Master tunable index:

Module: abrt

Layer: services

abrt_anon_write (Default: false)

Allow ABRT to modify public files used for public file transfer services.

Module: abrt

Layer: services

abrt_handle_event (Default: false)

Allow ABRT to run in abrt_handle_event_t domain to handle ABRT event scripts

Global
allow_console_login (Default: false)

Allow direct login to the console device. Required for System 390

Module: cvs

Layer: services

allow_cvs_read_shadow (Default: false)

Allow cvs daemon to read shadow

Module: init

Layer: system

allow_daemons_dump_core (Default: false)

Allow all daemons to write corefiles to /

Module: init

Layer: system

allow_daemons_use_tcp_wrapper (Default: false)

Allow all daemons to use tcp wrappers.

Module: init

Layer: system

allow_daemons_use_tty (Default: false)

Allow all daemons the ability to read/write terminals

Module: domain

Layer: kernel

allow_domain_fd_use (Default: true)

Allow all domains to use other domains file descriptors

Global
allow_execheap (Default: false)

Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla

Global
allow_execmem (Default: false)

Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla)

Global
allow_execmod (Default: false)

Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t)

Global
allow_execstack (Default: false)

Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla)

Module: ftp

Layer: services

allow_ftpd_anon_write (Default: false)

Allow ftp servers to upload files, used for public file transfer services. Directories must be labeled public_content_rw_t.

Module: ftp

Layer: services

allow_ftpd_full_access (Default: false)

Allow ftp servers to login to local users and read/write all files on the system, governed by DAC.

Module: ftp

Layer: services

allow_ftpd_use_cifs (Default: false)

Allow ftp servers to use cifs used for public file transfer services.

Module: ftp

Layer: services

allow_ftpd_use_nfs (Default: false)

Allow ftp servers to use nfs used for public file transfer services.

Module: rpc

Layer: services

allow_gssd_read_tmp (Default: true)

Allow gssd to read temp directory. For access to kerberos tgt.

Module: apache

Layer: services

allow_httpd_anon_write (Default: false)

Allow Apache to modify public files used for public file transfer services. Directories/Files must be labeled public_rw_content_t.

Module: apache

Layer: services

allow_httpd_mod_auth_ntlm_winbind (Default: false)

Allow Apache to use mod_auth_ntlm_winbind

Module: apache

Layer: services

allow_httpd_mod_auth_pam (Default: false)

Allow Apache to use mod_auth_pam

Module: apache

Layer: services

allow_httpd_sys_script_anon_write (Default: false)

Allow apache scripts to write to public content. Directories/Files must be labeled public_rw_content_t.

Module: java

Layer: apps

allow_java_execstack (Default: false)

Allow java executable stack

Module: kerberos

Layer: services

allow_kerberos (Default: false)

Allow confined applications to run with kerberos.

Module: mount

Layer: system

allow_mount_anyfile (Default: false)

Allow the mount command to mount any directory or file.

Module: mplayer

Layer: apps

allow_mplayer_execstack (Default: false)

Allow mplayer executable stack

Module: nsplugin

Layer: apps

allow_nsplugin_execmem (Default: false)

Allow nsplugin code to execmem/execstack

Global
allow_polyinstantiation (Default: false)

Enable polyinstantiated directory support.

Module: postfix

Layer: services

allow_postfix_local_write_mail_spool (Default: true)

Allow postfix_local domain full write access to mail_spool directories

Module: sysadm

Layer: roles

allow_ptrace (Default: false)

Allow sysadm to debug or ptrace all processes.

Module: rsync

Layer: services

allow_rsync_anon_write (Default: false)

Allow rsync to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t.

Module: sasl

Layer: services

allow_saslauthd_read_shadow (Default: false)

Allow sasl to read shadow

Module: samba

Layer: services

allow_smbd_anon_write (Default: false)

Allow samba to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t.

Module: ssh

Layer: services

allow_ssh_keysign (Default: false)

allow host key based authentication

Module: unconfineduser

Layer: roles

allow_unconfined_nsplugin_transition (Default: false)

Transition to confined nsplugin domains from unconfined user

Module: userdomain

Layer: system

allow_user_mysql_connect (Default: false)

Allow users to connect to mysql

Module: userdomain

Layer: system

allow_user_postgresql_connect (Default: false)

Allow users to connect to PostgreSQL

Module: xserver

Layer: services

allow_write_xshm (Default: false)

Allows clients to write to the X server shared memory segments.

