+
Determine of the console connected to the controlling terminal. -
+ + diff --git a/www/api-docs/admin_dmesg.html b/www/api-docs/admin_dmesg.html index 0d4fb902..45c45d7a 100644 --- a/www/api-docs/admin_dmesg.html +++ b/www/api-docs/admin_dmesg.html @@ -72,7 +72,8 @@Policy for dmesg.
+Policy for dmesg.
+ diff --git a/www/api-docs/admin_logrotate.html b/www/api-docs/admin_logrotate.html index d05e732e..45547459 100644 --- a/www/api-docs/admin_logrotate.html +++ b/www/api-docs/admin_logrotate.html @@ -72,7 +72,8 @@Rotate and archive system logs
+Rotate and archive system logs
+ diff --git a/www/api-docs/admin_netutils.html b/www/api-docs/admin_netutils.html index 7beb0fd6..5c42b384 100644 --- a/www/api-docs/admin_netutils.html +++ b/www/api-docs/admin_netutils.html @@ -72,7 +72,8 @@Network analysis utilities
+Network analysis utilities
+ diff --git a/www/api-docs/admin_rpm.html b/www/api-docs/admin_rpm.html index ed15c7cb..285109bb 100644 --- a/www/api-docs/admin_rpm.html +++ b/www/api-docs/admin_rpm.html @@ -72,7 +72,8 @@Policy for the RPM package manager.
+Policy for the RPM package manager.
+ diff --git a/www/api-docs/admin_usermanage.html b/www/api-docs/admin_usermanage.html index 6453b11c..a2b5a9af 100644 --- a/www/api-docs/admin_usermanage.html +++ b/www/api-docs/admin_usermanage.html @@ -72,7 +72,8 @@Policy for managing user accounts.
+Policy for managing user accounts.
+ diff --git a/www/api-docs/apps_gpg.html b/www/api-docs/apps_gpg.html index c354b75a..47cd6fca 100644 --- a/www/api-docs/apps_gpg.html +++ b/www/api-docs/apps_gpg.html @@ -55,7 +55,8 @@Policy for GNU Privacy Guard and related programs.
+Policy for GNU Privacy Guard and related programs.
+ diff --git a/www/api-docs/index.html b/www/api-docs/index.html index 60256bc0..76f05aa0 100644 --- a/www/api-docs/index.html +++ b/www/api-docs/index.html @@ -169,6 +169,9 @@ - udev-Policy for kernel threads, proc filesystem, -and unlabeled processes and objects. +Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
Policy for udev.
The unconfined domain.
+Unconfined access to network objects. +
++Unconfined access to devices. +
++Unconfined access to domains. +
++Create home directories +
++Unconfined access to files. +
++Unconfined access to filesystems +
+-Summary is missing! +Create a domain for long running processes +(daemons) which can be started by init scripts.
-Summary is missing! +Create a domain which can be started by init.
-Summary is missing! +Create a domain for short running processes +which can be started by init scripts.
+Unconfined access to the kernel. +
+-Summary is missing! +Modified mailserver interface for +sendmail daemon use.
