false
Allow users to connect to console (s390)
false
Allow cvs daemon to read shadow
false
Allow making the heap executable.
false
Allow making anonymous memory executable, e.g. for runtime-code generation or executable stack.
false
Allow making a modified private file mapping executable (text relocation).
false
Allow making the stack executable via mprotect. Also requires allow_execmem.
false
Allow ftp servers to modify public files used for public file transfer services.
false
Allow ftp servers to login to local users and read/write all files on the system, governed by DAC.
false
Allow ftp servers to use cifs used for public file transfer services.
false
Allow ftp servers to use nfs used for public file transfer services.
false
Allow gpg executable stack
true
Allow gssd to read temp directory.
false
Allow Apache to modify public files used for public file transfer services.
false
Allow Apache to use mod_auth_pam
true
Allow all domains to use ipsec labeled packets
false
Allow system to run with kerberos
false
Allow mount to mount any file
true
Allow mount to mount any dir
false
Allow mplayer executable stack
true
Allow all domains to use netlabel labeled packets
false
Allow nfs servers to modify public files used for public file transfer services.
false
Enable polyinstantiated directory support.
false
Allow sysadm to ptrace all processes
false
Allow rsync to modify public files used for public file transfer services.
false
Allow sasl to read shadow
false
Allow samba to modify public files used for public file transfer services.
false
allow host key based authentication
false
Allow unconfined to dyntrans to unconfined_execmem
true
Allow unlabeled packets to work on system
false
Allow users to connect to mysql
false
Allows clients to write to the X server shared memory segments.
false
Allow system to run with NIS
false
Allow zebra daemon to write it configuration files
false
Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files
false
Allow system cron jobs to relabel filesystem for restoring file contexts.
false
Disable transitions to evolution domains.
false
force to games to run in user_t mapping executable (text relocation).
false
Disable transitions to user mozilla domains
false
Disable transitions to user thunderbird domains
false
Enable extra rules in the cron domain to support fcron.
false
Allow ftp to read and write files in the user home directories
false
Allow ftpd to run directly without inetd
false
Enable reading of urandom for all domains.
This should be enabled when all programs are compiled with ProPolice/SSP stack smashing protection. All domains will be allowed to read from /dev/urandom.
false
Allow httpd to use built in scripting (usually php)
false
Allow http daemon to tcp connect
false
Allow httpd to connect to mysql/posgresql
false
Allow httpd to act as a relay
false
Allow httpd cgi support
false
Allow httpd to act as a FTP server by listening on the ftp port.
false
Allow httpd to read home directories
false
Run SSI execs in system CGI script domain.
false
Allow http daemon to communicate with the TTY
false
Run CGI in the main httpd domain
false
Allow email client to various content. nfs, samba, removable devices, user temp and untrusted content files
false
Control mozilla content access
false
Allow BIND to write the master zone files. Generally this is used for dynamic DNS.
false
Allow nfs to be exported read only
false
Allow nfs to be exported read/write.
false
Allow pppd to load kernel modules for certain modems
false
Allow pppd to be run for a regular user
false
Allow reading of default_t files.
false
Allow applications to read untrusted content If this is disallowed, Internet content has to be manually relabeled for read access to be granted
false
Allow ssh to run from inetd instead of as a daemon.
false
Allow samba to run as the domain controller; add machines to passwd file
false
Allow samba to export user home directories.
false
Allow samba to be exported read only
false
Allow samba to be exported read/write.
false
Allow samba to export NFS volumes.
false
Allow squid to connect to all ports, not just HTTP, FTP, and Gopher ports.
false
Allow ssh logins as sysadm_r:sysadm_t
false
Allow staff_r users to search the sysadm home dir and read files (such as ~/.bashrc)
false
Configure stunnel to be a standalone daemon or inetd service.
false
Use lpd server instead of cups
false
Support NFS home directories
false
Support SAMBA home directories
false
Allow regular users direct mouse access
false
Allow users to read system messages.
false
Allow users to control network interfaces (also needs USERCTL=true)
false
Control users use of ping and traceroute
false
Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)
false
Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.
false
Allow w to display everyone
false
Allow virt to manage nfs files
false
Allow virt to manage cifs files
false
Allow applications to write untrusted content If this is disallowed, no Internet content will be stored.
false
Allow xdm logins as sysadm