Module: xserver

Layer: services

allow_xserver_execmem (Default: false)

Allows XServer to execute writable memory

Global
allow_ypbind (Default: false)

Allow system to run with NIS

Module: zebra

Layer: services

allow_zebra_write_config (Default: false)

Allow zebra daemon to write it configuration files

Module: amavis

Layer: services

amavis_use_jit (Default: false)

Allow amavis to use JIT compiler

Module: antivirus

Layer: services

antivirus_can_scan_system (Default: false)

Allow antivirus programs to read non security files on a system

Module: antivirus

Layer: services

antivirus_use_jit (Default: false)

Determine whether can antivirus programs use JIT compiler.

Module: authlogin

Layer: system

authlogin_radius (Default: false)

Allow users to login using a radius server

Module: authlogin

Layer: system

authlogin_shadow (Default: false)

Allow users login programs to access /etc/shadow.

Module: awstats

Layer: apps

awstats_purge_apache_log_files (Default: false)

Determine whether awstats can purge httpd log files.

Module: cdrecord

Layer: apps

cdrecord_read_content (Default: false)

Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files

Module: clamav

Layer: services

clamd_use_jit (Default: false)

Allow clamd to use JIT compiler

Module: clamav

Layer: services

clamscan_can_scan_system (Default: false)

Allow clamscan to non security files on a system

Module: rhcs

Layer: services

cluster_can_network_connect (Default: false)

Allow cluster administrative domains to connect to the network using TCP.

Module: rhcs

Layer: services

cluster_manage_all_files (Default: true)

Allow cluster administrative domains to manage all files on a system.

Module: rhcs

Layer: services

cluster_use_execmem (Default: false)

Allow cluster administrative cluster domains memcheck-amd64- to use executable memory

Module: cobbler

Layer: services

cobbler_anon_write (Default: false)

Allow Cobbler to modify public files used for public file transfer services.

Module: cobbler

Layer: services

cobbler_can_network_connect (Default: false)

Allow Cobbler to connect to the network using TCP.

Module: cobbler

Layer: services

cobbler_use_cifs (Default: false)

Allow Cobbler to access cifs file systems.

Module: cobbler

Layer: services

cobbler_use_nfs (Default: false)

Allow Cobbler to access nfs file systems.

Module: collectd

Layer: services

collectd_tcp_network_connect (Default: false)

Determine whether collectd can connect to the network using TCP.

Module: condor

Layer: services

condor_domain_can_network_connect (Default: false)

Allow codnor domain to connect to the network using TCP.

Module: cron

Layer: services

cron_can_relabel (Default: false)

Allow system cron jobs to relabel filesystem for restoring file contexts.

Module: init

Layer: system

daemons_enable_cluster_mode (Default: true)

Enable cluster mode for daemons.

Module: sysnetwork

Layer: system

dhcpc_exec_iptables (Default: false)

Allow dhcpc client applications to execute iptables commands

Module: domain

Layer: kernel

domain_kernel_load_modules (Default: false)

Allow all domains to have the kernel load modules

Module: exim

Layer: services

exim_can_connect_db (Default: false)

Allow exim to connect to databases (postgres, mysql)

Module: exim

Layer: services

exim_manage_user_files (Default: false)

Allow exim to create, read, write, and delete unprivileged user files.

Module: exim

Layer: services

exim_read_user_files (Default: false)

Allow exim to read unprivileged user files.

Module: cron

Layer: services

fcron_crond (Default: false)

Enable extra rules in the cron domain to support fcron.

Module: rhcs

Layer: services

fenced_can_network_connect (Default: false)

Allow fenced domain to connect to the network using TCP.

Module: rhcs

Layer: services

fenced_can_ssh (Default: false)

Allow fenced domain to execute ssh.

Module: domain

Layer: kernel

fips_mode (Default: true)

Allow all domains to execute in fips_mode

Module: ftp

Layer: services

ftp_home_dir (Default: false)

Allow ftp to read and write files in the user home directories

Module: ftp

Layer: services

ftpd_connect_db (Default: false)

Allow ftp servers to use connect to mysql database

Module: ftp

Layer: services

ftpd_use_fusefs (Default: false)

Allow ftpd to use ntfs/fusefs volumes.

Module: ftp

Layer: services

ftpd_use_passive_mode (Default: false)

Allow ftp servers to use bind to all unreserved ports for passive mode

Module: git

Layer: services

git_cgi_enable_homedirs (Default: false)

Determine whether Git CGI can search home directories.

Module: git

Layer: services

git_cgi_use_cifs (Default: false)

Determine whether Git CGI can access cifs file systems.

Module: git

Layer: services

git_cgi_use_nfs (Default: false)

Determine whether Git CGI can access nfs file systems.

Module: git

Layer: services

git_session_bind_all_unreserved_ports (Default: false)

Determine whether Git session daemon can bind TCP sockets to all unreserved ports.