+Create block devices in /dev with the fixed disk type. +
++Do not audit attempts made by the caller to get +the attributes of fixed disk device nodes. +
++Do not audit attempts made by the caller to get +the attributes of removable devices device nodes. +
++Do not audit attempts made by the caller to set +the attributes of fixed disk device nodes. +
++Do not audit attempts made by the caller to set +the attributes of removable devices device nodes. +
++Allow the caller to get the attributes of fixed disk +device nodes. +
++Allow the caller to get the attributes of removable +devices device nodes. +
+Allow the caller to get the attributes of +the generic SCSI interface device nodes. +
++Get attributes of the device nodes +for the SCSI generic inerface. +
++Allow the caller to get the attributes +of device nodes of tape devices. +
++Allow the caller to directly read from a fixed disk. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly read from a logical volume. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly read from +a removable device. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly write to a fixed disk. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly read from a logical volume. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly write to +a removable device. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly read, in a +generic fashion, from any SCSI device. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly read +a tape device. +
++Set attributes of the device nodes +for the SCSI generic inerface. +
++Allow the caller to set the attributes of fixed disk +device nodes. +
++Allow the caller to set the attributes of removable +devices device nodes. +
++Allow the caller to set the attributes of +the generic SCSI interface device nodes. +
++Allow the caller to set the attributes +of device nodes of tape devices. +
++Unconfined access to storage devices. +
++Allow the caller to directly write, in a +generic fashion, from any SCSI device. +This is extremly dangerous as it can bypass the +SELinux protections for filesystem objects, and +should only be used by trusted domains. +
++Allow the caller to directly read +a tape device. +
++Transition to the unconfined domain by executing a shell. +
++Add the unconfined domain to the specified role. +
++Read and write unconfined domain unnamed pipes. +
++Send a SIGCHLD signal to the unconfined domain. +
++Inherit file descriptors from the unconfined domain. +
++Unconfined access to user domains. +
+-Policy for kernel threads, proc filesystem, -and unlabeled processes and objects. +Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
Policy for the kernel modules, kernel image, and bootloader.
+Policy for the kernel modules, kernel image, and bootloader.
+ diff --git a/www/api-docs/kernel_corenetwork.html b/www/api-docs/kernel_corenetwork.html index aac2e088..94444caf 100644 --- a/www/api-docs/kernel_corenetwork.html +++ b/www/api-docs/kernel_corenetwork.html @@ -78,7 +78,10 @@Policy controlling access to network objects
+Policy controlling access to network objects
+ + +This module is required to be included in all policies.
@@ -18291,6 +18294,47 @@ No+Unconfined access to network objects. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The domain allowed access. + + | +No + |
+
This module creates the device node concept and provides the policy for many of the device files. Notable exceptions are @@ -94,7 +94,8 @@ are used to label device nodes should use the dev_node macro. Additionally, this module controls access to three things:
-
+ + @@ -4049,6 +4050,47 @@ No+Unconfined access to devices. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
Policy for filesystems.
+Policy for filesystems.
+ + +This module is required to be included in all policies.
@@ -3288,6 +3291,47 @@ No+Unconfined access to filesystems +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
-Policy for kernel threads, proc filesystem, -and unlabeled processes and objects. -
++Policy for kernel threads, proc filesystem,and unlabeled processes and objects. +
+ + +This module is required to be included in all policies.
@@ -2151,6 +2153,47 @@ No+Unconfined access to the kernel. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+
Policy for kernel security interface, in particular, selinuxfs. -
+ + + +This module is required to be included in all policies.
@@ -524,6 +527,47 @@ No+Unconfined access to the SELinux security server. +
+ +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
Policy controlling access to storage devices
+Policy controlling access to storage devices
+ @@ -101,12 +102,12 @@Create block devices in /dev with the fixed disk type.
+| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
Allow the caller to directly write, in a generic fashion, from any SCSI device. @@ -1216,6 +1257,7 @@ SELinux protections for filesystem objects, and should only be used by trusted domains.
+| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| -? +domain | -Parameter descriptions are missing! +The type to be used for the mail server. + + | +No + | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| +entry_point + | + +The type to be used for the domain entry point program. |
No
diff --git a/www/api-docs/services_nis.html b/www/api-docs/services_nis.html
index 5997c42a..9670fc74 100644
--- a/www/api-docs/services_nis.html
+++ b/www/api-docs/services_nis.html
@@ -78,7 +78,8 @@
Description:-Policy for NIS (YP) servers and clients +Policy for NIS (YP) servers and clients + diff --git a/www/api-docs/services_remotelogin.html b/www/api-docs/services_remotelogin.html index 8bd22ed8..70a0b7bd 100644 --- a/www/api-docs/services_remotelogin.html +++ b/www/api-docs/services_remotelogin.html @@ -78,7 +78,8 @@Description:-Policy for rshd, rlogind, and telnetd. +Policy for rshd, rlogind, and telnetd. + diff --git a/www/api-docs/services_sendmail.html b/www/api-docs/services_sendmail.html index a8561ad9..1dd53f4a 100644 --- a/www/api-docs/services_sendmail.html +++ b/www/api-docs/services_sendmail.html @@ -78,7 +78,8 @@Description:-Policy for sendmail. +Policy for sendmail. + diff --git a/www/api-docs/services_ssh.html b/www/api-docs/services_ssh.html index 2eadd26f..46a0a118 100644 --- a/www/api-docs/services_ssh.html +++ b/www/api-docs/services_ssh.html @@ -81,7 +81,8 @@Description:-Secure shell client and server policy. +Secure shell client and server policy. + diff --git a/www/api-docs/system.html b/www/api-docs/system.html index 30026953..267d3773 100644 --- a/www/api-docs/system.html +++ b/www/api-docs/system.html @@ -100,6 +100,9 @@ - udev+ - + unconfined + - userdomain @@ -244,6 +247,11 @@ connection and disconnection of devices at runtime. udev |
Policy for udev. |
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| + + unconfined | +The unconfined domain. |
+
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| userdomain | diff --git a/www/api-docs/system_authlogin.html b/www/api-docs/system_authlogin.html index bcd8a82d..89a2f0c9 100644 --- a/www/api-docs/system_authlogin.html +++ b/www/api-docs/system_authlogin.html @@ -100,6 +100,9 @@ - udev
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+
This module contains basic filesystem types and interfaces. This includes:
-
+ + + +This module is required to be included in all policies.
@@ -218,6 +224,65 @@ No+Create home directories +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +home_type + | + +The type of the home directory + + | +No + |
+Unconfined access to files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
Tools for filesystem management, such as mkfs and fsck.
+Tools for filesystem management, such as mkfs and fsck.
+ diff --git a/www/api-docs/system_getty.html b/www/api-docs/system_getty.html index eb97234a..810af4de 100644 --- a/www/api-docs/system_getty.html +++ b/www/api-docs/system_getty.html @@ -100,6 +100,9 @@ - udevPolicy for getty.
+Policy for getty.
+ diff --git a/www/api-docs/system_hostname.html b/www/api-docs/system_hostname.html index a45d6865..93e46aab 100644 --- a/www/api-docs/system_hostname.html +++ b/www/api-docs/system_hostname.html @@ -100,6 +100,9 @@ - udevPolicy for changing the system host name.
+Policy for changing the system host name.
+ diff --git a/www/api-docs/system_hotplug.html b/www/api-docs/system_hotplug.html index c517d4b8..519b4a96 100644 --- a/www/api-docs/system_hotplug.html +++ b/www/api-docs/system_hotplug.html @@ -100,6 +100,9 @@ - udev+
Policy for hotplug system, for supporting the connection and disconnection of devices at runtime. -
+ + diff --git a/www/api-docs/system_init.html b/www/api-docs/system_init.html index 6c086fc5..265a9597 100644 --- a/www/api-docs/system_init.html +++ b/www/api-docs/system_init.html @@ -100,6 +100,9 @@ - udevSystem initialization programs (init and init scripts).
+System initialization programs (init and init scripts).
+ @@ -136,7 +140,15 @@ - ? + domain + + + + , + + + + entry_point )-Summary is missing! +Create a domain for long running processes +(daemons) which can be started by init scripts.
@@ -154,10 +167,20 @@ Summary is missing!-Summary is missing! +Create a domain which can be started by init.
@@ -195,10 +226,20 @@ Summary is missing!+Start and stop daemon programs directly. +
+ +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +role + | + +The role to be performing this action. + + | +No + |
| +terminal + | + +The type of the terminal of the user. + + | +No + |
-Summary is missing! +Create a domain for short running processes +which can be started by init scripts.
@@ -1015,10 +1142,20 @@ Summary is missing!Policy for iptables.
+Policy for iptables.
+ diff --git a/www/api-docs/system_libraries.html b/www/api-docs/system_libraries.html index 73686d52..ff2c5b32 100644 --- a/www/api-docs/system_libraries.html +++ b/www/api-docs/system_libraries.html @@ -100,6 +100,9 @@ - udevPolicy for system libraries.
