# # This file is for the declaration of global tunables. # To change the default value at build time, the booleans.conf # file should be used. # ######################################## # # Common tunables # ## <desc> ## <p> ## Allow cvs daemon to read shadow ## </p> ## </desc> # gen_tunable(allow_cvs_read_shadow,false) ## <desc> ## <p> ## Allow making the heap executable. ## </p> ## </desc> gen_tunable(allow_execheap,false) ## <desc> ## <p> ## Allow making anonymous memory executable, e.g. ## for runtime-code generation or executable stack. ## </p> ## </desc> gen_tunable(allow_execmem,false) ## <desc> ## <p> ## Allow making a modified private file ## mapping executable (text relocation). ## </p> ## </desc> gen_tunable(allow_execmod,false) ## <desc> ## <p> ## Allow making the stack executable via mprotect. ## Also requires allow_execmem. ## </p> ## </desc> gen_tunable(allow_execstack,false) ## <desc> ## <p> ## Allow ftp servers to modify public files ## used for public file transfer services. ## </p> ## </desc> gen_tunable(allow_ftpd_anon_write,false) ## <desc> ## <p> ## Allow gssd to read temp directory. ## </p> ## </desc> gen_tunable(allow_gssd_read_tmp,true) ## <desc> ## <p> ## Allow Apache to modify public files ## used for public file transfer services. ## </p> ## </desc> gen_tunable(allow_httpd_anon_write,false) ## <desc> ## <p> ## Allow java executable stack ## </p> ## </desc> gen_tunable(allow_java_execstack,false) ## <desc> ## <p> ## Allow system to run with kerberos ## </p> ## </desc> gen_tunable(allow_kerberos,false) ## <desc> ## <p> ## Allow rsync to modify public files ## used for public file transfer services. ## </p> ## </desc> gen_tunable(allow_rsync_anon_write,false) ## <desc> ## <p> ## Allow sasl to read shadow ## </p> ## </desc> gen_tunable(allow_saslauthd_read_shadow,false) ## <desc> ## <p> ## Allow samba to modify public files ## used for public file transfer services. ## </p> ## </desc> gen_tunable(allow_smbd_anon_write,false) ## <desc> ## <p> ## Allow sysadm to ptrace all processes ## </p> ## </desc> gen_tunable(allow_ptrace,false) ## <desc> ## <p> ## Allow system to run with NIS ## </p> ## </desc> gen_tunable(allow_ypbind,false) ## <desc> ## <p> ## Enable extra rules in the cron domain ## to support fcron. ## </p> ## </desc> gen_tunable(fcron_crond,false) ## <desc> ## <p> ## Allow ftp to read and write files in the user home directories ## </p> ## </desc> gen_tunable(ftp_home_dir,false) ## <desc> ## <p> ## Allow ftpd to run directly without inetd ## </p> ## </desc> gen_tunable(ftpd_is_daemon,false) ## <desc> ## <p> ## Enable reading of urandom for all domains. ## </p> ## <p> ## This should be enabled when all programs ## are compiled with ProPolice/SSP ## stack smashing protection. All domains will ## be allowed to read from /dev/urandom. ## </p> ## </desc> gen_tunable(global_ssp,false) ## <desc> ## <p> ## Allow httpd to use built in scripting (usually php) ## </p> ## </desc> gen_tunable(httpd_builtin_scripting,false) ## <desc> ## <p> ## Allow http daemon to tcp connect ## </p> ## </desc> gen_tunable(httpd_can_network_connect,false) ## <desc> ## <p> ## Allow httpd to connect to mysql/posgresql ## </p> ## </desc> gen_tunable(httpd_can_network_connect_db, false) ## <desc> ## <p> ## Allow httpd to act as a relay ## </p> ## </desc> gen_tunable(httpd_can_network_relay, false) ## <desc> ## <p> ## Allow httpd cgi support ## </p> ## </desc> gen_tunable(httpd_enable_cgi,false) ## <desc> ## <p> ## Allow httpd to act as a FTP server by ## listening on the ftp port. ## </p> ## </desc> gen_tunable(httpd_enable_ftp_server,false) ## <desc> ## <p> ## Allow httpd to read home directories ## </p> ## </desc> gen_tunable(httpd_enable_homedirs,false) ## <desc> ## <p> ## Run SSI execs in system CGI script domain. ## </p> ## </desc> gen_tunable(httpd_ssi_exec,false) ## <desc> ## <p> ## Allow http daemon to communicate with the TTY ## </p> ## </desc> gen_tunable(httpd_tty_comm,false) ## <desc> ## <p> ## Run CGI in the main httpd domain ## </p> ## </desc> gen_tunable(httpd_unified,false) ## <desc> ## <p> ## Allow BIND to write the master zone files. ## Generally this is used for dynamic DNS. ## </p> ## </desc> gen_tunable(named_write_master_zones,false) ## <desc> ## <p> ## Allow nfs to be exported read/write. ## </p> ## </desc> gen_tunable(nfs_export_all_rw,false) ## <desc> ## <p> ## Allow nfs to be exported read only ## </p> ## </desc> gen_tunable(nfs_export_all_ro,false) ## <desc> ## <p> ## Allow pppd to load kernel modules for certain modems ## </p> ## </desc> gen_tunable(pppd_can_insmod,false) ## <desc> ## <p> ## Allow reading of default_t files. ## </p> ## </desc> gen_tunable(read_default_t,false) ## <desc> ## <p> ## Allow ssh to run from inetd instead of as a daemon. ## </p> ## </desc> gen_tunable(run_ssh_inetd,false) ## <desc> ## <p> ## Allow samba to export user home directories. ## </p> ## </desc> gen_tunable(samba_enable_home_dirs,false) ## <desc> ## <p> ## Allow