From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 986BF15802F for ; Fri, 31 Mar 2023 23:07:24 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 391D6E08ED; Fri, 31 Mar 2023 23:07:17 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id DC46EE08ED for ; Fri, 31 Mar 2023 23:07:16 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 73984340FCC for ; Fri, 31 Mar 2023 23:07:15 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 4EB53A2F for ; Fri, 31 Mar 2023 23:07:12 +0000 (UTC) From: "Kenton Groombridge" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Kenton Groombridge" Message-ID: <1680286082.062f39e5dcb952b95a2f1272960b2379f5a41069.concord@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: doc/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: doc/policy.xml X-VCS-Directories: doc/ X-VCS-Committer: concord X-VCS-Committer-Name: Kenton Groombridge X-VCS-Revision: 062f39e5dcb952b95a2f1272960b2379f5a41069 X-VCS-Branch: master Date: Fri, 31 Mar 2023 23:07:12 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 6199e9bf-00d0-4d73-85ec-40ff576f94c8 X-Archives-Hash: fac482737f51cb96ee8206702eb1bee6 commit: 062f39e5dcb952b95a2f1272960b2379f5a41069 Author: Kenton Groombridge gentoo org> AuthorDate: Fri Mar 31 18:07:26 2023 +0000 Commit: Kenton Groombridge gentoo org> CommitDate: Fri Mar 31 18:08:02 2023 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=062f39e5 Update generated policy and doc files Signed-off-by: Kenton Groombridge gentoo.org> doc/policy.xml | 1750 ++++++++++++++++++++++++++++++-------------------------- 1 file changed, 944 insertions(+), 806 deletions(-) diff --git a/doc/policy.xml b/doc/policy.xml index ed1c8ef5d..ec78d3383 100644 --- a/doc/policy.xml +++ b/doc/policy.xml @@ -2455,7 +2455,17 @@ Domain to not audit. - + + +Do not audit attempts to read and write inherited portage ptys. + + + +Domain allowed access. + + + + Do not audit attempts to search the portage temporary directories. @@ -2466,7 +2476,7 @@ Domain to not audit. - + Do not audit attempts to read and write the portage temporary files. @@ -2477,7 +2487,7 @@ Domain to not audit. - + Allow the domain to run within an eselect module script. @@ -2487,7 +2497,7 @@ Domain to allow within an eselect module - + Read all portage files @@ -2502,7 +2512,7 @@ Domain allowed access - + Read portage db files @@ -2512,7 +2522,7 @@ Domain allowed access - + Read portage cache files @@ -2522,7 +2532,7 @@ Domain allowed access - + Read portage configuration files @@ -2532,7 +2542,7 @@ Domain allowed access - + Read portage ebuild files @@ -2542,7 +2552,7 @@ Domain allowed access - + Read portage log files @@ -2552,7 +2562,7 @@ Domain allowed access - + Read portage src repository files @@ -2562,7 +2572,7 @@ Domain allowed access - + Do not audit writing portage cache files @@ -61051,7 +61061,18 @@ Domain not to audit. - + + +Relabel configuration symlinks. + + + +Domain allowed access. + + + + + Mount a filesystem on all mount points. @@ -61061,7 +61082,7 @@ Domain allowed access. - + Get the attributes of all mount points. @@ -61071,7 +61092,7 @@ Domain allowed access. - + Set the attributes of all mount points. @@ -61081,7 +61102,7 @@ Domain allowed access. - + Do not audit attempts to set the attributes on all mount points. @@ -61091,7 +61112,7 @@ Domain to not audit. - + Search all mount points. @@ -61101,7 +61122,7 @@ Domain allowed access. - + Do not audit searching of all mount points. @@ -61111,7 +61132,7 @@ Domain to not audit. - + List all mount points. @@ -61121,7 +61142,7 @@ Domain allowed access. - + Do not audit listing of all mount points. @@ -61131,7 +61152,7 @@ Domain to not audit. - + Watch all mountpoints. @@ -61141,7 +61162,7 @@ Domain allowed access. - + Watch all mountpoints. @@ -61151,7 +61172,7 @@ Domain allowed access. - + Check if all mountpoints are writable. @@ -61161,7 +61182,7 @@ Domain allowed access. - + Do not audit attempts to write to mount points. @@ -61171,7 +61192,7 @@ Domain to not audit. - + List the contents of the root directory. @@ -61181,7 +61202,7 @@ Domain allowed access. - + Delete symbolic links in the root directory. @@ -61192,7 +61213,7 @@ Domain allowed access. - + Do not audit attempts to write to / dirs. @@ -61202,7 +61223,7 @@ Domain to not audit. - + Do not audit attempts to write files in the root directory. @@ -61213,7 +61234,7 @@ Domain to not audit. - + Watch the root directory. @@ -61223,7 +61244,7 @@ Domain allowed access. - + Create an object in the root directory, with a private type using a type transition. @@ -61249,7 +61270,7 @@ The name of the object being created. - + Do not audit attempts to read files in the root directory. @@ -61260,7 +61281,7 @@ Domain to not audit. - + Do not audit attempts to read or write files in the root directory. @@ -61271,7 +61292,7 @@ Domain to not audit. - + Do not audit attempts to read or write character device nodes in the root directory. @@ -61282,7 +61303,7 @@ Domain to not audit. - + Delete character device nodes in the root directory. @@ -61293,7 +61314,7 @@ Domain allowed access. - + Delete files in the root directory. @@ -61303,7 +61324,7 @@ Domain allowed access. - + Execute files in the root directory. @@ -61313,7 +61334,7 @@ Domain allowed access. - + Remove entries from the root directory. @@ -61323,7 +61344,7 @@ Domain allowed access. - + Manage the root directory. @@ -61333,7 +61354,7 @@ Domain allowed access. - + Get the attributes of a rootfs file system. @@ -61344,7 +61365,7 @@ Domain allowed access. - + Associate to root file system. @@ -61354,7 +61375,7 @@ Type of the file to associate. - + Relabel to and from rootfs file system. @@ -61364,7 +61385,7 @@ Domain allowed access. - + Unmount a rootfs filesystem. @@ -61374,7 +61395,7 @@ Domain allowed access. - + Mount on the root directory (/) @@ -61384,7 +61405,7 @@ Domain allowed access. - + Get the attributes of a filesystem mounted on /boot. @@ -61395,7 +61416,7 @@ Domain allowed access. - + Remount a filesystem mounted on /boot. @@ -61405,7 +61426,7 @@ Domain allowed access. - + Get attributes of the /boot directory. @@ -61415,7 +61436,7 @@ Domain allowed access. - + Do not audit attempts to get attributes of the /boot directory. @@ -61426,7 +61447,7 @@ Domain to not audit. - + Search the /boot directory. @@ -61436,7 +61457,7 @@ Domain allowed access. - + Do not audit attempts to search the /boot directory. @@ -61446,7 +61467,7 @@ Domain to not audit. - + List the /boot directory. @@ -61456,7 +61477,7 @@ Domain allowed access. - + Do not audit attempts to list the /boot directory. @@ -61466,7 +61487,7 @@ Domain allowed access. - + Create directories in /boot @@ -61476,7 +61497,7 @@ Domain allowed access. - + Create, read, write, and delete directories in /boot. @@ -61487,7 +61508,7 @@ Domain allowed access. - + Create a private type object in boot with an automatic type transition @@ -61513,7 +61534,7 @@ The name of the object being created. - + read files in the /boot directory. @@ -61524,7 +61545,7 @@ Domain allowed access. - + Create, read, write, and delete files in the /boot directory. @@ -61536,7 +61557,7 @@ Domain allowed access. - + Relabel from files in the /boot directory. @@ -61546,7 +61567,7 @@ Domain allowed access. - + Read symbolic links in the /boot directory. @@ -61556,7 +61577,7 @@ Domain allowed access. - + Read and write symbolic links in the /boot directory. @@ -61567,7 +61588,7 @@ Domain allowed access. - + Create, read, write, and delete symbolic links in the /boot directory. @@ -61578,7 +61599,7 @@ Domain allowed access. - + Read kernel files in the /boot directory. @@ -61588,7 +61609,7 @@ Domain allowed access. - + Install a kernel into the /boot directory. @@ -61599,7 +61620,7 @@ Domain allowed access. - + Delete a kernel from /boot. @@ -61610,7 +61631,7 @@ Domain allowed access. - + Getattr of directories with the default file type. @@ -61620,7 +61641,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of directories with the default file type. @@ -61631,7 +61652,7 @@ Domain to not audit. - + Search the contents of directories with the default file type. @@ -61641,7 +61662,7 @@ Domain allowed access. - + List contents of directories with the default file type. @@ -61651,7 +61672,7 @@ Domain allowed access. - + Do not audit attempts to list contents of directories with the default file type. @@ -61662,7 +61683,7 @@ Domain to not audit. - + Create, read, write, and delete directories with the default file type. @@ -61673,7 +61694,7 @@ Domain allowed access. - + Mount a filesystem on a directory with the default file type. @@ -61683,7 +61704,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of files with the default file type. @@ -61694,7 +61715,7 @@ Domain to not audit. - + Read files with the default file type. @@ -61704,7 +61725,7 @@ Domain allowed access. - + Do not audit attempts to read files with the default file type. @@ -61715,7 +61736,7 @@ Domain to not audit. - + Create, read, write, and delete files with the default file type. @@ -61726,7 +61747,7 @@ Domain allowed access. - + Read symbolic links with the default file type. @@ -61736,7 +61757,7 @@ Domain allowed access. - + Read sockets with the default file type. @@ -61746,7 +61767,7 @@ Domain allowed access. - + Read named pipes with the default file type. @@ -61756,7 +61777,7 @@ Domain allowed access. - + Search the contents of /etc directories. @@ -61766,7 +61787,7 @@ Domain allowed access. - + Set the attributes of the /etc directories. @@ -61776,7 +61797,7 @@ Domain allowed access. - + List the contents of /etc directories. @@ -61786,7 +61807,7 @@ Domain allowed access. - + Do not audit attempts to write to /etc dirs. @@ -61796,7 +61817,7 @@ Domain to not audit. - + Add and remove entries from /etc directories. @@ -61806,7 +61827,7 @@ Domain allowed access. - + Manage generic directories in /etc @@ -61817,7 +61838,7 @@ Domain allowed access - + Relabel directories to etc_t. @@ -61827,7 +61848,7 @@ Domain allowed access. - + Mount a filesystem on the etc directories. @@ -61838,7 +61859,7 @@ Domain allowed access. - + Remount etc filesystems. @@ -61848,7 +61869,7 @@ Domain allowed access. - + Watch /etc directories @@ -61858,7 +61879,7 @@ Domain allowed access. - + Read generic files in /etc. @@ -61902,7 +61923,7 @@ Domain allowed access. - + Map generic files in /etc. @@ -61924,7 +61945,7 @@ Domain allowed access. - + Do not audit attempts to write generic files in /etc. @@ -61934,7 +61955,7 @@ Domain allowed