Master tunable index:
Global
allow_console_login
(Default: false)
Allow users to connect to console (s390)
Module:
cvs
Layer:
services
allow_cvs_read_shadow
(Default: false)
Allow cvs daemon to read shadow
Module:
init
Layer:
system
allow_daemons_dump_core
(Default: false)
Allow all daemons to write corefiles to /
Module:
init
Layer:
system
allow_daemons_use_tty
(Default: false)
Allow all daemons the ability to use unallocated ttys
Global
allow_execheap
(Default: false)
Allow making the heap executable.
Global
allow_execmem
(Default: false)
Allow making anonymous memory executable, e.g.
for runtime-code generation or executable stack.
Global
allow_execmod
(Default: false)
Allow making a modified private file
mapping executable (text relocation).
Global
allow_execstack
(Default: false)
Allow making the stack executable via mprotect.
Also requires allow_execmem.
Module:
ftp
Layer:
services
allow_ftpd_anon_write
(Default: false)
Allow ftp servers to modify public files
used for public file transfer services.
Module:
ftp
Layer:
services
allow_ftpd_full_access
(Default: false)
Allow ftp servers to login to local users and
read/write all files on the system, governed by DAC.
Module:
ftp
Layer:
services
allow_ftpd_use_cifs
(Default: false)
Allow ftp servers to use cifs
used for public file transfer services.
Module:
ftp
Layer:
services
allow_ftpd_use_nfs
(Default: false)
Allow ftp servers to use nfs
used for public file transfer services.
Module:
rpc
Layer:
services
allow_gssd_read_tmp
(Default: true)
Allow gssd to read temp directory.
Module:
apache
Layer:
services
allow_httpd_anon_write
(Default: false)
Allow Apache to modify public files
used for public file transfer services.
Module:
apache
Layer:
services
allow_httpd_mod_auth_pam
(Default: false)
Allow Apache to use mod_auth_pam
Module:
apache
Layer:
services
allow_httpd_sys_script_anon_write
(Default: false)
Allow apache scripts to write to public content
Module:
domain
Layer:
kernel
allow_ipsec_label
(Default: true)
Allow all domains to use ipsec labeled packets
Module:
java
Layer:
apps
allow_java_execstack
(Default: false)
Allow java executable stack
Module:
kerberos
Layer:
services
allow_kerberos
(Default: false)
Allow system to run with kerberos
Module:
mount
Layer:
system
allow_mount_anyfile
(Default: false)
Allow mount to mount any file
Module:
mount
Layer:
system
allow_mounton_anydir
(Default: true)
Allow mount to mount any dir
Module:
mplayer
Layer:
apps
allow_mplayer_execstack
(Default: false)
Allow mplayer executable stack
Module:
domain
Layer:
kernel
allow_netlabel
(Default: true)
Allow all domains to use netlabel labeled packets
Module:
rpc
Layer:
services
allow_nfsd_anon_write
(Default: false)
Allow nfs servers to modify public files
used for public file transfer services.
Global
allow_polyinstantiation
(Default: false)
Enable polyinstantiated directory support.
Module:
userdomain
Layer:
system
allow_ptrace
(Default: false)
Allow sysadm to ptrace all processes
Module:
rsync
Layer:
services
allow_rsync_anon_write
(Default: false)
Allow rsync to modify public files
used for public file transfer services.
Module:
sasl
Layer:
services
allow_saslauthd_read_shadow
(Default: false)
Allow sasl to read shadow
Module:
samba
Layer:
services
allow_smbd_anon_write
(Default: false)
Allow samba to modify public files
used for public file transfer services.
Module:
ssh
Layer:
services
allow_ssh_keysign
(Default: false)
allow host key based authentication
Module:
unconfined
Layer:
system
allow_unconfined_execmem_dyntrans
(Default: false)
Allow unconfined to dyntrans to unconfined_execmem
Module:
domain
Layer:
kernel
allow_unlabeled_packets
(Default: true)
Allow unlabeled packets to work on system
Module:
userdomain
Layer:
system
allow_user_mysql_connect
(Default: false)
Allow users to connect to mysql
Module:
xserver
Layer:
services
allow_write_xshm
(Default: false)
Allows clients to write to the X server shared
memory segments.
Global
allow_ypbind
(Default: false)
Allow system to run with NIS
Module:
zebra
Layer:
services
allow_zebra_write_config
(Default: false)
Allow zebra daemon to write it configuration files
Module:
cdrecord
Layer:
apps
cdrecord_read_content
(Default: false)
Allow cdrecord to read various content.
nfs, samba, removable devices, user temp
and untrusted content files
Module:
cron
Layer:
services
cron_can_relabel
(Default: false)
Allow system cron jobs to relabel filesystem
for restoring file contexts.
Module:
cron
Layer:
services
fcron_crond
(Default: false)
Enable extra rules in the cron domain
to support fcron.
Module:
ftp
Layer:
services
ftp_home_dir
(Default: false)
Allow ftp to read and write files in the user home directories
Global
global_ssp
(Default: false)
Enable reading of urandom for all domains.
This should be enabled when all programs
are compiled with ProPolice/SSP
stack smashing protection. All domains will
be allowed to read from /dev/urandom.
