Berkeley process accounting
Policy for the Anaconda installer.
Policy for dmesg.
Decode DMI data for x86/ia64 bioses.
Hardware detection and configuration tools
Policy for the Anaconda installer.
+ + + + + +Decode DMI data for x86/ia64 bioses.
+ + + + ++Execute dmidecode in the dmidecode domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute dmidecode in the dmidecode domain, and +allow the specified role the dmidecode domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +role + | + +The role to be allowed the dmidecode domain. + + | +No + |
| +terminal + | + +The type of the terminal allow the dmidecode domain to use. + + | +No + |
Hardware detection and configuration tools
+ + + + ++Execute kudzu in the kudzu domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Execute kudzu in the kudzu domain, and +allow the specified role the kudzu domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +role + | + +The role to be allowed the kudzu domain. + + | +No + |
| +terminal + | + +The type of the terminal allow the kudzu domain to use. + + | +No + |
+Inherit and use logrotate file descriptors. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +role + | + +The role to be allowed the ping domain. + + | +No + |
| +terminal + | + +The type of the terminal allow the ping domain to use. + + | +No + |
+Conditionally execute ping in the ping domain, and +allow the specified role the ping domain. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +role + | + +The role to be allowed the traceroute domain. + + | +No + |
| +terminal + | + +The type of the terminal allow the traceroute domain to use. + + | +No + |
+Conditionally execute traceroute in the traceroute domain, and +allow the specified role the traceroute domain. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute password admin functions in +the admin passwd domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
Load keyboard mappings.
Web server log analysis
Web server log analysis
+ + + + ++Execute webalizer in the webalizer domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Execute webalizer in the webalizer domain, and +allow the specified role the webalizer domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| +role + | + +The role to be allowed the webalizer domain. + + | +No + |
| +terminal + | + +The type of the terminal allow the webalizer domain to use. + + | +No + |
-Enabling secure mode disallows programs, such as -newrole, from transitioning to administrative -user domains. -
+Enabling secure mode disallows programs, such asnewrole, from transitioning to administrativeuser domains.-Allow making anonymous memory executable, e.g. -for runtime-code generation or executable stack. -
+Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.-Allow making a modified private file -mapping executable (text relocation). -
+Allow making a modified private filemapping executable (text relocation). @@ -358,9 +399,19 @@ mapping executable (text relocation).-Allow making the stack executable via mprotect. -Also requires allow_execmem. -
+Allow making the stack executable via mprotect.Also requires allow_execmem. + + + +false
+ ++Allow ftp servers to modify public filesused for public file transfer services.
-Allow gpg executable stack -
+Allow gpg executable stack + + + +false
+ ++Allow Apache to modify public filesused for public file transfer services.
-Allow system to run with kerberos -
+Allow system to run with kerberos + + + +false
+ ++Allow sysadm to ptrace all processes
+ +false
+ ++Allow sasl to read shadow
-allow host key based authentication -
+allow host key based authentication @@ -411,8 +495,7 @@ allow host key based authentication-Allow users to connect to mysql -
+Allow users to connect to mysql @@ -424,8 +507,7 @@ Allow users to connect to mysql-Allow system to run with NIS -
+Allow system to run with NIS @@ -437,9 +519,7 @@ Allow system to run with NIS-Allow system cron jobs to relabel filesystem -for restoring file contexts. -
+Allow system cron jobs to relabel filesystemfor restoring file contexts. @@ -451,9 +531,115 @@ for restoring file contexts.-Enable extra rules in the cron domain -to support fcron. -
+Enable extra rules in the cron domainto support fcron. + + + +false
+ ++Allow ftp to read and write files in the user home directories
+ +false
+ ++Allow ftpd to run directly without inetd
+ +false
+ ++Allow httpd to use built in scripting (usually php)
+ +false
+ ++Allow http daemon to tcp connect
+ +false
+ ++Allow httpd cgi support
+ +false
+ ++Allow httpd to read home directories
+ +false
+ ++Run SSI execs in system CGI script domain.
