selinux-policy/policy/global_tunables

#
# This file is for the declaration of global tunables.
# To change the default value at build time, the booleans.conf
# file should be used.
#

## <desc>
## <p>
## Allow unconfined executables to make their heap memory executable.  Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
## </p>
## </desc>
gen_tunable(allow_execheap,false)

## <desc>
## <p>
## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla
## </p>
## </desc>
gen_tunable(allow_execmem,false)

## <desc>
## <p>
## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t
## </p>
## </desc>
gen_tunable(allow_execmod,false)

## <desc>
## <p>
## Allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
## </p>
## </desc>
gen_tunable(allow_execstack,false)

## <desc>
## <p>
## Enable polyinstantiated directory support.
## </p>
## </desc>
gen_tunable(allow_polyinstantiation,false)

## <desc>
## <p>
## Allow system to run with NIS
## </p>
## </desc>
gen_tunable(allow_ypbind,false)

## <desc>
## <p>
## Enable reading of urandom for all domains.
## </p>
## <p>
## This should be enabled when all programs
## are compiled with ProPolice/SSP
## stack smashing protection.  All domains will
## be allowed to read from /dev/urandom.
## </p>
## </desc>
gen_tunable(global_ssp,false)

## <desc>
## <p>
## Allow any files/directories to be exported read/write via NFS.
## </p>
## </desc>
gen_tunable(nfs_export_all_rw,false)

## <desc>
## <p>
## Allow any files/directories to be exported read/only via NFS.
## </p>
## </desc>
gen_tunable(nfs_export_all_ro,false)

## <desc>
## <p>
## Support NFS home directories
## </p>
## </desc>
gen_tunable(use_nfs_home_dirs,false)

## <desc>
## <p>
## Support SAMBA home directories
## </p>
## </desc>
gen_tunable(use_samba_home_dirs,false)

## <desc>
## <p>
## Support fusefs home directories
## </p>
## </desc>
gen_tunable(use_fusefs_home_dirs,false)

## <desc>
## <p>
## Allow users to run TCP servers (bind to ports and accept connection from
## the same domain and outside users)  disabling this forces FTP passive mode
## and may change other protocols.
## </p>
## </desc>
gen_tunable(user_tcp_server,false)

## <desc>
## <p>
## Allow direct login to the console device. Required for System 390
## </p>
## </desc>
gen_tunable(allow_console_login,false)
update to new commenting style 2005-06-23 20:27:06 +00:00			`#`
* Updated to sedoctool to read bool files and tunable files separately. * Changed the xml tag of <boolean> to <bool> to be consistent with gen_bool(). * Modified the implementation of segenxml to use regular expressions. 2005-10-07 18:08:50 +00:00			`# This file is for the declaration of global tunables.`
			`# To change the default value at build time, the booleans.conf`
update to new commenting style 2005-06-23 20:27:06 +00:00			`# file should be used.`
			`#`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
trunk: Improve several tunables descriptions from Dan Walsh. 2007-12-07 15:44:53 +00:00			`## Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00			`gen_tunable(allow_execheap,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
Allow hugetlbfs_t to be on device_t file system Allow sudo domains to signal user domains Dontaudit xdm_t sending signals to all domains Fix allow_exec* boolean descriptions 2010-09-10 14:10:34 +00:00			`## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
tunables work 2005-06-13 20:44:23 +00:00			`gen_tunable(allow_execmem,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
Allow hugetlbfs_t to be on device_t file system Allow sudo domains to signal user domains Dontaudit xdm_t sending signals to all domains Fix allow_exec* boolean descriptions 2010-09-10 14:10:34 +00:00			`## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
tunables work 2005-06-13 20:44:23 +00:00			`gen_tunable(allow_execmod,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
Allow hugetlbfs_t to be on device_t file system Allow sudo domains to signal user domains Dontaudit xdm_t sending signals to all domains Fix allow_exec* boolean descriptions 2010-09-10 14:10:34 +00:00			`## Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
more updates 2005-09-15 21:03:29 +00:00			`gen_tunable(allow_execstack,false)`

patch from dan Tue, 24 Oct 2006 11:00:28 -0400 2006-10-31 21:01:48 +00:00			`## <desc>`
			`## <p>`
			`## Enable polyinstantiated directory support.`
			`## </p>`
			`## </desc>`
			`gen_tunable(allow_polyinstantiation,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
update to new commenting style 2005-06-23 20:27:06 +00:00			`## Allow system to run with NIS`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
tunables work 2005-06-13 20:44:23 +00:00			`gen_tunable(allow_ypbind,false)`

add ssp patch and move some domain_(base_)?_type() rules to the TE file. 2006-03-14 19:13:59 +00:00			`## <desc>`
			`## <p>`
			`## Enable reading of urandom for all domains.`
			`## </p>`
			`## <p>`
			`## This should be enabled when all programs`
			`## are compiled with ProPolice/SSP`
			`## stack smashing protection. All domains will`
			`## be allowed to read from /dev/urandom.`
			`## </p>`
			`## </desc>`
			`gen_tunable(global_ssp,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
trunk: Improve several tunables descriptions from Dan Walsh. 2007-12-07 15:44:53 +00:00			`## Allow any files/directories to be exported read/write via NFS.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
add rpc 2005-10-24 01:53:13 +00:00			`gen_tunable(nfs_export_all_rw,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
trunk: Improve several tunables descriptions from Dan Walsh. 2007-12-07 15:44:53 +00:00			`## Allow any files/directories to be exported read/only via NFS.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
add rpc 2005-10-24 01:53:13 +00:00			`gen_tunable(nfs_export_all_ro,false)`

add thunderbird 2006-03-08 20:09:42 +00:00			`## <desc>`
			`## <p>`
trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00			`## Support NFS home directories`
add thunderbird 2006-03-08 20:09:42 +00:00			`## </p>`
			`## </desc>`
trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00			`gen_tunable(use_nfs_home_dirs,false)`
add thunderbird 2006-03-08 20:09:42 +00:00
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00			`## Support SAMBA home directories`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00			`gen_tunable(use_samba_home_dirs,false)`
clean up unused booleans 2005-10-28 17:31:53 +00:00
Start adding support for use_fusefs_home_dirs Add /var/lib/syslog directory file context Add /etc/localtime as locale file context 2010-10-04 18:45:52 +00:00			`## <desc>`
			`## <p>`
			`## Support fusefs home directories`
			`## </p>`
			`## </desc>`
			`gen_tunable(use_fusefs_home_dirs,false)`

xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <desc>`
			`## <p>`
update to new commenting style 2005-06-23 20:27:06 +00:00			`## Allow users to run TCP servers (bind to ports and accept connection from`
			`## the same domain and outside users) disabling this forces FTP passive mode`
			`## and may change other protocols.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </p>`
			`## </desc>`
tunables work 2005-06-13 20:44:23 +00:00			`gen_tunable(user_tcp_server,false)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00
			`## <desc>`
			`## <p>`
			`## Allow direct login to the console device. Required for System 390`
			`## </p>`
			`## </desc>`
			`gen_tunable(allow_console_login,false)`