access. - + Read and write generic files in /etc. @@ -61945,7 +61966,7 @@ Domain allowed access. - + Create, read, write, and delete generic files in /etc. @@ -61957,7 +61978,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete generic files in /etc. @@ -61969,7 +61990,7 @@ Domain to not audit. - + Delete system configuration files in /etc. @@ -61979,7 +62000,7 @@ Domain allowed access. - + Execute generic files in /etc. @@ -61989,7 +62010,7 @@ Domain allowed access. - + Watch /etc files. @@ -61999,7 +62020,7 @@ Domain allowed access. - + Get etc_t service status. @@ -62009,7 +62030,7 @@ Domain allowed access. - + start etc_t service @@ -62019,7 +62040,7 @@ Domain allowed access. - + stop etc_t service @@ -62029,7 +62050,7 @@ Domain allowed access. - + Relabel from and to generic files in /etc. @@ -62039,7 +62060,7 @@ Domain allowed access. - + Read symbolic links in /etc. @@ -62049,7 +62070,7 @@ Domain allowed access. - + Watch /etc symlinks @@ -62059,7 +62080,7 @@ Domain allowed access. - + Create, read, write, and delete symbolic links in /etc. @@ -62069,7 +62090,7 @@ Domain allowed access. - + Create objects in /etc with a private type using a type_transition. @@ -62095,7 +62116,7 @@ The name of the object being created. - + Create a boot flag. @@ -62117,7 +62138,7 @@ The name of the object being created. - + Delete a boot flag. @@ -62134,7 +62155,7 @@ Domain allowed access. - + Get the attributes of the etc_runtime directories. @@ -62145,7 +62166,7 @@ Domain allowed access. - + Mount a filesystem on the etc_runtime directories. @@ -62156,7 +62177,7 @@ Domain allowed access. - + Relabel to etc_runtime_t dirs. @@ -62166,7 +62187,7 @@ Domain allowed access. - + Do not audit attempts to set the attributes of the etc_runtime files @@ -62176,7 +62197,7 @@ Domain to not audit. - + Read files in /etc that are dynamically created on boot, such as mtab. @@ -62206,7 +62227,7 @@ Domain allowed access. - + Do not audit attempts to read files in /etc that are dynamically @@ -62218,7 +62239,7 @@ Domain to not audit. - + Do not audit attempts to read files in /etc @@ -62229,7 +62250,7 @@ Domain to not audit. - + Do not audit attempts to write etc runtime files. @@ -62240,7 +62261,7 @@ Domain to not audit. - + Read and write files in /etc that are dynamically created on boot, such as mtab. @@ -62252,7 +62273,7 @@ Domain allowed access. - + Create, read, write, and delete files in /etc that are dynamically created on boot, @@ -62265,7 +62286,7 @@ Domain allowed access. - + Relabel to etc_runtime_t files. @@ -62275,7 +62296,7 @@ Domain allowed access. - + Create, etc runtime objects with an automatic type transition. @@ -62296,7 +62317,7 @@ The name of the object being created. - + Get the attributes of the home directories root (/home). @@ -62307,7 +62328,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of the home directories root @@ -62319,7 +62340,7 @@ Domain to not audit. - + Search home directories root (/home). @@ -62329,7 +62350,7 @@ Domain allowed access. - + Do not audit attempts to search home directories root (/home). @@ -62340,7 +62361,7 @@ Domain to not audit. - + Do not audit attempts to list home directories root (/home). @@ -62351,7 +62372,7 @@ Domain to not audit. - + Get listing of home directories. @@ -62361,7 +62382,7 @@ Domain allowed access. - + Relabel to user home root (/home). @@ -62371,7 +62392,7 @@ Domain allowed access. - + Relabel from user home root (/home). @@ -62381,7 +62402,7 @@ Domain allowed access. - + Watch the user home root (/home). @@ -62391,7 +62412,7 @@ Domain allowed access. - + Create objects in /home. @@ -62416,7 +62437,7 @@ The name of the object being created. - + Get the attributes of lost+found directories. @@ -62426,7 +62447,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of lost+found directories. @@ -62437,7 +62458,7 @@ Domain to not audit. - + List the contents of lost+found directories. @@ -62447,7 +62468,7 @@ Domain allowed access. - + Create, read, write, and delete objects in lost+found directories. @@ -62459,7 +62480,7 @@ Domain allowed access. - + Search the contents of /mnt. @@ -62469,7 +62490,7 @@ Domain allowed access. - + Do not audit attempts to search /mnt. @@ -62479,7 +62500,7 @@ Domain to not audit. - + List the contents of /mnt. @@ -62489,7 +62510,7 @@ Domain allowed access. - + Do not audit attempts to list the contents of /mnt. @@ -62499,7 +62520,7 @@ Domain allowed access. - + Mount a filesystem on /mnt. @@ -62509,7 +62530,7 @@ Domain allowed access. - + Create, read, write, and delete directories in /mnt. @@ -62520,7 +62541,7 @@ Domain allowed access. - + Create, read, write, and delete files in /mnt. @@ -62530,7 +62551,7 @@ Domain allowed access. - + read files in /mnt. @@ -62540,7 +62561,7 @@ Domain allowed access. - + Read symbolic links in /mnt. @@ -62550,7 +62571,7 @@ Domain allowed access. - + Create, read, write, and delete symbolic links in /mnt. @@ -62560,7 +62581,7 @@ Domain allowed access. - + Search the contents of the kernel module directories. @@ -62570,7 +62591,7 @@ Domain allowed access. - + List the contents of the kernel module directories. @@ -62580,7 +62601,7 @@ Domain allowed access. - + Get the attributes of kernel module files. @@ -62590,7 +62611,7 @@ Domain allowed access. - + Read kernel module files. @@ -62600,7 +62621,7 @@ Domain allowed access. - + Read and mmap kernel module files. @@ -62610,7 +62631,7 @@ Domain allowed access. - + Write kernel module files. @@ -62620,7 +62641,7 @@ Domain allowed access. - + Delete kernel module files. @@ -62630,7 +62651,7 @@ Domain allowed access. - + Create, read, write, and delete kernel module files. @@ -62642,7 +62663,7 @@ Domain allowed access. - + Relabel from and to kernel module files. @@ -62652,7 +62673,7 @@ Domain allowed access. - + Mount on kernel module directories. @@ -62662,7 +62683,7 @@ Domain allowed access. - + Create objects in the kernel module directories with a private type via an automatic type transition. @@ -62688,7 +62709,7 @@ The name of the object being created. - + Load kernel module files. @@ -62698,7 +62719,7 @@ Domain allowed access. - + Load kernel module files. @@ -62708,7 +62729,7 @@ Domain allowed access. - + List world-readable directories. @@ -62719,7 +62740,7 @@ Domain allowed access. - + Read world-readable files. @@ -62730,7 +62751,7 @@ Domain allowed access. - + Read world-readable symbolic links. @@ -62741,7 +62762,7 @@ Domain allowed access. - + Read world-readable named pipes. @@ -62751,7 +62772,7 @@ Domain allowed access. - + Read world-readable sockets. @@ -62761,7 +62782,7 @@ Domain allowed access. - + Allow the specified type to associate to a filesystem with the type of the @@ -62773,7 +62794,7 @@ Type of the file to associate. - + Get the attributes of the tmp directory (/tmp). @@ -62783,7 +62804,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of the tmp directory (/tmp). @@ -62794,7 +62815,7 @@ Domain allowed access. - + Search the tmp directory (/tmp). @@ -62804,7 +62825,7 @@ Domain allowed access. - + Do not audit attempts to search the tmp directory (/tmp). @@ -62814,7 +62835,7 @@ Domain to not audit. - + Read the tmp directory (/tmp). @@ -62824,7 +62845,7 @@ Domain allowed access. - + Do not audit listing of the tmp directory (/tmp). @@ -62834,7 +62855,7 @@ Domain not to audit. - + Remove entries from the tmp directory. @@ -62844,7 +62865,7 @@ Domain allowed access. - + Read files in the tmp directory (/tmp). @@ -62854,7 +62875,7 @@ Domain allowed access. - + Manage temporary directories in /tmp. @@ -62864,7 +62885,7 @@ Domain allowed access. - + Relabel temporary directories in /tmp. @@ -62874,7 +62895,7 @@ Domain allowed access. - + Manage temporary files and directories in /tmp. @@ -62884,7 +62905,7 @@ Domain allowed access. - + Read symbolic links in the tmp directory (/tmp). @@ -62894,7 +62915,7 @@ Domain allowed access. - + Read and write generic named sockets in the tmp directory (/tmp). @@ -62904,7 +62925,7 @@ Domain allowed access. - + Mount filesystems in the tmp directory (/tmp) @@ -62914,7 +62935,7 @@ Domain allowed access. - + Set the attributes of all tmp directories. @@ -62924,7 +62945,7 @@ Domain allowed access. - + List all tmp directories. @@ -62934,7 +62955,7 @@ Domain allowed access. - + Relabel to and from all temporary directory types. @@ -62946,7 +62967,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all tmp files. @@ -62957,7 +62978,7 @@ Domain not to audit. - + Allow attempts to get the attributes of all tmp files. @@ -62968,7 +62989,7 @@ Domain allowed access. - + Relabel to and from all temporary file types. @@ -62980,7 +63001,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all tmp sock_file. @@ -62991,7 +63012,7 @@ Domain not to audit. - + Read all tmp files. @@ -63001,7 +63022,7 @@ Domain allowed access. - + Create an object in the tmp directories, with a private type using a type transition. @@ -63027,7 +63048,7 @@ The name of the object being created. - + Delete the contents of /tmp. @@ -63037,7 +63058,7 @@ Domain allowed access. - + Get the attributes of all tmpfs files. @@ -63047,7 +63068,7 @@ Domain allowed access. - + Set the attributes of the /usr directory. @@ -63057,7 +63078,7 @@ Domain allowed access. - + Search the content of /usr. @@ -63067,7 +63088,7 @@ Domain allowed access. - + List the contents of generic directories in /usr. @@ -63078,7 +63099,7 @@ Domain allowed access. - + Do not audit write of /usr dirs @@ -63088,7 +63109,7 @@ Domain to not audit. - + Add and remove entries from /usr directories. @@ -63098,7 +63119,7 @@ Domain allowed access. - + Do not audit attempts to add and remove entries from /usr directories. @@ -63109,7 +63130,7 @@ Domain to not audit. - + Delete generic directories in /usr in the caller domain. @@ -63119,7 +63140,7 @@ Domain allowed access. - + Watch generic directories in /usr. @@ -63129,7 +63150,7 @@ Domain allowed access. - + Delete generic files in /usr in the caller domain. @@ -63139,7 +63160,7 @@ Domain allowed access. - + Get the attributes of files in /usr. @@ -63149,7 +63170,7 @@ Domain allowed access. - + Map generic files in /usr. @@ -63160,7 +63181,7 @@ Domain allowed access. - + Read generic files in /usr. @@ -63188,7 +63209,7 @@ Domain allowed access. - + Execute generic programs in /usr in the caller domain. @@ -63198,7 +63219,7 @@ Domain allowed access. - + dontaudit write of /usr files @@ -63208,7 +63229,7 @@ Domain to not audit. - + Create, read, write, and delete files in the /usr