Module:
apache
Layer:
services
httpd_builtin_scripting
(Default: false)
Allow httpd to use built in scripting (usually php)
Module:
apache
Layer:
services
httpd_can_network_connect
(Default: false)
Allow http daemon to tcp connect
Module:
apache
Layer:
services
httpd_can_network_connect_db
(Default: false)
Allow httpd to connect to mysql/posgresql
Module:
apache
Layer:
services
httpd_can_network_relay
(Default: false)
Allow httpd to act as a relay
Module:
apache
Layer:
services
httpd_enable_ftp_server
(Default: false)
Allow httpd to act as a FTP server by
listening on the ftp port.
Module:
apache
Layer:
services
httpd_enable_homedirs
(Default: false)
Allow httpd to read home directories
Module:
apache
Layer:
services
httpd_ssi_exec
(Default: false)
Run SSI execs in system CGI script domain.
Module:
apache
Layer:
services
httpd_tty_comm
(Default: false)
Allow http daemon to communicate with the TTY
Module:
apache
Layer:
services
httpd_unified
(Default: false)
Run CGI in the main httpd domain
Module:
apache
Layer:
services
httpd_use_cifs
(Default: false)
Allow httpd to read cifs files
Module:
apache
Layer:
services
httpd_use_nfs
(Default: false)
Allow httpd to read nfs files
Global
mail_read_content
(Default: false)
Allow email client to various content.
nfs, samba, removable devices, user temp
and untrusted content files
Module:
mozilla
Layer:
apps
mozilla_read_content
(Default: false)
Control mozilla content access
Module:
bind
Layer:
services
named_write_master_zones
(Default: false)
Allow BIND to write the master zone files.
Generally this is used for dynamic DNS.
Global
nfs_export_all_ro
(Default: false)
Allow nfs to be exported read only
Global
nfs_export_all_rw
(Default: false)
Allow nfs to be exported read/write.
Module:
ppp
Layer:
services
pppd_can_insmod
(Default: false)
Allow pppd to load kernel modules for certain modems
Module:
ppp
Layer:
services
pppd_for_user
(Default: false)
Allow pppd to be run for a regular user
Global
read_default_t
(Default: false)
Allow reading of default_t files.
Global
read_untrusted_content
(Default: false)
Allow applications to read untrusted content
If this is disallowed, Internet content has
to be manually relabeled for read access to be granted
Module:
samba
Layer:
services
samba_domain_controller
(Default: false)
Allow samba to run as the domain controller; add machines to passwd file
Module:
samba
Layer:
services
samba_enable_home_dirs
(Default: false)
Allow samba to export user home directories.
Module:
samba
Layer:
services
samba_export_all_ro
(Default: false)
Allow samba to be exported read only
Module:
samba
Layer:
services
samba_export_all_rw
(Default: false)
Allow samba to be exported read/write.
Module:
samba
Layer:
services
samba_run_unconfined
(Default: false)
Allow samba to run unconfined scripts
Module:
samba
Layer:
services
samba_share_nfs
(Default: false)
Allow samba to export NFS volumes.
Module:
spamassassin
Layer:
services
spamassassin_can_network
(Default: false)
Allow user spamassassin clients to use the network.
Module:
spamassassin
Layer:
services
spamd_enable_home_dirs
(Default: true)
Allow spamd to read/write user home directories.
Module:
squid
Layer:
services
squid_connect_any
(Default: false)
Allow squid to connect to all ports, not just
HTTP, FTP, and Gopher ports.
Module:
ssh
Layer:
services
ssh_sysadm_login
(Default: false)
Allow ssh logins as sysadm_r:sysadm_t
Module:
lpd
Layer:
services
use_lpd_server
(Default: false)
Use lpd server instead of cups
Global
use_nfs_home_dirs
(Default: false)
Support NFS home directories
Global
use_samba_home_dirs
(Default: false)
Support SAMBA home directories
Module:
userdomain
Layer:
system
user_direct_mouse
(Default: false)
Allow regular users direct mouse access
Module:
userdomain
Layer:
system
user_dmesg
(Default: false)
Allow users to read system messages.
Module:
usernetctl
Layer:
apps
user_net_control
(Default: false)
Allow users to control network interfaces
(also needs USERCTL=true)
Module:
netutils
Layer:
admin
user_ping
(Default: false)
Control users use of ping and traceroute
Module:
userdomain
Layer:
system
user_rw_noexattrfile
(Default: false)
Allow user to r/w files on filesystems
that do not have extended attributes (FAT, CDROM, FLOPPY)
Global
user_tcp_server
(Default: false)
Allow users to run TCP servers (bind to ports and accept connection from
the same domain and outside users) disabling this forces FTP passive mode
and may change other protocols.
Module:
userdomain
Layer:
system
user_ttyfile_stat
(Default: false)
Allow w to display everyone
Global
write_untrusted_content
(Default: false)
Allow applications to write untrusted content
If this is disallowed, no Internet content
will be stored.
Module:
xserver
Layer:
services
xdm_sysadm_login
(Default: false)
Allow xdm logins as sysadm