use_comm
(Default: false)
Allow qemu to use serial/parallel communication ports
Module:
qemu
Layer:
contrib
qemu_use_nfs
(Default: true)
Allow qemu to use nfs file systems
Module:
qemu
Layer:
contrib
qemu_use_usb
(Default: true)
Allow qemu to use usb devices
Module:
ipsec
Layer:
system
racoon_read_shadow
(Default: false)
Allow racoon to read shadow
Module:
rgmanager
Layer:
contrib
rgmanager_can_network_connect
(Default: false)
Allow rgmanager domain to connect to the network using TCP.
Module:
rsync
Layer:
contrib
rsync_anon_write
(Default: false)
Allow rsync to modify public files
used for public file transfer services. Files/Directories must be
labeled public_content_rw_t.
Module:
rsync
Layer:
contrib
rsync_client
(Default: false)
Allow rsync to run as a client
Module:
rsync
Layer:
contrib
rsync_export_all_ro
(Default: false)
Allow rsync to export any files/directories read only.
Module:
rsync
Layer:
contrib
rsync_full_access
(Default: false)
Allow rsync server to manage all files/directories on the system.
Module:
rsync
Layer:
contrib
rsync_use_cifs
(Default: false)
Allow rsync servers to share cifs files systems
Module:
rsync
Layer:
contrib
rsync_use_nfs
(Default: false)
Allow rsync servers to share nfs files systems
Module:
samba
Layer:
contrib
samba_create_home_dirs
(Default: false)
Allow samba to create new home directories (e.g. via PAM)
Module:
samba
Layer:
contrib
samba_domain_controller
(Default: false)
Allow samba to act as the domain controller, add users,
groups and change passwords.
Module:
samba
Layer:
contrib
samba_enable_home_dirs
(Default: false)
Allow samba to share users home directories.
Module:
samba
Layer:
contrib
samba_export_all_ro
(Default: false)
Allow samba to share any file/directory read only.
Module:
samba
Layer:
contrib
samba_export_all_rw
(Default: false)
Allow samba to share any file/directory read/write.
Module:
samba
Layer:
contrib
samba_portmapper
(Default: false)
Allow samba to act as a portmapper
Module:
samba
Layer:
contrib
samba_run_unconfined
(Default: false)
Allow samba to run unconfined scripts
Module:
samba
Layer:
contrib
samba_share_fusefs
(Default: false)
Allow samba to export ntfs/fusefs volumes.
Module:
samba
Layer:
contrib
samba_share_nfs
(Default: false)
Allow samba to export NFS volumes.
Module:
sanlock
Layer:
contrib
sanlock_use_fusefs
(Default: false)
Allow sanlock to read/write fuse files
Module:
sanlock
Layer:
contrib
sanlock_use_nfs
(Default: false)
Allow sanlock to manage nfs files
Module:
sanlock
Layer:
contrib
sanlock_use_samba
(Default: false)
Allow sanlock to manage cifs files
Module:
sasl
Layer:
contrib
saslauthd_read_shadow
(Default: false)
Allow sasl to read shadow
Module:
xserver
Layer:
services
selinuxuser_direct_dri_enabled
(Default: false)
Allow regular users direct dri device access
Global
selinuxuser_execheap
(Default: false)
Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
Global
selinuxuser_execmod
(Default: false)
Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t
Global
selinuxuser_execstack
(Default: false)
Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
Module:
userdomain
Layer:
system
selinuxuser_mysql_connect_enabled
(Default: false)
Allow users to connect to the local mysql server
Module:
netutils
Layer:
admin
selinuxuser_ping
(Default: false)
Allow confined users the ability to execute the ping and traceroute commands.
Module:
userdomain
Layer:
system
selinuxuser_postgresql_connect_enabled
(Default: false)
Allow users to connect to PostgreSQL
Module:
userdomain
Layer:
system
selinuxuser_rw_noexattrfile
(Default: false)
Allow user to r/w files on filesystems
that do not have extended attributes (FAT, CDROM, FLOPPY)
Global
selinuxuser_tcp_server
(Default: false)
Allow users to run TCP servers (bind to ports and accept connection from
the same domain and outside users) disabling this forces FTP passive mode
and may change other protocols.