+ +false
+ ++Allow http daemon to communicate with the TTY
+ +false
+ ++Run CGI in the main httpd domain
-Allow BIND to write the master zone files. -Generally this is used for dynamic DNS. -
+Allow BIND to write the master zone files.Generally this is used for dynamic DNS. + + + +false
+ ++Allow pppd to load kernel modules for certain modems
+ +false
+ ++Allow pppd to be run for a regular user
-Allow reading of default_t files. -
+Allow reading of default_t files. @@ -492,10 +699,7 @@ Allow reading of default_t files.-Allow applications to read untrusted content -If this is disallowed, Internet content has -to be manually relabeled for read access to be granted -
+Allow applications to read untrusted contentIf this is disallowed, Internet content hasto be manually relabeled for read access to be granted @@ -507,8 +711,7 @@ to be manually relabeled for read access to be granted-Allow ssh to run from inetd instead of as a daemon. -
+Allow ssh to run from inetd instead of as a daemon. @@ -520,9 +723,7 @@ Allow ssh to run from inetd instead of as a daemon.-Allow squid to connect to all ports, not just -HTTP, FTP, and Gopher ports. -
+Allow squid to connect to all ports, not justHTTP, FTP, and Gopher ports. @@ -534,8 +735,7 @@ HTTP, FTP, and Gopher ports.-Allow ssh logins as sysadm_r:sysadm_t -
+Allow ssh logins as sysadm_r:sysadm_t @@ -547,9 +747,7 @@ Allow ssh logins as sysadm_r:sysadm_t-Allow staff_r users to search the sysadm home -dir and read files (such as ~/.bashrc) -
+Allow staff_r users to search the sysadm homedir and read files (such as ~/.bashrc) @@ -561,8 +759,7 @@ dir and read files (such as ~/.bashrc)-Support NFS home directories -
+Support NFS home directories @@ -574,8 +771,7 @@ Support NFS home directories-Support SAMBA home directories -
+Support SAMBA home directories @@ -587,8 +783,7 @@ Support SAMBA home directories-Allow regular users direct mouse access -
+Allow regular users direct mouse access @@ -600,8 +795,7 @@ Allow regular users direct mouse access-Allow users to read system messages. -
+Allow users to read system messages. @@ -613,9 +807,7 @@ Allow users to read system messages.-Allow users to control network interfaces -(also needs USERCTL=true) -
+Allow users to control network interfaces(also needs USERCTL=true) @@ -627,8 +819,7 @@ Allow users to control network interfaces-Control users use of ping and traceroute -
+Control users use of ping and traceroute @@ -640,8 +831,7 @@ Control users use of ping and traceroute-Allow user to r/w noextattrfile (FAT, CDROM, FLOPPY) -
+Allow user to r/w noextattrfile (FAT, CDROM, FLOPPY) @@ -653,8 +843,7 @@ Allow user to r/w noextattrfile (FAT, CDROM, FLOPPY)-Allow users to rw usb devices -
+Allow users to rw usb devices @@ -666,10 +855,7 @@ Allow users to rw usb devices-Allow users to run TCP servers (bind to ports and accept connection from -the same domain and outside users) disabling this forces FTP passive mode -and may change other protocols. -
+Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users) disabling this forces FTP passive modeand may change other protocols. @@ -681,8 +867,7 @@ and may change other protocols.-Allow w to display everyone -
+Allow w to display everyone @@ -694,10 +879,7 @@ Allow w to display everyone-Allow applications to write untrusted content -If this is disallowed, no Internet content -will be stored. -
+Allow applications to write untrusted contentIf this is disallowed, no Internet contentwill be stored. diff --git a/www/api-docs/index.html b/www/api-docs/index.html index 5fca52db..81c93634 100644 --- a/www/api-docs/index.html +++ b/www/api-docs/index.html @@ -16,15 +16,24 @@ - acctBerkeley process accounting
Policy for the Anaconda installer.