directory. @@ -63218,7 +63239,7 @@ Domain allowed access. - + Relabel a file to the type used in /usr. @@ -63228,7 +63249,7 @@ Domain allowed access. - + Relabel a file from the type used in /usr. @@ -63238,7 +63259,7 @@ Domain allowed access. - + Read symbolic links in /usr. @@ -63248,7 +63269,7 @@ Domain allowed access. - + Create objects in the /usr directory @@ -63273,7 +63294,7 @@ The name of the object being created. - + Search directories in /usr/src. @@ -63283,7 +63304,7 @@ Domain allowed access. - + Do not audit attempts to search /usr/src. @@ -63293,7 +63314,7 @@ Domain to not audit. - + Get the attributes of files in /usr/src. @@ -63303,7 +63324,7 @@ Domain allowed access. - + Read files in /usr/src. @@ -63313,7 +63334,7 @@ Domain allowed access. - + Execute programs in /usr/src in the caller domain. @@ -63323,7 +63344,7 @@ Domain allowed access. - + Install a system.map into the /boot directory. @@ -63333,7 +63354,7 @@ Domain allowed access. - + Read system.map in the /boot directory. @@ -63343,7 +63364,7 @@ Domain allowed access. - + Delete a system.map in the /boot directory. @@ -63353,7 +63374,7 @@ Domain allowed access. - + Search the contents of /var. @@ -63363,7 +63384,7 @@ Domain allowed access. - + Do not audit attempts to write to /var. @@ -63373,7 +63394,7 @@ Domain to not audit. - + Allow attempts to write to /var.dirs @@ -63383,7 +63404,7 @@ Domain allowed access. - + Do not audit attempts to search the contents of /var. @@ -63394,7 +63415,7 @@ Domain to not audit. - + List the contents of /var. @@ -63404,7 +63425,7 @@ Domain allowed access. - + Do not audit attempts to list the contents of /var. @@ -63415,7 +63436,7 @@ Domain to not audit. - + Create, read, write, and delete directories in the /var directory. @@ -63426,7 +63447,7 @@ Domain allowed access. - + relabelto/from var directories @@ -63436,7 +63457,7 @@ Domain allowed access. - + Read files in the /var directory. @@ -63446,7 +63467,7 @@ Domain allowed access. - + Append files in the /var directory. @@ -63456,7 +63477,7 @@ Domain allowed access. - + Read and write files in the /var directory. @@ -63466,7 +63487,7 @@ Domain allowed access. - + Do not audit attempts to read and write files in the /var directory. @@ -63477,7 +63498,7 @@ Domain to not audit. - + Create, read, write, and delete files in the /var directory. @@ -63487,7 +63508,7 @@ Domain allowed access. - + Read symbolic links in the /var directory. @@ -63497,7 +63518,7 @@ Domain allowed access. - + Create, read, write, and delete symbolic links in the /var directory. @@ -63508,7 +63529,7 @@ Domain allowed access. - + Create objects in the /var directory @@ -63533,7 +63554,7 @@ The name of the object being created. - + Get the attributes of the /var/lib directory. @@ -63543,7 +63564,7 @@ Domain allowed access. - + Search the /var/lib directory. @@ -63567,7 +63588,7 @@ Domain allowed access. - + Do not audit attempts to search the contents of /var/lib. @@ -63579,7 +63600,7 @@ Domain to not audit. - + List the contents of the /var/lib directory. @@ -63589,7 +63610,7 @@ Domain allowed access. - + Read-write /var/lib directories @@ -63599,7 +63620,7 @@ Domain allowed access. - + manage var_lib_t dirs @@ -63609,7 +63630,7 @@ Domain allowed access. - + relabel var_lib_t dirs @@ -63619,7 +63640,7 @@ Domain allowed access. - + Create objects in the /var/lib directory @@ -63644,7 +63665,7 @@ The name of the object being created. - + Read generic files in /var/lib. @@ -63654,7 +63675,7 @@ Domain allowed access. - + Read generic symbolic links in /var/lib @@ -63664,7 +63685,7 @@ Domain allowed access. - + Create, read, write, and delete the pseudorandom number generator seed. @@ -63675,7 +63696,7 @@ Domain allowed access. - + Allow domain to manage mount tables necessary for rpcd, nfsd, etc. @@ -63686,7 +63707,7 @@ Domain allowed access. - + Set the attributes of the generic lock directories. @@ -63696,7 +63717,7 @@ Domain allowed access. - + Search the locks directory (/var/lock). @@ -63706,7 +63727,7 @@ Domain allowed access. - + Do not audit attempts to search the locks directory (/var/lock). @@ -63717,7 +63738,7 @@ Domain to not audit. - + List generic lock directories. @@ -63727,7 +63748,7 @@ Domain allowed access. - + Test write access on lock directories. @@ -63737,7 +63758,7 @@ Domain allowed access. - + Add entries in the /var/lock directories. @@ -63747,7 +63768,7 @@ Domain allowed access. - + Add and remove entries in the /var/lock directories. @@ -63758,7 +63779,7 @@ Domain allowed access. - + Create lock directories @@ -63768,7 +63789,7 @@ Domain allowed access - + Relabel to and from all lock directory types. @@ -63779,7 +63800,7 @@ Domain allowed access. - + Get the attributes of generic lock files. @@ -63789,7 +63810,7 @@ Domain allowed access. - + Delete generic lock files. @@ -63799,7 +63820,7 @@ Domain allowed access. - + Create, read, write, and delete generic lock files. @@ -63810,7 +63831,7 @@ Domain allowed access. - + Delete all lock files. @@ -63821,7 +63842,7 @@ Domain allowed access. - + Read all lock files. @@ -63831,7 +63852,7 @@ Domain allowed access. - + manage all lock files. @@ -63841,7 +63862,7 @@ Domain allowed access. - + Relabel from/to all lock files. @@ -63851,7 +63872,7 @@ Domain allowed access. - + Create an object in the locks directory, with a private type using a type transition. @@ -63877,7 +63898,7 @@ The name of the object being created. - + Do not audit attempts to get the attributes of the /var/run directory. @@ -63888,7 +63909,7 @@ Domain to not audit. - + mounton a /var/run directory. @@ -63898,7 +63919,7 @@ Domain allowed access. - + Set the attributes of the /var/run directory. @@ -63908,7 +63929,7 @@ Domain allowed access. - + Search the contents of runtime process ID directories (/var/run). @@ -63919,7 +63940,7 @@ Domain allowed access. - + Do not audit attempts to search the /var/run directory. @@ -63930,7 +63951,7 @@ Domain to not audit. - + List the contents of the runtime process ID directories (/var/run). @@ -63941,7 +63962,7 @@ Domain allowed access. - + Check write access on /var/run directories. @@ -63951,7 +63972,7 @@ Domain allowed access. - + Create a /var/run directory. @@ -63961,7 +63982,7 @@ Domain allowed access. - + Watch /var/run directories. @@ -63971,7 +63992,7 @@ Domain allowed access. - + Read generic runtime files. @@ -63981,7 +64002,7 @@ Domain allowed access. - + Execute generic programs in /var/run in the caller domain. @@ -63991,7 +64012,7 @@ Domain allowed access. - + Read and write generic runtime files. @@ -64001,7 +64022,7 @@ Domain allowed access. - + Delete generic runtime symlinks. @@ -64011,7 +64032,7 @@ Domain allowed access. - + Write named generic runtime pipes. @@ -64021,7 +64042,7 @@ Domain allowed access. - + Delete all runtime dirs. @@ -64032,7 +64053,7 @@ Domain allowed access. - + Create, read, write, and delete all runtime directories. @@ -64042,7 +64063,7 @@ Domain allowed access. - + Relabel all runtime directories. @@ -64052,7 +64073,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all runtime data files. @@ -64063,7 +64084,7 @@ Domain to not audit. - + Read all runtime files. @@ -64074,7 +64095,7 @@ Domain allowed access. - + Do not audit attempts to ioctl all runtime files. @@ -64084,7 +64105,7 @@ Domain to not audit. - + Do not audit attempts to write to all runtime files. @@ -64094,7 +64115,7 @@ Domain to not audit. - + Delete all runtime files. @@ -64105,7 +64126,7 @@ Domain allowed access. - + Create, read, write and delete all var_run (pid) files @@ -64116,7 +64137,7 @@ Domain allowed access. - + Relabel all runtime files. @@ -64126,7 +64147,7 @@ Domain allowed access. - + Delete all runtime symlinks. @@ -64137,7 +64158,7 @@ Domain allowed access. - + Create, read, write and delete all var_run (pid) symbolic links. @@ -64148,7 +64169,7 @@ Domain allowed access. - + Relabel all runtime symbolic links. @@ -64158,7 +64179,7 @@ Domain allowed access. - + Create all runtime named pipes @@ -64168,7 +64189,7 @@ Domain allowed access. - + Delete all runtime named pipes @@ -64178,7 +64199,7 @@ Domain allowed access. - + Create all runtime sockets. @@ -64188,7 +64209,7 @@ Domain allowed access. - + Delete all runtime sockets. @@ -64198,7 +64219,7 @@ Domain allowed access. - + Relabel all runtime named sockets. @@ -64208,7 +64229,7 @@ Domain allowed access. - + Create an object in the /run directory, with a private type. @@ -64260,7 +64281,7 @@ The name of the object being created. - + Create a generic lock directory within the run directories. @@ -64275,7 +64296,7 @@ The name of the object being created. - + Create all spool sockets @@ -64285,7 +64306,7 @@ Domain allowed access. - + Delete all spool sockets @@ -64295,7 +64316,7 @@ Domain allowed access. - + Mount filesystems on all polyinstantiation member directories. @@ -64306,7 +64327,7 @@ Domain allowed access. - + Search the contents of generic spool directories (/var/spool). @@ -64317,7 +64338,7 @@ Domain allowed access. - + Do not audit attempts to search generic spool directories. @@ -64328,7 +64349,7 @@ Domain to not audit. - + List the contents of generic spool (/var/spool) directories. @@ -64339,7 +64360,7 @@ Domain allowed access. - + Create, read, write, and delete generic spool directories (/var/spool). @@ -64350,7 +64371,7 @@ Domain allowed access. - + Read generic spool files. @@ -64360,7 +64381,7 @@ Domain allowed access. - + Create, read, write, and delete generic spool files. @@ -64371,7 +64392,7 @@ Domain allowed access. - + Create objects in the spool directory with a private type with a type transition. @@ -64398,7 +64419,7 @@ The name of the object being created. - + Allow access to manage all polyinstantiated directories on the system. @@ -64409,7 +64430,7 @@ Domain allowed access. - + Unconfined access to files. @@ -64419,7 +64440,7 @@ Domain allowed access. - + Create, read, write, and delete symbolic links in /etc that are dynamically created on boot. @@ -64431,7 +64452,7 @@ Domain allowed access. - + Do not audit attempts to read etc_runtime resources @@ -64441,7 +64462,7 @@ Domain allowed access. - + List usr/src files @@ -64451,7 +64472,7 @@ Domain allowed access - + Read usr/src files @@ -64461,7 +64482,7 @@ Domain allowed access - + Manage /usr/src files @@ -64471,7 +64492,7 @@ Domain allowed access - + Create a resource in the generic lib location with an automatic type transition towards the kernel modules @@ -64493,7 +64514,7 @@ Optional name of the