Module:
userdomain
Layer:
system
selinuxuser_use_ssh_chroot
(Default: false)
Allow user to use ssh chroot environment.
Module:
ftp
Layer:
contrib
sftpd_anon_write
(Default: false)
Allow anon internal-sftp to upload files, used for
public file transfer services. Directories must be labeled
public_content_rw_t.
Module:
ftp
Layer:
contrib
sftpd_enable_homedirs
(Default: false)
Allow sftp-internal to read and write files
in the user home directories
Module:
ftp
Layer:
contrib
sftpd_full_access
(Default: false)
Allow sftp-internal to login to local users and
read/write all files on the system, governed by DAC.
Module:
ftp
Layer:
contrib
sftpd_write_ssh_home
(Default: false)
Allow internal-sftp to read and write files
in the user ssh home directories.
Module:
sge
Layer:
contrib
sge_domain_can_network_connect
(Default: false)
Allow sge to connect to the network using any TCP port
Module:
sge
Layer:
contrib
sge_use_nfs
(Default: false)
Allow sge to access nfs file systems.
Module:
smartmon
Layer:
contrib
smartmon_3ware
(Default: false)
Enable additional permissions needed to support
devices on 3ware controllers.
Module:
samba
Layer:
contrib
smbd_anon_write
(Default: false)
Allow samba to modify public files used for public file
transfer services. Files/Directories must be labeled
public_content_rw_t.
Module:
spamassassin
Layer:
contrib
spamassassin_can_network
(Default: false)
Allow user spamassassin clients to use the network.
Module:
spamassassin
Layer:
contrib
spamd_enable_home_dirs
(Default: true)
Allow spamd to read/write user home directories.
Module:
squid
Layer:
contrib
squid_connect_any
(Default: false)
Allow squid to connect to all ports, not just
HTTP, FTP, and Gopher ports.
Module:
squid
Layer:
contrib
squid_use_tproxy
(Default: false)
Allow squid to run as a transparent proxy (TPROXY)
Module:
ssh
Layer:
services
ssh_chroot_rw_homedirs
(Default: false)
Allow ssh with chroot env to read and write files
in the user home directories
Module:
ssh
Layer:
services
ssh_keysign
(Default: false)
allow host key based authentication
Module:
ssh
Layer:
services
ssh_sysadm_login
(Default: false)
Allow ssh logins as sysadm_r:sysadm_t
Module:
staff
Layer:
roles
staff_use_svirt
(Default: false)
allow staff user to create and transition to svirt domains.
Module:
telepathy
Layer:
contrib
telepathy_connect_all_ports
(Default: false)
Allow the Telepathy connection managers
to connect to any network port.
Module:
telepathy
Layer:
contrib
telepathy_tcp_connect_generic_network_ports
(Default: false)
Allow the Telepathy connection managers
to connect to any generic TCP port.
Module:
tftp
Layer:
contrib
tftp_anon_write
(Default: false)
Allow tftp to modify public files
used for public file transfer services.
Module:
tftp
Layer:
contrib
tftp_home_dir
(Default: false)
Allow tftp to read and write files in the user home directories
Module:
tor
Layer:
contrib
tor_bind_all_unreserved_ports
(Default: false)
Allow tor daemon to bind
tcp sockets to all unreserved ports.
Module:
tor
Layer:
contrib
tor_can_network_relay
(Default: false)
Allow tor to act as a relay
Module:
unconfineduser
Layer:
roles
unconfined_chrome_sandbox_transition
(Default: false)
allow unconfined users to transition to the chrome sandbox domains when running chrome-sandbox
Module:
unconfineduser
Layer:
roles
unconfined_login
(Default: true)
Allow a user to login as an unconfined domain
Module:
unconfineduser
Layer:
roles
unconfined_mozilla_plugin_transition
(Default: false)
Allow unconfined users to transition to the Mozilla plugin domain when running xulrunner plugin-container.
Module:
unconfineduser
Layer:
roles
unconfined_mplayer
(Default: false)
Allow video playing tools to run unconfined
Module:
unprivuser
Layer:
roles
unprivuser_use_svirt
(Default: false)
Allow unprivledged user to create and transition to svirt domains.