spamassassin to do DNS lookups ## </p> ## </desc> gen_tunable(spamassasin_can_network,false) ## <desc> ## <p> ## Allow squid to connect to all ports, not just ## HTTP, FTP, and Gopher ports. ## </p> ## </desc> gen_tunable(squid_connect_any,false) ## <desc> ## <p> ## Allow ssh logins as sysadm_r:sysadm_t ## </p> ## </desc> gen_tunable(ssh_sysadm_login,false) ## <desc> ## <p> ## Configure stunnel to be a standalone daemon or ## inetd service. ## </p> ## </desc> gen_tunable(stunnel_is_daemon,false) ## <desc> ## <p> ## Support NFS home directories ## </p> ## </desc> gen_tunable(use_nfs_home_dirs,false) ## <desc> ## <p> ## Support SAMBA home directories ## </p> ## </desc> gen_tunable(use_samba_home_dirs,false) ## <desc> ## <p> ## Control users use of ping and traceroute ## </p> ## </desc> gen_tunable(user_ping,false) ######################################## # # Strict policy specific # ifdef(`strict_policy',` ## <desc> ## <p> ## Allow gpg executable stack ## </p> ## </desc> gen_tunable(allow_gpg_execstack,false) ## <desc> ## <p> ## Allow mplayer executable stack ## </p> ## </desc> gen_tunable(allow_mplayer_execstack,false) ## <desc> ## <p> ## allow host key based authentication ## </p> ## </desc> gen_tunable(allow_ssh_keysign,false) ## <desc> ## <p> ## Allow users to connect to mysql ## </p> ## </desc> gen_tunable(allow_user_mysql_connect,false) ## <desc> ## <p> ## Allows clients to write to the X server shared ## memory segments. ## </p> ## </desc> gen_tunable(allow_write_xshm,false) ## <desc> ## <p> ## Allow cdrecord to read various content. ## nfs, samba, removable devices, user temp ## and untrusted content files ## </p> ## </desc> gen_tunable(cdrecord_read_content,false) ## <desc> ## <p> ## Allow system cron jobs to relabel filesystem ## for restoring file contexts. ## </p> ## </desc> gen_tunable(cron_can_relabel,false) ## <desc> ## <p> ## force to games to run in user_t ## mapping executable (text relocation). ## </p> ## </desc> gen_tunable(disable_games_trans,false) ## <desc> ## <p> ## Disable transitions to evolution domains. ## </p> ## </desc> gen_tunable(disable_evolution_trans,false) ## <desc> ## <p> ## Disable transitions to user mozilla domains ## </p> ## </desc> gen_tunable(disable_mozilla_trans,false) ## <desc> ## <p> ## Disable transitions to user thunderbird domains ## </p> ## </desc> gen_tunable(disable_thunderbird_trans,false) ## <desc> ## <p> ## Allow email client to various content. ## nfs, samba, removable devices, user temp ## and untrusted content files ## </p> ## </desc> gen_tunable(mail_read_content,false) ## <desc> ## <p> ## Control mozilla content access ## </p> ## </desc> gen_tunable(mozilla_read_content,false) ## <desc> ## <p> ## Allow pppd to be run for a regular user ## </p> ## </desc> gen_tunable(pppd_for_user,false) ## <desc> ## <p> ## Allow applications to read untrusted content ## If this is disallowed, Internet content has ## to be manually relabeled for read access to be granted ## </p> ## </desc> gen_tunable(read_untrusted_content,false) ## <desc> ## <p> ## Allow user spamassassin clients to use the network. ## </p> ## </desc> gen_tunable(spamassassin_can_network,false) ## <desc> ## <p> ## Allow staff_r users to search the sysadm home ## dir and read files (such as ~/.bashrc) ## </p> ## </desc> gen_tunable(staff_read_sysadm_file,false) ## <desc> ## <p> ## Allow regular users direct mouse access ## </p> ## </desc> gen_tunable(user_direct_mouse,false) ## <desc> ## <p> ## Allow users to read system messages. ## </p> ## </desc> gen_tunable(user_dmesg,false) ## <desc> ## <p> ## Allow users to control network interfaces ## (also needs USERCTL=true) ## </p> ## </desc> gen_tunable(user_net_control,false) ## <desc> ## <p> ## Allow user to r/w files on filesystems ## that do not have extended attributes (FAT, CDROM, FLOPPY) ## </p> ## </desc> gen_tunable(user_rw_noexattrfile,false) ## <desc> ## <p> ## Allow users to rw usb devices ## </p> ## </desc> gen_tunable(user_rw_usb,false) ## <desc> ## <p> ## Allow users to run TCP servers (bind to ports and accept connection from ## the same domain and outside users) disabling this forces FTP passive mode ## and may change other protocols. ## </p> ## </desc> gen_tunable(user_tcp_server,false) ## <desc> ## <p> ## Allow w to display everyone ## </p> ## </desc> gen_tunable(user_ttyfile_stat,false) ## <desc> ## <p> ## Allow applications to write untrusted content ## If this is disallowed, no Internet content ## will be stored. ## </p> ## </desc> gen_tunable(write_untrusted_content,false) ## <desc> ## <p> ## Allow xdm logins as sysadm ## </p> ## </desc> gen_tunable(xdm_sysadm_login,false) ') ######################################## # # Targeted policy specific # ifdef(`targeted_policy',` ## <desc> ## <p> ## Allow spammd to read/write user home directories. ## </p> ## </desc> gen_tunable(spamd_enable_home_dirs,true) ')