resource - + Read etc runtime resources @@ -64503,7 +64524,7 @@ Domain allowed access - + Allow relabel from and to non-security types @@ -64514,7 +64535,7 @@ Domain allowed access. - + Manage non-security-sensitive resource types @@ -64525,7 +64546,7 @@ Domain allowed access. - + Allow relabeling from and to any pidfile associated type @@ -65023,7 +65044,7 @@ Domain allowed access. - + list cgroup directories. @@ -65033,7 +65054,7 @@ Domain allowed access. - + Ioctl cgroup directories. @@ -65043,7 +65064,17 @@ Domain allowed access. - + + +Create cgroup directories. + + + +Domain allowed access. + + + + Delete cgroup directories. @@ -65053,7 +65084,7 @@ Domain allowed access. - + Manage cgroup directories. @@ -65063,7 +65094,7 @@ Domain allowed access. - + Relabel cgroup directories. @@ -65073,7 +65104,7 @@ Domain allowed access. - + Get attributes of cgroup files. @@ -65083,7 +65114,7 @@ Domain allowed access. - + Read cgroup files. @@ -65093,7 +65124,17 @@ Domain allowed access. - + + +Create cgroup files. + + + +Domain allowed access. + + + + Watch cgroup files. @@ -65103,7 +65144,7 @@ Domain allowed access. - + Create cgroup lnk_files. @@ -65113,7 +65154,7 @@ Domain allowed access. - + Write cgroup files. @@ -65123,7 +65164,7 @@ Domain allowed access. - + Read and write cgroup files. @@ -65133,7 +65174,7 @@ Domain allowed access. - + Do not audit attempts to open, get attributes, read and write @@ -65145,7 +65186,7 @@ Domain to not audit. - + Manage cgroup files. @@ -65155,7 +65196,7 @@ Domain allowed access. - + Relabel cgroup symbolic links. @@ -65165,7 +65206,7 @@ Domain allowed access. - + Watch cgroup directories. @@ -65175,7 +65216,7 @@ Domain allowed access. - + Mount on cgroup directories. @@ -65185,7 +65226,7 @@ Domain allowed access. - + Create an object in a cgroup tmpfs filesystem, with a private type using a type transition. @@ -65211,7 +65252,7 @@ The name of the object being created. - + Do not audit attempts to read dirs on a CIFS or SMB filesystem. @@ -65222,7 +65263,7 @@ Domain to not audit. - + Mount a CIFS or SMB network filesystem. @@ -65232,7 +65273,7 @@ Domain allowed access. - + Remount a CIFS or SMB network filesystem. This allows some mount options to be changed. @@ -65243,7 +65284,7 @@ Domain allowed access. - + Unmount a CIFS or SMB network filesystem. @@ -65253,7 +65294,7 @@ Domain allowed access. - + Get the attributes of a CIFS or SMB network filesystem. @@ -65265,7 +65306,7 @@ Domain allowed access. - + Search directories on a CIFS or SMB filesystem. @@ -65275,7 +65316,7 @@ Domain allowed access. - + List the contents of directories on a CIFS or SMB filesystem. @@ -65286,7 +65327,7 @@ Domain allowed access. - + Do not audit attempts to list the contents of directories on a CIFS or SMB filesystem. @@ -65297,7 +65338,7 @@ Domain to not audit. - + Mounton a CIFS filesystem. @@ -65307,7 +65348,7 @@ Domain allowed access. - + Read files on a CIFS or SMB filesystem. @@ -65318,7 +65359,7 @@ Domain allowed access. - + Read all inherited filesystem image files. @@ -65329,7 +65370,7 @@ Domain allowed access. - + Read all filesystem image files. @@ -65340,7 +65381,7 @@ Domain allowed access. - + Mmap-read all filesystem image files. @@ -65351,7 +65392,7 @@ Domain allowed access. - + Read and write all filesystem image files. @@ -65362,7 +65403,7 @@ Domain allowed access. - + Mmap-Read-write all filesystem image files. @@ -65373,7 +65414,7 @@ Domain allowed access. - + Do not audit attempts to write all filesystem image files. @@ -65384,7 +65425,7 @@ Domain allowed access. - + Get the attributes of filesystems that do not have extended attribute support. @@ -65396,7 +65437,7 @@ Domain allowed access. - + Read all noxattrfs directories. @@ -65406,7 +65447,7 @@ Domain allowed access. - + Do not audit attempts to list all noxattrfs directories. @@ -65417,7 +65458,7 @@ Domain to not audit. - + Create, read, write, and delete all noxattrfs directories. @@ -65427,7 +65468,7 @@ Domain allowed access. - + Read all noxattrfs files. @@ -65437,7 +65478,7 @@ Domain allowed access. - + Do not audit attempts to read all noxattrfs files. @@ -65448,7 +65489,7 @@ Domain to not audit. - + Dont audit attempts to write to noxattrfs files. @@ -65458,7 +65499,7 @@ Domain to not audit. - + Create, read, write, and delete all noxattrfs files. @@ -65468,7 +65509,7 @@ Domain allowed access. - + Read all noxattrfs symbolic links. @@ -65478,7 +65519,7 @@ Domain allowed access. - + Manage all noxattrfs symbolic links. @@ -65488,7 +65529,7 @@ Domain allowed access. - + Relabel all objects from filesystems that do not support extended attributes. @@ -65499,7 +65540,7 @@ Domain allowed access. - + Do not audit attempts to read files on a CIFS or SMB filesystem. @@ -65510,7 +65551,7 @@ Domain to not audit. - + Append files on a CIFS filesystem. @@ -65522,7 +65563,7 @@ Domain allowed access. - + dontaudit Append files on a CIFS filesystem. @@ -65534,7 +65575,7 @@ Domain to not audit. - + Do not audit attempts to read or write files on a CIFS or SMB filesystem. @@ -65545,7 +65586,7 @@ Domain to not audit. - + Read symbolic links on a CIFS or SMB filesystem. @@ -65555,7 +65596,7 @@ Domain allowed access. - + Read named pipes on a CIFS or SMB network filesystem. @@ -65566,7 +65607,7 @@ Domain allowed access. - + Read named sockets on a CIFS or SMB network filesystem. @@ -65577,7 +65618,7 @@ Domain allowed access. - + Execute files on a CIFS or SMB network filesystem, in the caller @@ -65590,7 +65631,7 @@ Domain allowed access. - + Create, read, write, and delete directories on a CIFS or SMB network filesystem. @@ -65602,7 +65643,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete directories @@ -65614,7 +65655,7 @@ Domain to not audit. - + Create, read, write, and delete files on a CIFS or SMB network filesystem. @@ -65626,7 +65667,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete files @@ -65638,7 +65679,7 @@ Domain to not audit. - + Create, read, write, and delete symbolic links on a CIFS or SMB network filesystem. @@ -65649,7 +65690,7 @@ Domain allowed access. - + Create, read, write, and delete named pipes on a CIFS or SMB network filesystem. @@ -65660,7 +65701,7 @@ Domain allowed access. - + Create, read, write, and delete named sockets on a CIFS or SMB network filesystem. @@ -65671,7 +65712,7 @@ Domain allowed access. - + Execute a file on a CIFS or SMB filesystem in the specified domain. @@ -65706,7 +65747,7 @@ The type of the new process. - + Create, read, write, and delete dirs on a configfs filesystem. @@ -65717,7 +65758,7 @@ Domain allowed access. - + Create, read, write, and delete files on a configfs filesystem. @@ -65728,7 +65769,7 @@ Domain allowed access. - + Mount a DOS filesystem, such as FAT32 or NTFS. @@ -65739,7 +65780,7 @@ Domain allowed access. - + Remount a DOS filesystem, such as FAT32 or NTFS. This allows @@ -65751,7 +65792,7 @@ Domain allowed access. - + Unmount a DOS filesystem, such as FAT32 or NTFS. @@ -65762,7 +65803,7 @@ Domain allowed access. - + Get the attributes of a DOS filesystem, such as FAT32 or NTFS. @@ -65774,7 +65815,7 @@ Domain allowed access. - + Allow changing of the label of a DOS filesystem using the context= mount option. @@ -65785,7 +65826,7 @@ Domain allowed access. - + Get attributes of directories on a dosfs filesystem. @@ -65795,7 +65836,7 @@ Domain allowed access. - + Search dosfs filesystem. @@ -65805,7 +65846,7 @@ Domain allowed access. - + List dirs DOS filesystem. @@ -65815,7 +65856,7 @@ Domain allowed access. - + Create, read, write, and delete dirs on a DOS filesystem. @@ -65826,7 +65867,7 @@ Domain allowed access. - + Read files on a DOS filesystem. @@ -65836,7 +65877,7 @@ Domain allowed access. - + Read and map files on a DOS filesystem. @@ -65846,7 +65887,7 @@ Domain allowed access. - + Create, read, write, and delete files on a DOS filesystem. @@ -65857,7 +65898,7 @@ Domain allowed access. - + Read symbolic links on an eCryptfs filesystem. @@ -65867,7 +65908,7 @@ Domain allowed access. - + Create, read, write, and delete directories on an eCryptfs filesystem. @@ -65879,7 +65920,7 @@ Domain allowed access. - + Create, read, write, and delete files on an eCryptfs filesystem. @@ -65891,7 +65932,7 @@ Domain allowed access. - + Create, read, write, and delete named sockets on an eCryptfs filesystem. @@ -65902,7 +65943,7 @@ Domain allowed access. - + Get the attributes of efivarfs filesystems. @@ -65912,7 +65953,7 @@ Domain allowed access. - + List dirs in efivarfs filesystem. @@ -65922,7 +65963,7 @@ Domain allowed access. - + Read files in efivarfs - contains Linux Kernel configuration options for UEFI systems @@ -65934,7 +65975,19 @@ Domain allowed access. - + + +Set the attributes of files in efivarfs +- contains Linux Kernel configuration options for UEFI systems + + + +Domain allowed access. + + + + + Create, read, write, and delete files on a efivarfs filesystem. @@ -65946,7 +65999,7 @@ Domain allowed access. - + stat a FUSE filesystem @@ -65956,7 +66009,7 @@ Domain allowed access. - + Mount a FUSE filesystem. @@ -65966,7 +66019,7 @@ Domain allowed access. - + Unmount a FUSE filesystem. @@ -65976,7 +66029,7 @@ Domain allowed access. - + Remount a FUSE filesystem. @@ -65986,7 +66039,7 @@ Domain allowed access. - + Mounton a FUSEFS filesystem. @@ -65996,7 +66049,7 @@ Domain allowed access. - + Make FUSEFS files an entrypoint for the specified domain. @@ -66007,7 +66060,7 @@ The domain for which fusefs_t is an entrypoint. - + Execute FUSEFS files in a specified domain. @@ -66032,7 +66085,7 @@ Domain to transition to. - + Search directories on a FUSEFS filesystem. @@ -66044,7 +66097,7 @@ Domain allowed access. - + List the contents of directories on a FUSEFS filesystem. @@ -66056,7 +66109,7 @@ Domain allowed access. - + Do not audit attempts to list the contents of directories on a FUSEFS filesystem. @@ -66067,7 +66120,7 @@ Domain to not audit. - + Set the attributes of directories on a FUSEFS filesystem. @@ -66079,7 +66132,7 @@ Domain allowed access. - + Create, read, write, and delete directories on a FUSEFS filesystem. @@ -66091,7 +66144,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete directories @@ -66103,7 +66156,7 @@ Domain to not audit. - + Get the attributes of files on a FUSEFS filesystem. @@ -66115,7 +66168,7 @@ Domain allowed access. - + Read, a FUSEFS filesystem. @@ -66126,7 +66179,7 @@ Domain allowed access. - + Execute files on a FUSEFS filesystem. @@ -66137,7 +66190,7 @@ Domain allowed