+## Allow users to manage files on dosfs_t devices, usually removable media +##
+##+## This interface allows a domain to execute sudo_exec_t without a +## domain transition. It is for daemons that already have setuid +## access but are running as uid != 0. +##
+##+## Enabling this allows some daemons to access unconfined_home_dir_t and +## unconfined_home_t as if they were regular home directories. This does +## reduce the protection... +##
+##+## Allow the specified domain to be run in the role unconfined_r +## This is suitable for domains that are entered indirectly from +## unconfined_t +##
+##+## Also allow the domain to send sigchld to unconfined_t and use fds +##
+##+## Debians python-support will precompile installed python +## packages for installed python versions. This way, +## the python2.3-foobar and python2.4-foobar (and 2.5) packages +## could be merged into one python-foobar while keeping the +## dependency information useful. +##
+##+## This template creates a user domain, types, and +## rules for the user's tty, pty, home directories, +## tmp, and tmpfs files. +##
+##+## This differs from the unpriv_user_template by allowing non-privileged network access. +##
+##+## Allow the Erlang Port mapper to coordinate all nodes in distributed +## computing. It also wants to run on single nodes so any daemon written in +## Erlang will need it. +##
+##+## Make specified object MCS trusted. This +## allows all levels to read and write the +## object. +##
+##+## This currently only applies to filesystem +## objects, for example, files and directories. +##
+##+Enabling secure mode disallows programs, such as +newrole, from transitioning to administrative +user domains. +
++Disable transitions to insmod. +
++boolean to determine whether the system permits loading policy, setting +enforcing mode, and changing boolean values. Set this to true and you +have to reboot to set it back +
++Allow cvs daemon to read shadow +
++Allow zebra daemon to write it configuration files +
++Allow making the heap executable. +
++Allow making anonymous memory executable, e.g. +for runtime-code generation or executable stack. +
++Allow making a modified private file +mapping executable (text relocation). +
++Allow making the stack executable via mprotect. +Also requires allow_execmem. +
++Allow ftp servers to modify public files +used for public file transfer services. +
++Allow ftp servers to use cifs +used for public file transfer services. +
++Allow ftp servers to use nfs +used for public file transfer services. +
++Allow gssd to read temp directory. +
++Allow Apache to modify public files +used for public file transfer services. +
++Allow Apache to use mod_auth_pam +
++Allow java executable stack +
++Allow system to run with kerberos +
++Allow nfs servers to modify public files +used for public file transfer services. +
++Allow rsync to modify public files +used for public file transfer services. +
++Allow sasl to read shadow +
++Allow samba to modify public files +used for public file transfer services. +
++Allow system to run with NIS +
++Enable extra rules in the cron domain +to support fcron. +
++Allow ftp to read and write files in the user home directories +
++Allow ftpd to run directly without inetd +
++Enable reading of urandom for all domains. +
++This should be enabled when all programs +are compiled with ProPolice/SSP +stack smashing protection. All domains will +be allowed to read from /dev/urandom. +
++Allow httpd to use built in scripting (usually php) +
++Allow http daemon to tcp connect +
++Allow httpd to connect to mysql/posgresql +
++Allow httpd to act as a relay +
++Allow httpd cgi support +
++Allow httpd to act as a FTP server by +listening on the ftp port. +
++Allow httpd to read home directories +
++Run SSI execs in system CGI script domain. +
++Allow http daemon to communicate with the TTY +
++Run CGI in the main httpd domain +
++Allow BIND to write the master zone files. +Generally this is used for dynamic DNS. +
++Allow nfs to be exported read/write. +
++Allow nfs to be exported read only +
++Allow pppd to load kernel modules for certain modems +
++Allow reading of default_t files. +
++Allow samba to export user home directories. +
++Allow samba to export NFS volumes. +
++Allow squid to connect to all ports, not just +HTTP, FTP, and Gopher ports. +
++Configure stunnel to be a standalone daemon or +inetd service. +
++Support NFS home directories +
++Support SAMBA home directories +
++Control users use of ping and traceroute +
++Allow gpg executable stack +
++Allow mplayer executable stack +
++Allow sysadm to ptrace all processes +
++allow host key based authentication +
++Allow users to connect to mysql +
++Allows clients to write to the X server shared +memory segments. +
++Allow cdrecord to read various content. +nfs, samba, removable devices, user temp +and untrusted content files +
++Allow system cron jobs to relabel filesystem +for restoring file contexts. +
++force to games to run in user_t +mapping executable (text relocation). +
++Disable transitions to evolution domains. +
++Disable transitions to user mozilla domains +
++Disable transitions to user thunderbird domains +
++Allow email client to various content. +nfs, samba, removable devices, user temp +and untrusted content files +
++Control mozilla content access +
++Allow pppd to be run for a regular user +
++Allow applications to read untrusted content +If this is disallowed, Internet content has +to be manually relabeled for read access to be granted +
++Allow ssh to run from inetd instead of as a daemon. +
++Allow user spamassassin clients to use the network. +
++Allow ssh logins as sysadm_r:sysadm_t +
++Allow staff_r users to search the sysadm home +dir and read files (such as ~/.bashrc) +
++Allow regular users direct mouse access +
++Allow users to read system messages. +
++Allow users to control network interfaces +(also needs USERCTL=true) +
++Allow user to r/w files on filesystems +that do not have extended attributes (FAT, CDROM, FLOPPY) +
++Allow users to run TCP servers (bind to ports and accept connection from +the same domain and outside users) disabling this forces FTP passive mode +and may change other protocols. +
++Allow w to display everyone +
++Allow applications to write untrusted content +If this is disallowed, no Internet content +will be stored. +
++Allow xdm logins as sysadm +
++Allow all daemons the ability to use unallocated ttys +
++Allow mount to mount any file +
++Allow spammd to read/write user home directories. +
++Allow httpd cgi support +
++Allow unconfined to dyntrans to unconfined_execmem +
+
+## More descriptive text about myapp. The , , and
+## html tags for formatting.
+##
+## This policy supports the following myapp features: +##