Policy for dmesg.
Decode DMI data for x86/ia64 bioses.
Hardware detection and configuration tools
Multilevel security policy
Load keyboard mappings.
Web server log analysis
Apache web server
Advanced power management daemon
Ethernet activity monitor.
Berkeley internet name domain DNS server.
Bluetooth tools and system services.
Dictionary daemon
Finger user information service.
File transfer protocol service
OpenLDAP directory server
Mailman is for managing electronic mail discussion and e-newsletter lists
PostgreSQL relational database
Point to Point Protocol daemon creates links in ppp networks
Privacy enhancing web proxy.
IPv6 router advertisement daemon
SMB and CIFS client/server programs for UNIX
+SMB and CIFS client/server programs for UNIX and +name Service Switch daemon for resolving names +from Windows NT servers. +
SASL authentication server
+Allow the specified domain to append +apache squirrelmail data. +
++Transition to apache. +
++Execute all user scripts in the user +script domain. +
++Execute the Apache helper program with +a domain transition. +
++Execute all web scripts in the system +script domain. +
++Do not audit attempts to append to the +Apache logs. +
++Do not audit attempts to read and write Apache +unix domain stream sockets. +
++Do not audit attempts to read and write Apache +system script unix domain stream sockets. +
++Do not audit attempts to read and write Apache +TCP sockets. +
++Allow the specified domain to list +the contents of the apache modules +directory. +
++Allow the specified domain to manage +apache system content files. +
++Allow the specified domain to read +apache configuration files. +
++Allow the specified domain to read +apache log files. +
++Allow the specified domain to read +apache squirrelmail data. +
++Execute all user scripts in the user +script domain. Add user script domains +to the specified role. +
++Execute the Apache helper program with +a domain transition, and allow the +specified role the dmidecode domain. +
++Send a SIGCHLD signal to apache. +
++Send a null signal to apache. +
++Inherit and use file descriptors from Apache. +
++Append to apm's log file. +
++Execute APM in the apm domain. +
++Read and write to an apm unix stream socket. +
++Use file descriptors for apmd. +
++Write to apmd unnamed pipes. +
++Do not audit attempts to read and write +arpwatch packet sockets. +
++Create arpwatch data files. +
++Read and write arpwatch temporary files. +
++Search arpwatch's data file directories. +
++Append only to the last logins log. +
++Append to login records (wtmp). +
++Read the last logins log. +
+-Summary is missing! +Read and write to the last logins log.
+Use nsswitch to look up uid-username mappings. +
++Write to login records (wtmp). +
++Execute bind in the named domain. +
++Search the contents of the kernel module directories. +
+- Execute hwclock in the caller domain. -
+Execute hwclock in the caller domain. +- Allow executing domain to modify clock drift -
+Allow executing domain to modify clock drift ++Bind TCP sockets to the pegasus_http port. +
++Bind TCP sockets to the pegasus_https port. +
++Connect TCP sockets to reserved ports. +
++Make a TCP connection to the pegasus_http port. +
++Make a TCP connection to the pegasus_https port. +
++Send and receive TCP traffic on the pegasus_http port. +
++Send and receive TCP traffic on the pegasus_https port. +
++Bind UDP sockets to the pegasus_http port. +
++Bind UDP sockets to the pegasus_https port. +
++Receive UDP traffic on the pegasus_http port. +
++Receive UDP traffic on the pegasus_https port. +
++Send UDP traffic on the pegasus_http port. +
++Send UDP traffic on the pegasus_https port. +
++Send and receive UDP traffic on the pegasus_http port. +
++Send and receive UDP traffic on the pegasus_https port. +
++Read and write the point-to-point device. +
++Read and write the the hardware SSL accelerator. +
++Read and write to mouse devices. +
++Execute dmidecode in the dmidecode domain. +
++Execute dmidecode in the dmidecode domain, and +allow the specified role the dmidecode domain. +
++Do not audit attempts to get attribues of +all domains IPSEC key management sockets. +
++Ptrace all domains. +
++Do not audit attempts to get the +attributes of the home directories root +(/home). +
++Do not audit attempts to get the attributes +of non security block devices. +
++Do not audit attempts to get the attributes +of non security character devices. +
++Do not audit attempts to get the attributes +of non security files. +
++Do not audit attempts to get the attributes +of non security named pipes. +
++Do not audit attempts to get the attributes +of non security named sockets. +
++Do not audit attempts to get the attributes +of non security symbolic links. +
++Do not audit attempts to list all +non security directories. +
++Do not audit attempts to search +the /var/run directory. +
+-Summary is missing! +Do not audit attempts to search +the contents of /var.