access. - + Set the attributes of files on a FUSEFS filesystem. @@ -66149,7 +66202,7 @@ Domain allowed access. - + Create, read, write, and delete files on a FUSEFS filesystem. @@ -66161,7 +66214,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete files @@ -66173,7 +66226,7 @@ Domain to not audit. - + Get the attributes of symlinks on a FUSEFS filesystem. @@ -66185,7 +66238,7 @@ Domain allowed access. - + Read symbolic links on a FUSEFS filesystem. @@ -66195,7 +66248,7 @@ Domain allowed access. - + Set the attributes of symlinks on a FUSEFS filesystem. @@ -66207,7 +66260,7 @@ Domain allowed access. - + Manage symlinks on a FUSEFS filesystem. @@ -66218,7 +66271,7 @@ Domain allowed access. - + Get the attributes of named pipes on a FUSEFS filesystem. @@ -66230,7 +66283,7 @@ Domain allowed access. - + Set the attributes of named pipes on a FUSEFS filesystem. @@ -66242,7 +66295,7 @@ Domain allowed access. - + Manage named pipes on a FUSEFS filesystem. @@ -66254,7 +66307,7 @@ Domain allowed access. - + Get the attributes of named sockets on a FUSEFS filesystem. @@ -66266,7 +66319,7 @@ Domain allowed access. - + Set the attributes of named sockets on a FUSEFS filesystem. @@ -66278,7 +66331,7 @@ Domain allowed access. - + Manage named sockets on a FUSEFS filesystem. @@ -66290,7 +66343,7 @@ Domain allowed access. - + Get the attributes of character files on a FUSEFS filesystem. @@ -66302,7 +66355,7 @@ Domain allowed access. - + Set the attributes of character files on a FUSEFS filesystem. @@ -66314,7 +66367,7 @@ Domain allowed access. - + Manage character files on a FUSEFS filesystem. @@ -66326,7 +66379,7 @@ Domain allowed access. - + Get the attributes of an hugetlbfs filesystem. @@ -66337,7 +66390,7 @@ Domain allowed access. - + List hugetlbfs. @@ -66347,7 +66400,7 @@ Domain allowed access. - + Manage hugetlbfs dirs. @@ -66357,7 +66410,7 @@ Domain allowed access. - + Read and write inherited hugetlbfs files. @@ -66367,7 +66420,7 @@ Domain allowed access. - + Read and write hugetlbfs files. @@ -66377,7 +66430,7 @@ Domain allowed access. - + Read, map and write hugetlbfs files. @@ -66387,7 +66440,7 @@ Domain allowed access. - + Allow the type to associate to hugetlbfs filesystems. @@ -66397,7 +66450,7 @@ The type of the object to be associated. - + Search inotifyfs filesystem. @@ -66407,7 +66460,7 @@ Domain allowed access. - + List inotifyfs filesystem. @@ -66417,7 +66470,7 @@ Domain allowed access. - + Dontaudit List inotifyfs filesystem. @@ -66427,7 +66480,7 @@ Domain to not audit. - + Create an object in a hugetlbfs filesystem, with a private type using a type transition. @@ -66453,7 +66506,7 @@ The name of the object being created. - + Mount an iso9660 filesystem, which is usually used on CDs. @@ -66464,7 +66517,7 @@ Domain allowed access. - + Remount an iso9660 filesystem, which is usually used on CDs. This allows @@ -66476,7 +66529,7 @@ Domain allowed access. - + Allow changing of the label of a filesystem with iso9660 type @@ -66487,7 +66540,7 @@ Domain allowed access. - + Unmount an iso9660 filesystem, which is usually used on CDs. @@ -66498,7 +66551,7 @@ Domain allowed access. - + Get the attributes of an iso9660 filesystem, which is usually used on CDs. @@ -66510,7 +66563,7 @@ Domain allowed access. - + Get the attributes of files on an iso9660 filesystem, which is usually used on CDs. @@ -66521,7 +66574,7 @@ Domain allowed access. - + Read files on an iso9660 filesystem, which is usually used on CDs. @@ -66532,7 +66585,7 @@ Domain allowed access. - + Mount a NFS filesystem. @@ -66542,7 +66595,7 @@ Domain allowed access. - + Remount a NFS filesystem. This allows some mount options to be changed. @@ -66553,7 +66606,7 @@ Domain allowed access. - + Unmount a NFS filesystem. @@ -66563,7 +66616,7 @@ Domain allowed access. - + Get the attributes of a NFS filesystem. @@ -66574,7 +66627,7 @@ Domain allowed access. - + Search directories on a NFS filesystem. @@ -66584,7 +66637,7 @@ Domain allowed access. - + List NFS filesystem. @@ -66594,7 +66647,7 @@ Domain allowed access. - + Do not audit attempts to list the contents of directories on a NFS filesystem. @@ -66605,7 +66658,7 @@ Domain to not audit. - + Add a watch on directories on an NFS filesystem. @@ -66616,7 +66669,7 @@ Domain allowed access. - + Mounton a NFS filesystem. @@ -66626,7 +66679,7 @@ Domain allowed access. - + Read files on a NFS filesystem. @@ -66637,7 +66690,7 @@ Domain allowed access. - + Do not audit attempts to read files on a NFS filesystem. @@ -66648,7 +66701,7 @@ Domain to not audit. - + Read files on a NFS filesystem. @@ -66658,7 +66711,7 @@ Domain allowed access. - + Execute files on a NFS filesystem. @@ -66669,7 +66722,7 @@ Domain allowed access. - + Append files on a NFS filesystem. @@ -66681,7 +66734,7 @@ Domain allowed access. - + dontaudit Append files on a NFS filesystem. @@ -66693,7 +66746,7 @@ Domain to not audit. - + Do not audit attempts to read or write files on a NFS filesystem. @@ -66704,7 +66757,7 @@ Domain to not audit. - + Add a watch on files on an NFS filesystem. @@ -66714,7 +66767,7 @@ Domain allowed access. - + Read symbolic links on a NFS filesystem. @@ -66724,7 +66777,7 @@ Domain allowed access. - + Dontaudit read symbolic links on a NFS filesystem. @@ -66734,7 +66787,7 @@ Domain to not audit. - + Read named sockets on a NFS filesystem. @@ -66744,7 +66797,7 @@ Domain allowed access. - + Read named pipes on a NFS network filesystem. @@ -66755,7 +66808,7 @@ Domain allowed access. - + Get the attributes of directories of RPC file system pipes. @@ -66766,7 +66819,7 @@ Domain allowed access. - + Search directories of RPC file system pipes. @@ -66776,7 +66829,7 @@ Domain allowed access. - + Search removable storage directories. @@ -66786,7 +66839,7 @@ Domain allowed access. - + Do not audit attempts to list removable storage directories. @@ -66796,7 +66849,7 @@ Domain not to audit. - + Read removable storage files. @@ -66806,7 +66859,7 @@ Domain allowed access. - + Do not audit attempts to read removable storage files. @@ -66816,7 +66869,7 @@ Domain not to audit. - + Do not audit attempts to write removable storage files. @@ -66826,7 +66879,7 @@ Domain not to audit. - + Read removable storage symbolic links. @@ -66836,7 +66889,7 @@ Domain allowed access. - + Read block nodes on removable filesystems. @@ -66846,7 +66899,7 @@ Domain allowed access. - + Read and write block nodes on removable filesystems. @@ -66856,7 +66909,7 @@ Domain allowed access. - + Read directories of RPC file system pipes. @@ -66866,7 +66919,7 @@ Domain allowed access. - + Read files of RPC file system pipes. @@ -66876,7 +66929,7 @@ Domain allowed access. - + Read symbolic links of RPC file system pipes. @@ -66886,7 +66939,7 @@ Domain allowed access. - + Read sockets of RPC file system pipes. @@ -66896,7 +66949,7 @@ Domain allowed access. - + Read and write sockets of RPC file system pipes. @@ -66906,7 +66959,7 @@ Domain allowed access. - + Create, read, write, and delete directories on a NFS filesystem. @@ -66918,7 +66971,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete directories @@ -66930,7 +66983,7 @@ Domain to not audit. - + Create, read, write, and delete files on a NFS filesystem. @@ -66942,7 +66995,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete files @@ -66954,7 +67007,7 @@ Domain to not audit. - + Create, read, write, and delete symbolic links on a NFS network filesystem. @@ -66966,7 +67019,7 @@ Domain allowed access. - + Create, read, write, and delete named pipes on a NFS filesystem. @@ -66977,7 +67030,7 @@ Domain allowed access. - + Create, read, write, and delete named sockets on a NFS filesystem. @@ -66988,7 +67041,7 @@ Domain allowed access. - + Execute a file on a NFS filesystem in the specified domain. @@ -67023,7 +67076,7 @@ The type of the new process. - + Mount a NFS server pseudo filesystem. @@ -67033,7 +67086,7 @@ Domain allowed access. - + Mount a NFS server pseudo filesystem. This allows some mount options to be changed. @@ -67044,7 +67097,7 @@ Domain allowed access. - + Unmount a NFS server pseudo filesystem. @@ -67054,7 +67107,7 @@ Domain allowed access. - + Get the attributes of a NFS server pseudo filesystem. @@ -67065,7 +67118,7 @@ Domain allowed access. - + Search NFS server directories. @@ -67075,7 +67128,7 @@ Domain allowed access. - + List NFS server directories. @@ -67085,7 +67138,7 @@ Domain allowed access. - + Watch NFS server directories. @@ -67095,7 +67148,7 @@ Domain allowed access. - + Getattr files on an nfsd filesystem @@ -67105,7 +67158,7 @@ Domain allowed access. - + Read and write NFS server files. @@ -67115,7 +67168,7 @@ Domain allowed access. - + Get the attributes of nsfs inodes (e.g. /proc/pid/ns/uts) @@ -67125,7 +67178,7 @@ Domain allowed access. - + Read nsfs inodes (e.g. /proc/pid/ns/uts) @@ -67135,7 +67188,7 @@ Domain allowed access. - + Watch NFS server files. @@ -67145,7 +67198,7 @@ Domain allowed access. - + Get the attributes of an nsfs filesystem. @@ -67155,7 +67208,7 @@ Domain allowed access. - + Unmount an nsfs filesystem. @@ -67165,7 +67218,7 @@ Domain allowed access. - + Get the attributes of a pstore filesystem. @@ -67175,7 +67228,7 @@ Domain allowed access. - + Get the attributes of directories of a pstore filesystem. @@ -67186,7 +67239,7 @@ Domain allowed access. - + Create pstore directories. @@ -67196,7 +67249,7 @@ Domain allowed access. - + Relabel to/from pstore_t directories. @@ -67206,7 +67259,7 @@ Domain allowed access. - + List the directories of a pstore filesystem. @@ -67217,7 +67270,7 @@ Domain allowed access. - + Read pstore_t files @@ -67227,7 +67280,7 @@ Domain allowed access. - + Delete the files of a pstore filesystem. @@ -67238,7 +67291,7 @@ Domain allowed access. - + Allow the type to associate to ramfs filesystems. @@ -67248,7 +67301,7 @@ The type of the object to be associated. - + Mount a RAM filesystem. @@ -67258,7 +67311,7 @@ Domain allowed access. - + Remount a RAM filesystem. This allows some mount options to be changed. @@ -67269,7 +67322,7 @@ Domain allowed access. - + Unmount a RAM filesystem. @@ -67279,7 +67332,7 @@ Domain allowed access. - + Get the attributes of a RAM filesystem. @@ -67289,7 +67342,7 @@ Domain allowed access. - + Search directories on a ramfs @@ -67299,7 +67352,7 @@ Domain allowed access. - + Dontaudit Search directories on a ramfs @@ -67309,7 +67362,7 @@ Domain to not audit. - + Set the attributes of directories on a ramfs. @@ -67320,7 +67373,7 @@ Domain allowed