Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla")
Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t")
Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla")
Allow ftp servers to upload files, used for public file transfer services. Directories must be labeled public_content_rw_t.
Allow ftp servers to login to local users and read/write all files on the system, governed by DAC.
Allow ftp servers to use cifs used for public file transfer services.
Allow ftp servers to use nfs used for public file transfer services.
Allow gssd to read temp directory. For access to kerberos tgt.
Allow Apache to modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.
Allow Apache to use mod_auth_pam
Allow confined applications to run with kerberos.
Allow the mount command to mount any directory or file.
Allow nfs servers to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t.
Enable polyinstantiated directory support.
Allow sysadm to debug or ptrace all processes.
Allow rsync to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t.
Allow samba to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t.
Allow users to connect to mysql
Allow users to connect to PostgreSQL
Allows clients to write to the X server shared memory segments.
Allow system to run with NIS
Allow zebra daemon to write it configuration files
Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files
Allow system cron jobs to relabel filesystem for restoring file contexts.
Allow exim to create, read, write, and delete unprivileged user files.
Allow exim to read unprivileged user files.
Enable extra rules in the cron domain to support fcron.
Allow ftp to read and write files in the user home directories
Enable reading of urandom for all domains.
This should be enabled when all programs are compiled with ProPolice/SSP stack smashing protection. All domains will be allowed to read from /dev/urandom.
Allow httpd to use built in scripting (usually php)
Allow HTTPD scripts and modules to connect to the network using TCP.
Allow HTTPD scripts and modules to connect to databases over the network.
Allow httpd to act as a relay
Allow httpd to act as a FTP server by listening on the ftp port.
Allow httpd to read home directories
Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
Unify HTTPD to communicate with the terminal. Needed for entering the passphrase for certificates at the terminal.
Unify HTTPD handling of all content files.
Allow email client to various content. nfs, samba, removable devices, user temp and untrusted content files
Allow BIND to write the master zone files. Generally this is used for dynamic DNS or zone transfers.
Allow any files/directories to be exported read/only via NFS.
Allow any files/directories to be exported read/write via NFS.
Allow openvpn to read home directories
Allow pppd to load kernel modules for certain modems
Allow reading of default_t files.
Allow applications to read untrusted content If this is disallowed, Internet content has to be manually relabeled for read access to be granted
Allow rsync to export any files/directories read only.
Allow samba to act as the domain controller, add users, groups and change passwords.
Allow samba to share users home directories.
Allow samba to share any file/directory read only.
Allow samba to share any file/directory read/write.
Allow samba to run unconfined scripts
Allow user spamassassin clients to use the network.
Allow spamd to read/write user home directories.
Allow squid to connect to all ports, not just HTTP, FTP, and Gopher ports.
Allow tftp to modify public files used for public file transfer services.
Support NFS home directories
Support SAMBA home directories
Allow regular users direct mouse access
Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)
Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.
Allow applications to write untrusted content If this is disallowed, no Internet content will be stored.