+Execute generic programs in /usr in the caller domain. +
+-Do not audit attempts to get the -attributes of the home directories root +Get the attributes of the home directories root (/home).
+List the contents of /var. +
+-Make the specified type a +Make the specified type a polyinstantiated directory.
-Read generic files in /var/lib +Read generic files in /var/lib. +
++Read generic symbolic links in /var/lib
-Read and write block device nodes on new filesystems +Read and write block device nodes on new filesystems that have not yet been labeled.
+Add and remove entries in the /var/lock +directories. +
++Search all directories. +
+-Summary is missing! +Search the contents of /var.
+Make the specified type a file that +should not be dontaudited from +browsing from user domains. +
+-Summary is missing! +Make the specified type usable for files +in a filesystem.
+Execute fingerd in the fingerd domain. +
++Allow the specified domain to connect to fingerd with a tcp socket. +
++Do not audit attempts to get the attributes +of all files with a filesystem type. +
++Do not audit attempts to get the attributes +of all named pipes with a filesystem type. +
++Do not audit attempts to get the attributes +of all named sockets with a filesystem type. +
++Do not audit attempts to get the attributes +of all symbolic links with a filesystem type. +
++Get the quotas of a persistent +filesystem which has extended +attributes, such as ext3, JFS, or XFS. +
+-Summary is missing! +Get the attributes of all files with +a filesystem type.
+Get the attributes of all named pipes with +a filesystem type. +
++Get the attributes of all named sockets with +a filesystem type. +
++Get the attributes of all symbolic links with +a filesystem type. +
++Search directories on a ramfs +
++Write to named socket on a ramfs filesystem. +
++Execute FTP daemon entry point programs. +
++Read ftpd etc files +
++Read FTP transfer logs +
++Use ftp by connecting over TCP. +
+-Do not audit attempts to get the +Do not audit attempts to get the attributes of the GPM control channel named socket.
@@ -33136,8 +35554,8 @@ system- Execute hostname in the caller domain. -
+Execute hostname in the caller domain. ++Dont audit the specified domain connecting to +init scripts with a unix domain stream socket. +
++Allow the specified domain to connect to +init scripts with a unix domain stream socket. +
++Allow the specified domain to connect to +init scripts with a unix socket. +
++Do not audit attempts to search generic kernel sysctls. +
+-Do not audit attempts by caller to search sysctl network directories. +Do not audit attempts by caller to search network sysctl directories.
-Do not audit attempts by caller to search the sysctl directory. +Do not audit attempts by caller to search +the base directory of sysctls.
+Read information from the debugging filesystem. +
++Search network sysctl directories. +
++Write to generic proc entries. +
++Execute kudzu in the kudzu domain. +
++Execute kudzu in the kudzu domain, and +allow the specified role the kudzu domain. +
++List the contents of the generic log directory (/var/log). +
++Inherit and use logrotate file descriptors. +
++Execute mailman in the mailman domain. +
++Execute mailman CGI scripts in the +mailman CGI domain. +
++Execute mailman in the caller domain. +
++List the contents of mailman data directories. +
++Create, read, write, and delete +mailman logs. +
++Allow domain to read mailman archive files. +
++Allow read acces to mailman data symbolic links. +
++Allow domain to search data directories. +
++Send generic signals to the mailman cgi domain. +
++Create, read, write, and delete public files +and directories used for file transfer services. +
++Read system SSL certificates. +
+-Read fonts +Read fonts. +
++Read hardware identification data.