access. - + Create, read, write, and delete directories on a ramfs. @@ -67331,7 +67384,7 @@ Domain allowed access. - + Dontaudit read on a ramfs files. @@ -67341,7 +67394,7 @@ Domain to not audit. - + Dontaudit read on a ramfs fifo_files. @@ -67351,7 +67404,7 @@ Domain to not audit. - + Create, read, write, and delete files on a ramfs filesystem. @@ -67362,7 +67415,7 @@ Domain allowed access. - + Write to named pipe on a ramfs filesystem. @@ -67372,7 +67425,7 @@ Domain allowed access. - + Do not audit attempts to write to named pipes on a ramfs filesystem. @@ -67383,7 +67436,7 @@ Domain to not audit. - + Read and write a named pipe on a ramfs filesystem. @@ -67393,7 +67446,7 @@ Domain allowed access. - + Create, read, write, and delete named pipes on a ramfs filesystem. @@ -67404,7 +67457,7 @@ Domain allowed access. - + Write to named socket on a ramfs filesystem. @@ -67414,7 +67467,7 @@ Domain allowed access. - + Create, read, write, and delete named sockets on a ramfs filesystem. @@ -67425,7 +67478,7 @@ Domain allowed access. - + Mount a ROM filesystem. @@ -67435,7 +67488,7 @@ Domain allowed access. - + Remount a ROM filesystem. This allows some mount options to be changed. @@ -67446,7 +67499,7 @@ Domain allowed access. - + Unmount a ROM filesystem. @@ -67456,7 +67509,7 @@ Domain allowed access. - + Get the attributes of a ROM filesystem. @@ -67467,7 +67520,7 @@ Domain allowed access. - + Mount a RPC pipe filesystem. @@ -67477,7 +67530,7 @@ Domain allowed access. - + Remount a RPC pipe filesystem. This allows some mount option to be changed. @@ -67488,7 +67541,7 @@ Domain allowed access. - + Unmount a RPC pipe filesystem. @@ -67498,7 +67551,7 @@ Domain allowed access. - + Get the attributes of a RPC pipe filesystem. @@ -67509,7 +67562,7 @@ Domain allowed access. - + Read and write RPC pipe filesystem named pipes. @@ -67519,7 +67572,7 @@ Domain allowed access. - + Watch RPC pipe filesystem directories. @@ -67529,7 +67582,7 @@ Domain allowed access. - + Mount a tmpfs filesystem. @@ -67539,7 +67592,7 @@ Domain allowed access. - + Remount a tmpfs filesystem. @@ -67549,7 +67602,7 @@ Domain allowed access. - + Unmount a tmpfs filesystem. @@ -67559,7 +67612,7 @@ Domain allowed access. - + Do not audit getting the attributes of a tmpfs filesystem @@ -67569,7 +67622,7 @@ Domain to not audit - + Get the attributes of a tmpfs filesystem. @@ -67581,7 +67634,7 @@ Domain allowed access. - + Allow the type to associate to tmpfs filesystems. @@ -67591,7 +67644,7 @@ The type of the object to be associated. - + Relabel from tmpfs filesystem. @@ -67601,7 +67654,7 @@ Domain allowed access. - + Get the attributes of tmpfs directories. @@ -67611,7 +67664,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of tmpfs directories. @@ -67622,7 +67675,7 @@ Domain to not audit. - + Mount on tmpfs directories. @@ -67632,7 +67685,7 @@ Domain allowed access. - + Mount on tmpfs files. @@ -67642,7 +67695,7 @@ Domain allowed access. - + Set the attributes of tmpfs directories. @@ -67652,7 +67705,7 @@ Domain allowed access. - + Search tmpfs directories. @@ -67662,7 +67715,7 @@ Domain allowed access. - + List the contents of generic tmpfs directories. @@ -67672,7 +67725,7 @@ Domain allowed access. - + Do not audit attempts to list the contents of generic tmpfs directories. @@ -67683,7 +67736,7 @@ Domain to not audit. - + Create, read, write, and delete tmpfs directories @@ -67694,7 +67747,7 @@ Domain allowed access. - + Do not audit attempts to write tmpfs directories @@ -67705,7 +67758,7 @@ Domain to not audit. - + Relabel from tmpfs_t dir @@ -67715,7 +67768,7 @@ Domain allowed access. - + Relabel directory on tmpfs filesystems. @@ -67725,7 +67778,7 @@ Domain allowed access. - + Watch directories on tmpfs filesystems. @@ -67735,7 +67788,7 @@ Domain allowed access. - + Create an object in a tmpfs filesystem, with a private type using a type transition. @@ -67761,7 +67814,7 @@ The name of the object being created. - + Do not audit attempts to getattr generic tmpfs files. @@ -67772,7 +67825,7 @@ Domain to not audit. - + Do not audit attempts to read or write generic tmpfs files. @@ -67783,7 +67836,7 @@ Domain to not audit. - + Delete tmpfs symbolic links. @@ -67793,7 +67846,7 @@ Domain allowed access. - + Create, read, write, and delete auto moutpoints. @@ -67804,7 +67857,7 @@ Domain allowed access. - + Read generic tmpfs files. @@ -67814,7 +67867,7 @@ Domain allowed access. - + Read and write generic tmpfs files. @@ -67824,7 +67877,7 @@ Domain allowed access. - + Relabel files on tmpfs filesystems. @@ -67834,7 +67887,7 @@ Domain allowed access. - + Read tmpfs link files. @@ -67844,7 +67897,7 @@ Domain allowed access. - + Relabelfrom socket files on tmpfs filesystems. @@ -67854,7 +67907,7 @@ Domain allowed access. - + Relabelfrom tmpfs link files. @@ -67864,7 +67917,7 @@ Domain allowed access. - + Read and write character nodes on tmpfs filesystems. @@ -67874,7 +67927,7 @@ Domain allowed access. - + dontaudit Read and write character nodes on tmpfs filesystems. @@ -67884,7 +67937,7 @@ Domain to not audit. - + Relabel character nodes on tmpfs filesystems. @@ -67894,7 +67947,7 @@ Domain allowed access. - + Read and write block nodes on tmpfs filesystems. @@ -67904,7 +67957,7 @@ Domain allowed access. - + Relabel block nodes on tmpfs filesystems. @@ -67914,7 +67967,7 @@ Domain allowed access. - + Relabel named pipes on tmpfs filesystems. @@ -67924,7 +67977,7 @@ Domain allowed access. - + Read and write, create and delete generic files on tmpfs filesystems. @@ -67935,7 +67988,7 @@ Domain allowed access. - + Read and write, create and delete symbolic links on tmpfs filesystems. @@ -67946,7 +67999,7 @@ Domain allowed access. - + Read and write, create and delete socket files on tmpfs filesystems. @@ -67957,7 +68010,7 @@ Domain allowed access. - + Read and write, create and delete character nodes on tmpfs filesystems. @@ -67968,7 +68021,7 @@ Domain allowed access. - + Read and write, create and delete block nodes on tmpfs filesystems. @@ -67979,7 +68032,7 @@ Domain allowed access. - + Get the attributes of a trace filesystem. @@ -67989,7 +68042,7 @@ Domain allowed access. - + Get attributes of dirs on tracefs filesystem. @@ -67999,7 +68052,7 @@ Domain allowed access. - + search directories on a tracefs filesystem @@ -68009,7 +68062,7 @@ Domain allowed access. - + Get the attributes of files on a trace filesystem. @@ -68020,7 +68073,7 @@ Domain allowed access. - + Mount a XENFS filesystem. @@ -68030,7 +68083,7 @@ Domain allowed access. - + Search the XENFS filesystem. @@ -68040,7 +68093,7 @@ Domain allowed access. - + Create, read, write, and delete directories on a XENFS filesystem. @@ -68052,7 +68105,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete directories @@ -68064,7 +68117,7 @@ Domain to not audit. - + Create, read, write, and delete files on a XENFS filesystem. @@ -68076,7 +68129,7 @@ Domain allowed access. - + Map files a XENFS filesystem. @@ -68086,7 +68139,7 @@ Domain allowed access. - + Do not audit attempts to create, read, write, and delete files @@ -68098,7 +68151,7 @@ Domain to not audit. - + Mount all filesystems. @@ -68108,7 +68161,7 @@ Domain allowed access. - + Remount all filesystems. This allows some mount options to be changed. @@ -68119,7 +68172,7 @@ Domain allowed access. - + Unmount all filesystems. @@ -68129,7 +68182,7 @@ Domain allowed access. - + Get the attributes of all filesystems. @@ -68153,7 +68206,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes all filesystems. @@ -68164,7 +68217,7 @@ Domain to not audit. - + Get the quotas of all filesystems. @@ -68175,7 +68228,7 @@ Domain allowed access. - + Set the quotas of all filesystems. @@ -68186,7 +68239,7 @@ Domain allowed access. - + Relabelfrom all filesystems. @@ -68196,7 +68249,7 @@ Domain allowed access. - + Get the attributes of all directories with a filesystem type. @@ -68207,7 +68260,7 @@ Domain allowed access. - + Search all directories with a filesystem type. @@ -68217,7 +68270,7 @@ Domain allowed access. - + List all directories with a filesystem type. @@ -68227,7 +68280,7 @@ Domain allowed access. - + Get the attributes of all files with a filesystem type. @@ -68238,7 +68291,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all files with a filesystem type. @@ -68249,7 +68302,7 @@ Domain to not audit. - + Get the attributes of all symbolic links with a filesystem type. @@ -68260,7 +68313,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all symbolic links with a filesystem type. @@ -68271,7 +68324,7 @@ Domain to not audit. - + Get the attributes of all named pipes with a filesystem type. @@ -68282,7 +68335,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all named pipes with a filesystem type. @@ -68293,7 +68346,7 @@ Domain to not audit. - + Get the attributes of all named sockets with a filesystem type. @@ -68304,7 +68357,7 @@ Domain allowed access. - + Do not audit attempts to get the attributes of all named sockets with a filesystem type. @@ -68315,7 +68368,7 @@ Domain to not audit. - + Get the attributes of all block device nodes with a filesystem type. @@ -68326,7 +68379,7 @@ Domain allowed access. - + Get the attributes of all character device nodes with a filesystem type. @@ -68337,7 +68390,7 @@ Domain allowed access. - + Unconfined access to filesystems @@ -71360,7 +71413,18 @@ Domain to not audit. - + + +Get the attributes of the selinuxfs +directory. + + + +Domain to not audit. + + + + Do not audit attempts to get the attributes of the selinuxfs directory. @@ -71371,7 +71435,7 @@ Domain to not audit. - + Search selinuxfs. @@ -71381,7 +71445,7 @@ Domain allowed access. - + Do not audit attempts to search selinuxfs. @@ -71391,7 +71455,7 @@ Domain to not audit. - + Do not audit attempts to read generic selinuxfs entries @@ -71402,7 +71466,17 @@ Domain to not audit. - + + +Mount on the selinuxfs directory. + + + +Domain allowed access. + + + + Allows the caller to get the mode of policy enforcement (enforcing or permissive mode). @@ -71414,7 +71488,7 @@ Domain allowed access. - + Allow caller to set the mode of policy enforcement (enforcing or permissive mode). @@ -71436,7 +71510,7 @@ Domain allowed access. - + Allow caller to load the policy into the kernel. @@ -71446,7 +71520,7 @@ Domain allowed access. - + Allow caller to read the policy from the kernel. @@ -71456,7 +71530,7 @@ Domain allowed access. - + Allow caller to set the state of generic Booleans to enable or disable conditional portions of