Global
use_ecryptfs_home_dirs
(Default: false)
Support ecryptfs home directories
Global
use_fusefs_home_dirs
(Default: false)
Support fusefs home directories
Module:
lpd
Layer:
contrib
use_lpd_server
(Default: false)
Use lpd server instead of cups
Global
use_nfs_home_dirs
(Default: false)
Support NFS home directories
Global
use_samba_home_dirs
(Default: false)
Support SAMBA home directories
Module:
varnishd
Layer:
contrib
varnishd_connect_any
(Default: false)
Allow varnishd to connect to all ports,
not just HTTP.
Module:
vbetool
Layer:
contrib
vbetool_mmap_zero_ignore
(Default: false)
Ignore vbetool mmap_zero errors.
Module:
virt
Layer:
contrib
virt_use_comm
(Default: false)
Allow confined virtual guests to use serial/parallel communication ports
Module:
virt
Layer:
contrib
virt_use_execmem
(Default: false)
Allow confined virtual guests to use executable memory and executable stack
Module:
virt
Layer:
contrib
virt_use_fusefs
(Default: false)
Allow confined virtual guests to read fuse files
Module:
virt
Layer:
contrib
virt_use_nfs
(Default: false)
Allow confined virtual guests to manage nfs files
Module:
virt
Layer:
contrib
virt_use_rawip
(Default: false)
Allow confined virtual guests to interact with rawip sockets
Module:
virt
Layer:
contrib
virt_use_samba
(Default: false)
Allow confined virtual guests to manage cifs files
Module:
virt
Layer:
contrib
virt_use_sanlock
(Default: false)
Allow confined virtual guests to interact with the sanlock
Module:
virt
Layer:
contrib
virt_use_usb
(Default: true)
Allow confined virtual guests to use usb devices
Module:
virt
Layer:
contrib
virt_use_xserver
(Default: false)
Allow confined virtual guests to interact with the xserver
Module:
webadm
Layer:
contrib
webadm_manage_user_files
(Default: false)
Allow webadm to manage files in users home directories
Module:
webadm
Layer:
contrib
webadm_read_user_files
(Default: false)
Allow webadm to read files in users home directories
Module:
wine
Layer:
contrib
wine_mmap_zero_ignore
(Default: false)
Ignore wine mmap_zero errors.
Module:
xserver
Layer:
services
xdm_exec_bootloader
(Default: false)
Allow the graphical login program to execute bootloader
Module:
xserver
Layer:
services
xdm_sysadm_login
(Default: false)
Allow the graphical login program to login directly as sysadm_r:sysadm_t
Module:
xen
Layer:
contrib
xen_use_nfs
(Default: false)
Allow xen to manage nfs files
Module:
xen
Layer:
contrib
xend_run_blktap
(Default: true)
Allow xend to run blktapctrl/tapdisk.
Not required if using dedicated logical volumes for disk images.
Module:
xen
Layer:
contrib
xend_run_qemu
(Default: true)
Allow xend to run qemu-dm.
Not required if using paravirt and no vfb.
Module:
xguest
Layer:
contrib
xguest_connect_network
(Default: true)
Allow xguest users to configure Network Manager and connect to apache ports
Module:
xguest
Layer:
contrib
xguest_mount_media
(Default: true)
Allow xguest users to mount removable media
Module:
xguest
Layer:
contrib
xguest_use_bluetooth
(Default: true)
Allow xguest to use blue tooth devices
Module:
xserver
Layer:
services
xserver_clients_write_xshm
(Default: false)
Allows clients to write to the X server shared
memory segments.
Module:
xserver
Layer:
services
xserver_execmem
(Default: false)
Allows XServer to execute writable memory
Module:
xserver
Layer:
services
xserver_object_manager
(Default: false)
Support X userspace object manager
Module:
zabbix
Layer:
contrib
zabbix_can_network
(Default: false)
Allow zabbix to connect to unreserved ports
Module:
zebra
Layer:
contrib
zebra_write_config
(Default: false)
Allow zebra daemon to write it configuration files
Module:
zoneminder
Layer:
contrib
zoneminder_anon_write
(Default: false)
Allow ZoneMinder to modify public files
used for public file transfer services.