+Read public files used for file +transfer services. +
++Make specified domain MLS trusted +for lowering the level of files. +
++Make specified domain MLS trusted +for reading from files at higher levels. +
++Make specified domain MLS trusted +for raising the level of files. +
++Make specified domain MLS trusted +for writing to files at lower levels. +
++Make specified domain MLS trusted +for reading from processes at higher levels. +
++Make specified domain MLS trusted +for setting the level of processes +it executes. +
++Make specified domain MLS trusted +for writing to processes at lower levels. +
++Allow the specified domain to do a MLS +range transition that changes +the current level. +
++Make specified domain a target domain +for MLS range transitions that change +the current level. +
++Make specified object MLS trusted. +
++Rename a file with the configuration options used when +loading modules. +
++Do not audit attempts to read and write TCP +sockets of mail delivery domains. +
++MTA stub interface. No access allowed. +
++Connect to all mail servers over TCP. +
++Read and write to the MySQL database +named socket. +
++Conditionally execute ping in the ping domain, and +allow the specified role the ping domain. +
++Conditionally execute traceroute in the traceroute domain, and +allow the specified role the traceroute domain. +
++Send generic signals to ypbind. +
++Use the ypbind service to access NIS services +unconditionally. +
++Execute domain in the ppp domain. +
++Unconditionally execute ppp daemon on behalf of a user or staff type. +
++Conditionally execute ppp daemon on behalf of a user or staff type. +
++Allow domain to send sigchld to parent of PPP domain type. +
++Allow domain to send a signal to PPP domain type. +
++Use PPP file discriptors. +
++Execute winbind_helper in the winbind_helper domain. +
++Allow the specified domain to read the winbind pid files. +
++Allow the specified domain to read the winbind pid files. +
++Execute winbind_helper in the winbind_helper domain, and +allow the specified role the winbind_helper domain. +
++Search selinuxfs. +
++Sendmail stub interface. No access allowed. +
++Execute su in the caller domain. +
++Delete the dhcp client pid file. +
++Execute tcpd in the tcpd domain. +
++ioctl of generic pty types. +
++Search the contents of the /dev/pts directory. +
++Read and write the pty multiplexor (/dev/ptmx). +
++Allow process to read udev process state. +
++Don't audit search on the user home subdirectory. +
++Dont audit attempts to read and write sysadm ptys. +
++Get the attributes of the sysadm users +home directory. +
++Create, read, write, and delete all directories +in all users home directories. +
++Create, read, write, and delete all files +in all users home directories. +
++Create, read, write, and delete all symlinks +in all users home directories. +
++Read all unprivileged users home directory +files. +
++Search all unprivileged users home directories. +
++Send a SIGCHLD signal to sysadm users. +
++Execute password admin functions in +the admin passwd domain. +
++Execute webalizer in the webalizer domain. +
++Execute webalizer in the webalizer domain, and +allow the specified role the webalizer domain. +
+Multilevel security policy
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Search the contents of the kernel module directories. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Bind TCP sockets to the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Bind TCP sockets to the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Connect TCP sockets to reserved ports. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make a TCP connection to the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make a TCP connection to the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send and receive TCP traffic on the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send and receive TCP traffic on the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Bind UDP sockets to the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Bind UDP sockets to the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Receive UDP traffic on the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Receive UDP traffic on the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send UDP traffic on the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send UDP traffic on the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send and receive UDP traffic on the pegasus_http port. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send and receive UDP traffic on the pegasus_https port. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The domain allowed access. + + | +No + |
+Read and write the point-to-point device. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read and write the the hardware SSL accelerator. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read and write to mouse devices. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to get the attributes +of all named pipes with a filesystem type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to get the attributes +of all named sockets with a filesystem type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to get the attributes +of all symbolic links with a filesystem type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Get the quotas of a persistent +filesystem which has extended +attributes, such as ext3, JFS, or XFS. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the domain getting quotas. + + | +No + |
-Summary is missing! +Get the attributes of all files with +a filesystem type.