the policy. @@ -71478,7 +71552,7 @@ Domain allowed access. - + Allow caller to set the state of all Booleans to enable or disable conditional portions of the policy. @@ -71500,7 +71574,7 @@ Domain allowed access. - + Allow caller to get the state of all Booleans to view conditional portions of the policy. @@ -71512,7 +71586,7 @@ Domain allowed access. - + Allow caller to set SELinux access vector cache parameters. @@ -71534,7 +71608,7 @@ Domain allowed access. - + Allows caller to validate security contexts. @@ -71545,7 +71619,7 @@ Domain allowed access. - + Do not audit attempts to validate security contexts. @@ -71556,7 +71630,7 @@ Domain to not audit. - + Allows caller to compute an access vector. @@ -71567,7 +71641,7 @@ Domain allowed access. - + Calculate the default type for object creation. @@ -71578,7 +71652,7 @@ Domain allowed access. - + Allows caller to compute polyinstatntiated directory members. @@ -71589,7 +71663,7 @@ Domain allowed access. - + Calculate the context for relabeling objects. @@ -71608,7 +71682,7 @@ Domain allowed access. - + Allows caller to compute possible contexts for a user. @@ -71618,7 +71692,7 @@ Domain allowed access. - + Allows the caller to use the SELinux status page. @@ -71629,7 +71703,7 @@ Domain allowed access. - + Unconfined access to the SELinux kernel security server. @@ -77965,7 +78039,18 @@ Domain allowed access. - + + +Allow the specified domain to +search container config directories. + + + +Domain allowed access. + + + + Allow the specified domain to read container config files. @@ -77976,7 +78061,7 @@ Domain allowed access. - + Allow the specified domain to watch container config directories. @@ -77987,7 +78072,7 @@ Domain allowed access. - + Allow the specified domain to create container config files. @@ -77998,7 +78083,7 @@ Domain allowed access. - + Allow the specified domain to read and write container config files. @@ -78009,7 +78094,7 @@ Domain allowed access. - + Allow the specified domain to manage container config files. @@ -78020,7 +78105,7 @@ Domain allowed access. - + Allow the specified domain to create container files in the @@ -78033,7 +78118,7 @@ Domain allowed access. - + Allow the specified domain to manage container file directories. @@ -78044,7 +78129,7 @@ Domain allowed access. - + Allow the specified domain to watch container file directories. @@ -78055,7 +78140,7 @@ Domain allowed access. - + Allow the specified domain to manage container files. @@ -78066,7 +78151,7 @@ Domain allowed access. - + Do not audit attempts to relabel container file directories. @@ -78077,7 +78162,7 @@ Domain to not audit. - + Do not audit attempts to relabel container files. @@ -78088,7 +78173,7 @@ Domain to not audit. - + Allow the specified domain to manage container lnk files. @@ -78099,7 +78184,7 @@ Domain allowed access. - + Allow the specified domain to read and write container fifo files. @@ -78110,7 +78195,7 @@ Domain allowed access. - + Allow the specified domain to manage container fifo files. @@ -78121,7 +78206,7 @@ Domain allowed access. - + Allow the specified domain to manage container sock files. @@ -78132,7 +78217,7 @@ Domain allowed access. - + Allow the specified domain to read and write container chr files. @@ -78143,7 +78228,7 @@ Domain allowed access. - + Do not audit attempts to read and write container chr files. @@ -78154,7 +78239,7 @@ Domain allowed access. - + Allow the specified domain to manage container chr files. @@ -78165,7 +78250,7 @@ Domain allowed access. - + Allow the specified domain to create objects in specified directories with @@ -78193,7 +78278,7 @@ The name of the object being created. - + Allow the specified domain to list the contents of read-only container @@ -78205,7 +78290,7 @@ Domain allowed access. - + Allow the specified domain to manage container config home content. @@ -78216,7 +78301,7 @@ Domain allowed access. - + Allow the specified domain to create objects in an xdg_config directory @@ -78239,7 +78324,7 @@ The name of the object being created. - + Allow the specified domain to manage container data home files. @@ -78250,7 +78335,7 @@ Domain allowed access. - + Allow the specified domain to manage container data home named @@ -78262,7 +78347,7 @@ Domain allowed access. - + Allow the specified domain to manage container data home named @@ -78274,7 +78359,7 @@ Domain allowed access. - + Administrate all container files. @@ -78284,7 +78369,7 @@ Domain allowed access. - + Administrate all container read-only files. @@ -78294,7 +78379,7 @@ Domain allowed access. - + All of the rules necessary for a user to manage user container runtime data @@ -78306,7 +78391,7 @@ Domain allowed access. - + All of the rules necessary for a user to manage container data in their home @@ -78318,7 +78403,7 @@ Domain allowed access. - + Allow the specified domain to relabel container files and @@ -78330,7 +78415,7 @@ Domain allowed access. - + Allow the specified domain to remount container filesystems. @@ -78341,7 +78426,7 @@ Domain allowed access. - + Allow the specified domain to relabel container filesystems. @@ -78352,7 +78437,7 @@ Domain allowed access. - + Allow the specified domain to get the attributes of container @@ -78364,7 +78449,7 @@ Domain allowed access. - + Allow the specified domain to search runtime container directories. @@ -78375,7 +78460,7 @@ Domain allowed access. - + Allow the specified domain to read runtime container files. @@ -78386,7 +78471,7 @@ Domain allowed access. - + Allow the specified domain to get the attributes runtime container of @@ -78398,7 +78483,7 @@ Domain allowed access. - + Allow the specified domain to manage runtime container files. @@ -78409,7 +78494,7 @@ Domain allowed access. - + Allow the specified domain to manage runtime container named pipes. @@ -78420,7 +78505,7 @@ Domain allowed access. - + Allow the specified domain to manage runtime container symlinks. @@ -78431,7 +78516,7 @@ Domain allowed access. - + Allow the specified domain to manage runtime container named sockets. @@ -78442,7 +78527,7 @@ Domain allowed access. - + Allow the specified domain to manage user runtime container files. @@ -78453,7 +78538,7 @@ Domain allowed access. - + Allow the specified domain to read and write user runtime container named sockets. @@ -78464,7 +78549,7 @@ Domain allowed access. - + Allow the specified domain to search container directories in /var/lib. @@ -78475,7 +78560,7 @@ Domain allowed access. - + Allow the specified domain to list the contents of container directories @@ -78487,7 +78572,7 @@ Domain allowed access. - + Allow the specified domain to manage container file directories in /var/lib. @@ -78498,7 +78583,7 @@ Domain allowed access. - + Allow the specified domain to read container files in /var/lib. @@ -78509,7 +78594,7 @@ Domain allowed access. - + Allow the specified domain to manage container files in /var/lib. @@ -78520,7 +78605,7 @@ Domain allowed access. - + Allow the specified domain to memory map container files in /var/lib. @@ -78531,7 +78616,7 @@ Domain allowed access. - + Allow the specified domain to manage container named pipes in /var/lib. @@ -78542,7 +78627,7 @@ Domain allowed access. - + Allow the specified domain to manage container symlinks in /var/lib. @@ -78553,7 +78638,7 @@ Domain allowed access. - + Allow the specified domain to manage container named sockets in /var/lib. @@ -78564,7 +78649,7 @@ Domain allowed access. - + Allow the specified domain to create objects in /var/lib with an automatic @@ -78586,7 +78671,7 @@ The name of the object being created. - + Allow the specified domain to create objects in /var/lib with an automatic @@ -78608,7 +78693,7 @@ The name of the object being created. - + Allow the specified domain to create objects in container /var/lib directories @@ -78631,7 +78716,7 @@ The name of the object being created. - + Allow the specified domain to create objects in unlabeled directories with @@ -78654,7 +78739,7 @@ The name of the object being created. - + Allow the specified domain to search container log file directories. @@ -78665,7 +78750,7 @@ Domain allowed access. - + Allow the specified domain to list the contents of container log directories. @@ -78676,7 +78761,7 @@ Domain allowed access. - + Allow the specified domain to create container log file directories. @@ -78687,7 +78772,7 @@ Domain allowed access. - + Allow the specified domain to manage container log file directories. @@ -78698,7 +78783,7 @@ Domain allowed access. - + Allow the specified domain to watch container log file directories. @@ -78709,7 +78794,7 @@ Domain allowed access. - + Allow the specified domain to create container log files. @@ -78720,7 +78805,7 @@ Domain allowed access. - + Allow the specified domain to append data to container log files. @@ -78731,7 +78816,7 @@ Domain allowed access. - + Allow the specified domain to manage container log files. @@ -78742,7 +78827,7 @@ Domain allowed access. - + Allow the specified domain to watch container log files. @@ -78753,7 +78838,7 @@ Domain allowed access. - + Allow the specified domain to create objects in log directories with an @@ -78776,7 +78861,7 @@ The name of the object being created. - + Allow the specified domain to manage container log symlinks. @@ -78787,7 +78872,7 @@ Domain allowed access. - + Allow the specified domain to start systemd units for containers. @@ -78798,7 +78883,7 @@ Domain allowed access. - + All of the rules required to administrate a container @@ -86526,7 +86611,17 @@ Domain prefix to be used. - + + +Permit to read/write Munin TCP sockets + + + +Domain allowed access. + + + + Connect to munin over a unix domain stream socket. @@ -86537,7 +86632,7 @@ Domain allowed access. - + Read munin configuration content. @@ -86548,7 +86643,7 @@ Domain allowed access. - + Append munin log files. @@ -86559,7 +86654,7 @@ Domain allowed access. - + Search munin library directories. @@ -86569,7 +86664,7 @@ Domain allowed access. - + Do not audit attempts to search munin library directories. @@ -86580,7 +86675,7 @@ Domain to not audit. - + All of the rules required to administrate an munin environment. @@ -98074,7 +98169,19 @@ Domain allowed access. - + + +Create the zpool cache with an +automatic transition to the zpool +cache type. + + + +Domain allowed access. + + + + Read and write zpool cache files. @@ -98084,7 +98191,7 @@ Domain allowed access. - + All of the rules required to administrate a ZFS environment. @@ -105537,7 +105644,18 @@ Domain to