+Policy for system libraries.
+ diff --git a/www/api-docs/system_locallogin.html b/www/api-docs/system_locallogin.html index 248f982f..34495f7f 100644 --- a/www/api-docs/system_locallogin.html +++ b/www/api-docs/system_locallogin.html @@ -100,6 +100,9 @@ - udevPolicy for local logins.
+Policy for local logins.
+ diff --git a/www/api-docs/system_logging.html b/www/api-docs/system_logging.html index 4554b108..bc1079ef 100644 --- a/www/api-docs/system_logging.html +++ b/www/api-docs/system_logging.html @@ -100,6 +100,9 @@ - udevPolicy for the kernel message logger and system logging daemon.
+Policy for the kernel message logger and system logging daemon.
+ diff --git a/www/api-docs/system_lvm.html b/www/api-docs/system_lvm.html index 0da71a83..ce57f083 100644 --- a/www/api-docs/system_lvm.html +++ b/www/api-docs/system_lvm.html @@ -100,6 +100,9 @@ - udevPolicy for logical volume management programs.
+Policy for logical volume management programs.
+ diff --git a/www/api-docs/system_miscfiles.html b/www/api-docs/system_miscfiles.html index be5525b8..1bf647ef 100644 --- a/www/api-docs/system_miscfiles.html +++ b/www/api-docs/system_miscfiles.html @@ -100,6 +100,9 @@ - udevMiscelaneous files.
+Miscelaneous files.
+ diff --git a/www/api-docs/system_modutils.html b/www/api-docs/system_modutils.html index 36849758..fdbb731c 100644 --- a/www/api-docs/system_modutils.html +++ b/www/api-docs/system_modutils.html @@ -100,6 +100,9 @@ - udevPolicy for kernel module utilities
+Policy for kernel module utilities
+ diff --git a/www/api-docs/system_mount.html b/www/api-docs/system_mount.html index 7f61be86..48b61643 100644 --- a/www/api-docs/system_mount.html +++ b/www/api-docs/system_mount.html @@ -100,6 +100,9 @@ - udevPolicy for mount.
+Policy for mount.
+ diff --git a/www/api-docs/system_selinuxutil.html b/www/api-docs/system_selinuxutil.html index ad54f250..6ed72879 100644 --- a/www/api-docs/system_selinuxutil.html +++ b/www/api-docs/system_selinuxutil.html @@ -100,6 +100,9 @@ - udevPolicy for SELinux policy and userland applications.
+Policy for SELinux policy and userland applications.
+ diff --git a/www/api-docs/system_sysnetwork.html b/www/api-docs/system_sysnetwork.html index 7fcfd262..3dca320d 100644 --- a/www/api-docs/system_sysnetwork.html +++ b/www/api-docs/system_sysnetwork.html @@ -100,6 +100,9 @@ - udevPolicy for network configuration: ifconfig and dhcp client.
+Policy for network configuration: ifconfig and dhcp client.
+ diff --git a/www/api-docs/system_udev.html b/www/api-docs/system_udev.html index d25f12e3..d6d9caa4 100644 --- a/www/api-docs/system_udev.html +++ b/www/api-docs/system_udev.html @@ -100,6 +100,9 @@ - udevPolicy for udev.
+Policy for udev.
+ diff --git a/www/api-docs/system_unconfined.html b/www/api-docs/system_unconfined.html new file mode 100644 index 00000000..a57bce1c --- /dev/null +++ b/www/api-docs/system_unconfined.html @@ -0,0 +1,395 @@ + + +The unconfined domain.
+ + + + ++Transition to the unconfined domain by executing a shell. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Add the unconfined domain to the specified role. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read and write unconfined domain unnamed pipes. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Send a SIGCHLD signal to the unconfined domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Inherit file descriptors from the unconfined domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+A template to make the specified domain unconfined. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to make unconfined. + + | +No + |
Policy for user domains
+Policy for user domains
+ @@ -671,6 +675,47 @@ No+Unconfined access to user domains. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+A template to make the specified domain unconfined. +
+