@@ -1156,10 +1376,10 @@ Summary is missing!+Get the attributes of all named pipes with +a filesystem type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Get the attributes of all named sockets with +a filesystem type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Get the attributes of all symbolic links with +a filesystem type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Search directories on a ramfs +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Write to named socket on a ramfs filesystem. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to search generic kernel sysctls. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
-Do not audit attempts by caller to search sysctl network directories. +Do not audit attempts by caller to search network sysctl directories.
@@ -476,13 +521,13 @@ No-Do not audit attempts by caller to search the sysctl directory. +Do not audit attempts by caller to search +the base directory of sysctls.
@@ -1109,6 +1155,48 @@ No+Read information from the debugging filesystem. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Search network sysctl directories. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Write to generic proc entries. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+
+This module contains interfaces for handling multilevel +security. The interfaces allow the specified subjects +and objects to be allowed certain privileges in the +MLS rules. +
+
+ + +This module is required to be included in all policies.
+ + + ++Make specified domain MLS trusted +for lowering the level of files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain MLS trusted +for reading from files at higher levels. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain MLS trusted +for raising the level of files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain MLS trusted +for writing to files at lower levels. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain MLS trusted +for reading from processes at higher levels. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain MLS trusted +for setting the level of processes +it executes. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain MLS trusted +for writing to processes at lower levels. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Allow the specified domain to do a MLS +range transition that changes +the current level. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified domain a target domain +for MLS range transitions that change +the current level. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Make specified object MLS trusted. +
+ + ++
+Make specified object MLS trusted. This +allows all levels to read and write the +object. +
+
+This currently only applies to filesystem +objects, for example, files and directories. +
+
+ +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the object. + + | +No + |
+Search selinuxfs. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+ioctl of generic pty types. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Search the contents of the /dev/pts directory. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process to allow access. + + | +No + |
Apache web server
Advanced power management daemon
Ethernet activity monitor.
Berkeley internet name domain DNS server.
Bluetooth tools and system services.
Dictionary daemon
Finger user information service.
File transfer protocol service
OpenLDAP directory server
Mailman is for managing electronic mail discussion and e-newsletter lists
PostgreSQL relational database
Point to Point Protocol daemon creates links in ppp networks
Privacy enhancing web proxy.
IPv6 router advertisement daemon
SMB and CIFS client/server programs for UNIX
+SMB and CIFS client/server programs for UNIX and +name Service Switch daemon for resolving names +from Windows NT servers. +
SASL authentication server
Apache web server
+ + + + ++Allow the specified domain to append +apache squirrelmail data. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Transition to apache. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute all user scripts in the user +script domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute the Apache helper program with +a domain transition. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute all web scripts in the system +script domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to append to the +Apache logs. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to read and write Apache +unix domain stream sockets. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to read and write Apache +system script unix domain stream sockets. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Do not audit attempts to read and write Apache +TCP sockets. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to list +the contents of the apache modules +directory. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to manage +apache system content files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to read +apache configuration files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to read +apache log files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to read +apache squirrelmail data. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute all user scripts in the user +script domain. Add user script domains +to the specified role. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
| +role + | + +The role to be allowed the script domains. + + | +No + |
+Execute the Apache helper program with +a domain transition, and allow the +specified role the dmidecode domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
| +role + | + +The role to be allowed the dmidecode domain. + + | +No + |
| +terminal + | + +The type of the terminal allow the dmidecode domain to use. + + | +No + |
+Send a SIGCHLD signal to apache. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Send a null signal to apache. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Inherit and use file descriptors from Apache. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Create a set of derived types for apache +web content. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +prefix + | + +The prefix to be used for deriving type names. + + | +No + |
+The per user domain template for the apache module. +
+ + ++
+This template creates types used for web pages +and web cgi to be used from the user home directory. +
+
+This template is invoked automatically for each user, and +generally does not need to be invoked directly +by policy writers. +
+
+ +| Parameter: | Description: | Optional: |
|---|---|---|
| +userdomain_prefix + | + +The prefix of the user domain (e.g., user +is the prefix for user_t). + + | +No + |
| +user_domain + | + +The type of the user domain. + + | +No + |
| +user_role + | + +The role associated with the user domain. + + | +No + |
Advanced power management daemon
+ + + + ++Append to apm's log file. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute APM in the apm domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read and write to an apm unix stream socket. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Use file descriptors for apmd. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Write to apmd unnamed pipes. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
Ethernet activity monitor.