not audit. - + + +Do not audit attempts to read/write to the +dhcp unix datagram socket descriptors. + + + +Domain to not audit. + + + + Do not audit attempts to read/write to the dhcp unix stream socket descriptors. @@ -105548,7 +105666,7 @@ Domain to not audit. - + Send a SIGCHLD signal to the dhcp client. @@ -105558,7 +105676,7 @@ Domain allowed access. - + Send a kill signal to the dhcp client. @@ -105569,7 +105687,7 @@ Domain allowed access. - + Send a SIGSTOP signal to the dhcp client. @@ -105579,7 +105697,7 @@ Domain allowed access. - + Send a null signal to the dhcp client. @@ -105589,7 +105707,7 @@ Domain allowed access. - + Send a generic signal to the dhcp client. @@ -105600,7 +105718,7 @@ Domain allowed access. - + Send and receive messages from dhcpc over dbus. @@ -105611,7 +105729,7 @@ Domain allowed access. - + Read and write dhcp configuration files. @@ -105621,7 +105739,7 @@ Domain allowed access. - + Search the DHCP client state directories. @@ -105632,7 +105750,7 @@ Domain allowed access. - + Read dhcp client state files. @@ -105642,7 +105760,7 @@ Domain allowed access. - + Delete the dhcp client state files. @@ -105652,7 +105770,7 @@ Domain allowed access. - + Set the attributes of network config files. @@ -105662,7 +105780,7 @@ Domain allowed access. - + Read network config files. @@ -105693,7 +105811,7 @@ Domain allowed access. - + Map network config files. @@ -105709,7 +105827,7 @@ Domain allowed access. - + map network config files. @@ -105725,7 +105843,7 @@ Domain allowed access. - + Do not audit attempts to read network config files. @@ -105735,7 +105853,7 @@ Domain to not audit. - + Write network config files. @@ -105745,7 +105863,7 @@ Domain allowed access. - + Create network config files. @@ -105755,7 +105873,7 @@ Domain allowed access. - + Relabel network config files. @@ -105765,7 +105883,7 @@ Domain allowed access. - + Create files in /etc with the type used for the network config files. @@ -105781,7 +105899,7 @@ The name of the object being created. - + Create, read, write, and delete network config files. @@ -105791,7 +105909,7 @@ Domain allowed access. - + Read dhcp client runtime files. @@ -105801,7 +105919,7 @@ Domain allowed access. - + Delete the dhcp client runtime files. @@ -105811,7 +105929,7 @@ Domain allowed access. - + Create, read, write, and delete dhcp client runtime files. @@ -105821,7 +105939,7 @@ Domain allowed access. - + Execute ifconfig in the ifconfig domain. @@ -105831,7 +105949,7 @@ Domain allowed to transition. - + Execute ifconfig in the ifconfig domain, and allow the specified role the ifconfig domain, @@ -105849,7 +105967,7 @@ Role allowed access. - + Execute ifconfig in the caller domain. @@ -105859,7 +105977,7 @@ Domain allowed access. - + Send a generic signal to ifconfig. @@ -105870,7 +105988,7 @@ Domain allowed access. - + Send null signals to ifconfig. @@ -105881,7 +105999,7 @@ Domain allowed access. - + Create the /run/netns directory with an automatic type transition. @@ -105892,7 +106010,7 @@ Domain allowed access. - + Create an object in the /run/netns directory with a private type. @@ -105918,7 +106036,7 @@ The name of the object being created. - + Read the DHCP configuration files. @@ -105928,7 +106046,7 @@ Domain allowed access. - + Search the DHCP state data directory. @@ -105938,7 +106056,7 @@ Domain allowed access. - + Create DHCP state data. @@ -105973,7 +106091,7 @@ The name of the object being created. - + Perform a DNS name resolution. @@ -105984,7 +106102,7 @@ Domain allowed access. - + Connect and use a LDAP server. @@ -105994,7 +106112,7 @@ Domain allowed access. - + Connect and use remote port mappers. @@ -106004,7 +106122,7 @@ Domain allowed access. - + Make the specified program domain accessable from the DHCP hooks/scripts. @@ -106728,7 +106846,17 @@ Domain allowed access. - + + +Manage symbolic links under /run/systemd/userdb. + + + +Domain allowed access. + + + + Manage socket files under /run/systemd/userdb . @@ -106738,7 +106866,7 @@ Domain allowed access. - + Connect to /run/systemd/userdb/io.systemd.DynamicUser . @@ -106748,7 +106876,7 @@ Domain allowed access. - + Allow reading /run/systemd/machines @@ -106758,7 +106886,7 @@ Domain that can access the machines files - + Allow watching /run/systemd/machines @@ -106768,7 +106896,7 @@ Domain allowed access. - + Allow connecting to /run/systemd/userdb/io.systemd.Machine socket @@ -106778,7 +106906,7 @@ Domain that can access the socket - + Send and receive messages from systemd machined over dbus. @@ -106789,7 +106917,7 @@ Domain allowed access. - + Send and receive messages from systemd hostnamed over dbus. @@ -106800,7 +106928,7 @@ Domain allowed access. - + allow systemd_passwd_agent to inherit fds @@ -106810,7 +106938,7 @@ Domain that owns the fds - + allow systemd_passwd_agent to be run by admin @@ -106825,7 +106953,7 @@ role that it runs in - + Allow a systemd_passwd_agent_t process to interact with a daemon that needs a password from the sysadmin. @@ -106836,7 +106964,7 @@ Domain allowed access. - + Transition to systemd_passwd_runtime_t when creating dirs @@ -106846,7 +106974,7 @@ Domain allowed access. - + Transition to systemd_userdbd_runtime_t when creating the userdb directory inside an init runtime @@ -106858,7 +106986,7 @@ Domain allowed access. - + Allow to domain to create systemd-passwd symlink @@ -106868,7 +106996,7 @@ Domain allowed access. - + Allow a domain to watch systemd-passwd runtime dirs. @@ -106878,7 +107006,7 @@ Domain allowed access. - + Allow domain to list the contents of systemd_journal_t dirs @@ -106888,7 +107016,7 @@ Domain allowed access. - + Allow domain to read systemd_journal_t files @@ -106898,7 +107026,7 @@ Domain allowed access. - + Allow domain to create/manage systemd_journal_t files @@ -106908,7 +107036,7 @@ Domain allowed access. - + Allow domain to add a watch on systemd_journal_t directories @@ -106918,7 +107046,17 @@ Domain allowed access. - + + +Relabel from systemd-journald file type. + + + +Domain allowed access. + + + + Relabel to systemd-journald directory type. @@ -106928,7 +107066,7 @@ Domain allowed access. - + Relabel to systemd-journald file type. @@ -106938,7 +107076,7 @@ Domain allowed access. - + Allow domain to read systemd_networkd_t unit files @@ -106948,7 +107086,7 @@ Domain allowed access. - + Allow domain to create/manage systemd_networkd_t unit files @@ -106958,7 +107096,7 @@ Domain allowed access. - + Allow specified domain to enable systemd-networkd units @@ -106968,7 +107106,7 @@ Domain allowed access. - + Allow specified domain to start systemd-networkd units @@ -106978,7 +107116,7 @@ Domain allowed access. - + Send and receive messages from systemd networkd over dbus. @@ -106989,7 +107127,7 @@ Domain allowed access. - + Allow specified domain to get status of systemd-networkd @@ -106999,7 +107137,7 @@ Domain allowed access. - + Relabel systemd_networkd tun socket. @@ -107009,7 +107147,7 @@ Domain allowed access. - + Read/Write from systemd_networkd netlink route socket. @@ -107019,7 +107157,7 @@ Domain allowed access. - + Allow domain to list dirs under /run/systemd/netif @@ -107029,7 +107167,7 @@ domain permitted the access - + Watch directories under /run/systemd/netif @@ -107039,7 +107177,7 @@ Domain permitted the access - + Allow domain to read files generated by systemd_networkd @@ -107049,7 +107187,7 @@ domain allowed access - + Allow systemd_logind_t to read process state for cgroup file @@ -107059,7 +107197,7 @@ Domain systemd_logind_t may access. - + Allow the specified domain to create the systemd-logind linger directory with @@ -107071,7 +107209,7 @@ Domain allowed access. - + Allow the specified domain to start systemd user manager units (systemd --user). @@ -107082,7 +107220,7 @@ Domain allowed access. - + Allow the specified domain to stop systemd user manager units (systemd --user). @@ -107093,7 +107231,7 @@ Domain allowed access. - + Allow the specified domain to reload systemd user manager units (systemd --user). @@ -107104,7 +107242,7 @@ Domain allowed access. - + Get the status of systemd user manager units (systemd --user). @@ -107115,7 +107253,7 @@ Domain allowed access. - + Allow specified domain to start power units @@ -107125,7 +107263,7 @@ Domain to not audit. - + Get the system status information about power units @@ -107135,7 +107273,7 @@ Domain allowed access. - + Allows connections to the systemd-socket-proxyd's socket. @@ -107145,7 +107283,7 @@ Domain allowed access. - + Make the specified type usable for systemd tmpfiles config files. @@ -107156,7 +107294,7 @@ Type to be used for systemd tmpfiles config files. - + Allow the specified domain to create the tmpfiles config directory with @@ -107168,7 +107306,7 @@ Domain allowed access. - + Create an object in the systemd tmpfiles config directory, with a private type @@ -107195,7 +107333,7 @@ The name of the object being created. - + Allow domain to list systemd tmpfiles config directory @@ -107205,7 +107343,7 @@ Domain allowed access. - + Allow domain to relabel to systemd tmpfiles config directory @@ -107215,7 +107353,7 @@ Domain allowed access. - + Allow domain to relabel to systemd tmpfiles config files @@ -107225,7 +107363,7 @@ Domain allowed access. - + Allow systemd_tmpfiles_t to manage filesystem objects @@ -107235,7 +107373,7 @@ Type of object to manage - + Connect to systemd resolved over /run/systemd/resolve/io.systemd.Resolve . @@ -107246,7 +107384,7 @@ Domain allowed access. - + Send and receive messages from systemd resolved over dbus. @@ -107257,7 +107395,7 @@ Domain allowed access. - + Allow domain to read resolv.conf file generated by systemd_resolved @@ -107267,7 +107405,7 @@ domain allowed access - + Execute the systemctl program. @@ -107277,7 +107415,7 @@ Domain allowed access. - + Allow domain to getattr on .updated file (generated by systemd-update-done @@ -107287,7 +107425,7 @@ domain allowed access - + Search keys for the all systemd --user domains. @@ -107297,7 +107435,7 @@ Domain allowed access. - + Create keys for the all systemd --user domains. @@ -107307,7 +107445,7 @@ Domain allowed access. - + Write keys for the all systemd --user domains. @@ -107317,7 +107455,7 @@ Domain allowed access. - + Execute systemd-sysusers in the systemd sysusers domain. @@ -107328,7 +107466,7 @@ Domain allowed access. - + Run systemd-sysusers with a domain transition. @@ -107344,7 +107482,7 @@ Role allowed access. - + receive and use a systemd_machined_devpts_t file handle