+ + + + ++Do not audit attempts to read and write +arpwatch packet sockets. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Create arpwatch data files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read and write arpwatch temporary files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Search arpwatch's data file directories. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute bind in the named domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
Bluetooth tools and system services.
+ + + + + +Finger user information service.
+ + + + ++Execute fingerd in the fingerd domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Allow the specified domain to connect to fingerd with a tcp socket. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
File transfer protocol service
+ + + + ++Execute FTP daemon entry point programs. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read ftpd etc files +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read FTP transfer logs +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Use ftp by connecting over TCP. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
-Do not audit attempts to get the +Do not audit attempts to get the attributes of the GPM control channel named socket.
diff --git a/www/api-docs/services_hal.html b/www/api-docs/services_hal.html index d37fbc53..06979a04 100644 --- a/www/api-docs/services_hal.html +++ b/www/api-docs/services_hal.html @@ -31,9 +31,21 @@ servicesServers:
-
kadmind
-
krb5kdc
+
kadmind
+
krb5kdc
Clients:
-
kinit
-
kdestroy
-
klist
-
ksu (incomplete)
+
kinit
+
kdestroy
+
klist
+
ksu (incomplete)
diff --git a/www/api-docs/services_ktalk.html b/www/api-docs/services_ktalk.html index d99f2a62..f88e605e 100644 --- a/www/api-docs/services_ktalk.html +++ b/www/api-docs/services_ktalk.html @@ -31,9 +31,21 @@ services
Mailman is for managing electronic mail discussion and e-newsletter lists
+ + + + ++Execute mailman in the mailman domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute mailman CGI scripts in the +mailman CGI domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Execute mailman in the caller domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowd access. + + | +No + |
+List the contents of mailman data directories. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Create, read, write, and delete +mailman logs. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow domain to read mailman archive files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow read acces to mailman data symbolic links. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow domain to search data directories. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Send generic signals to the mailman cgi domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+The template to define a mailmain domain. +
+ + ++
+This template creates a domain to be used for +a new mailman daemon. +
+
+ +| Parameter: | Description: | Optional: |
|---|---|---|
| +userdomain_prefix + | + +The type of daemon to be used eg, cgi would give mailman_cgi_ + + | +No + |
+Do not audit attempts to read and write TCP +sockets of mail delivery domains. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Mail server domain. + + | +No + |
+MTA stub interface. No access allowed. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +N/A + + | +yes + |
+Connect to all mail servers over TCP. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Mail server domain. + + | +No + |
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read and write to the MySQL database +named socket. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Send generic signals to ypbind. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Use the ypbind service to access NIS services +unconditionally. +
+ + ++
+Use the ypbind service to access NIS services +unconditionally. +
+
+This interface was added because of apache and +spamassassin, to fix a nested conditionals problem. +When that support is added, this should be removed, +and the regular interface should be used. +
+
+| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Unconditionally execute ppp daemon on behalf of a user or staff type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Conditionally execute ppp daemon on behalf of a user or staff type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow domain to send sigchld to parent of PPP domain type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow domain to send a signal to PPP domain type. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Use PPP file discriptors. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
IPv6 router advertisement daemon
+ + + + + +SMB and CIFS client/server programs for UNIX
++SMB and CIFS client/server programs for UNIX and +name Service Switch daemon for resolving names +from Windows NT servers. +
@@ -251,6 +285,48 @@ Execute smbmount in the smbmount domain. +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Execute winbind_helper in the winbind_helper domain. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to read the winbind pid files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to read the winbind pid files. +
+ +SASL authentication server
+ + + + + ++Sendmail stub interface. No access allowed. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +N/A + + | +yes + |
+Execute tcpd in the tcpd domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Append only to the last logins log. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Append to login records (wtmp). +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
-Summary is missing! +Read and write to the last logins log.
@@ -1533,10 +1659,10 @@ Summary is missing!+
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Use nsswitch to look up uid-username mappings. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Write to login records (wtmp). +
+ +| Parameter: | Description: | Optional: | - The type of the process performing this action. - +The type of the process performing this action. + | No | @@ -326,8 +326,8 @@ No- The type of the process performing this action. - +The type of the process performing this action. + | No | diff --git a/www/api-docs/system_domain.html b/www/api-docs/system_domain.html index 99e978f1..c4ab57dd 100644 --- a/www/api-docs/system_domain.html +++ b/www/api-docs/system_domain.html @@ -324,6 +324,49 @@ No + +
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
+Ptrace all domains. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the +attributes of the home directories root +(/home). +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the attributes +of non security block devices. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the attributes +of non security character devices. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the attributes +of non security files. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the attributes +of non security named pipes. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the attributes +of non security named sockets. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to get the attributes +of non security symbolic links. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
+Do not audit attempts to list all +non security directories. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain to not audit. + + | +No + |
-Summary is missing! +Do not audit attempts to search +the contents of /var.
@@ -1945,10 +2334,10 @@ Summary is missing!+Execute generic programs in /usr in the caller domain. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +The type of the process performing this action. + + | +No + |
-Do not audit attempts to get the -attributes of the home directories root +Get the attributes of the home directories root (/home).
@@ -2910,6 +3340,48 @@ directories in /usr. +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+List the contents of /var. +
+ +| Parameter: | Description: | Optional: |
|---|
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read generic symbolic links in /var/lib
@@ -5599,7 +6113,7 @@ No-Read and write block device nodes on new filesystems +Read and write block device nodes on new filesystems that have not yet been labeled.
@@ -5665,6 +6179,91 @@ No+Add and remove entries in the /var/lock +directories. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Search all directories. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
-Summary is missing! +Search the contents of /var.
@@ -6114,10 +6713,10 @@ Summary is missing!+Make the specified type a file that +should not be dontaudited from +browsing from user domains. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +file_type + | + +Type of the file to be used as a +member directory. + + | +No + |
-Summary is missing! +Make the specified type usable for files +in a filesystem.
@@ -6369,10 +7014,10 @@ Summary is missing!- Execute hostname in the caller domain. -
+Execute hostname in the caller domain. ++Dont audit the specified domain connecting to +init scripts with a unix domain stream socket. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to connect to +init scripts with a unix domain stream socket. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Allow the specified domain to connect to +init scripts with a unix socket. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+List the contents of the generic log directory (/var/log). +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Create, read, write, and delete public files +and directories used for file transfer services. +
+ + +| Parameter: | Description: | Optional: |
|---|---|---|
| +domain + | + +Domain allowed access. + + | +No + |
+Read system SSL certificates. +
+ +| Parameter: | Description: | Optional: | -Type type of the process performing this action. +Domain allowed access. + + | +No + | + +
|---|
+Read hardware identification data. +
+ + +| Parameter: | Description: | Optional: | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| +domain + | + +Domain allowed access. | No @@ -385,7 +512,7 @@ Allow process to read localization info domain | -Type type of the process performing this action. +Domain allowed access. |
No
@@ -419,6 +546,49 @@ Read man pages
+Parameters+
+
+
+
+
+miscfiles_read_public_files(
+
+
+
+
+ domain
+
+
+ )
++
+
+ Summary++Read public files used for file +transfer services. + + +Parameters
|