Module: git

Layer: services

git_session_users (Default: false)

Determine whether calling user domains can execute Git daemon in the git_session_t domain.

Module: git

Layer: services

git_system_enable_homedirs (Default: false)

Determine whether Git system daemon can search home directories.

Module: git

Layer: services

git_system_use_cifs (Default: false)

Determine whether Git system daemon can access cifs file systems.

Module: git

Layer: services

git_system_use_nfs (Default: false)

Determine whether Git system daemon can access nfs file systems.

Global
global_ssp (Default: false)

Enable reading of urandom for all domains.

This should be enabled when all programs are compiled with ProPolice/SSP stack smashing protection. All domains will be allowed to read from /dev/urandom.

Module: glusterd

Layer: services

gluster_anon_write (Default: false)

Allow glusterfsd to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t.

Module: glusterd

Layer: services

gluster_export_all_ro (Default: false)

Allow glusterfsd to share any file/directory read only.

Module: glusterd

Layer: services

gluster_export_all_rw (Default: true)

Allow glusterfsd to share any file/directory read/write.

Module: gpg

Layer: apps

gpg_agent_env_file (Default: false)

Allow usage of the gpg-agent --write-env-file option. This also allows gpg-agent to manage user files.

Module: gpg

Layer: apps

gpg_web_anon_write (Default: false)

Allow gpg web domain to modify public files used for public file transfer services.

Module: apache

Layer: services

httpd_builtin_scripting (Default: false)

Allow httpd to use built in scripting (usually php)

Module: apache

Layer: services

httpd_can_check_spam (Default: false)

Allow http daemon to check spam

Module: apache

Layer: services

httpd_can_network_connect (Default: false)

Allow HTTPD scripts and modules to connect to the network using TCP.

Module: apache

Layer: services

httpd_can_network_connect_cobbler (Default: false)

Allow HTTPD scripts and modules to connect to cobbler over the network.

Module: apache

Layer: services

httpd_can_network_connect_db (Default: false)

Allow HTTPD scripts and modules to connect to databases over the network.

Module: apache

Layer: services

httpd_can_network_memcache (Default: false)

Allow httpd to connect to memcache server

Module: apache

Layer: services

httpd_can_network_relay (Default: false)

Allow httpd to act as a relay

Module: apache

Layer: services

httpd_can_sendmail (Default: false)

Allow http daemon to send mail

Module: apache

Layer: services

httpd_dbus_avahi (Default: false)

Allow Apache to communicate with avahi service via dbus

Module: apache

Layer: services

httpd_dbus_sssd (Default: false)

Allow Apache to communicate with sssd service via dbus

Module: apache

Layer: services

httpd_enable_cgi (Default: false)

Allow httpd cgi support

Module: apache

Layer: services

httpd_enable_ftp_server (Default: false)

Allow httpd to act as a FTP server by listening on the ftp port.

Module: apache

Layer: services

httpd_enable_homedirs (Default: false)

Allow httpd to read home directories

Module: apache

Layer: services

httpd_execmem (Default: false)

Allow httpd scripts and modules execmem/execstack

Module: apache

Layer: services

httpd_manage_ipa (Default: false)

Allow httpd processes to manage IPA content

Module: apache

Layer: services

httpd_read_user_content (Default: false)

Allow httpd to read user content

Module: apache

Layer: services

httpd_run_preupgrade (Default: false)

Allow Apache to run preupgrade

Module: apache

Layer: services

httpd_run_stickshift (Default: false)

Allow Apache to run in stickshift mode, not transition to passenger

Module: apache

Layer: services

httpd_serve_cobbler_files (Default: false)

Allow HTTPD scripts and modules to server cobbler files.

Module: apache

Layer: services

httpd_setrlimit (Default: false)

Allow httpd daemon to change system limits

Module: apache

Layer: services

httpd_ssi_exec (Default: false)

Allow HTTPD to run SSI executables in the same domain as system CGI scripts.

Module: apache

Layer: services

httpd_tmp_exec (Default: false)

Allow Apache to execute tmp content.

Module: apache

Layer: services

httpd_tty_comm (Default: false)

Unify HTTPD to communicate with the terminal. Needed for entering the passphrase for certificates at the terminal.

Module: apache

Layer: services

httpd_unified (Default: false)

Unify HTTPD handling of all content files.

Module: apache

Layer: services

httpd_use_cifs (Default: false)

Allow httpd to access cifs file systems

Module: apache

Layer: services

httpd_use_fusefs (Default: false)

Allow httpd to access FUSE file systems

Module: apache

Layer: services

httpd_use_gpg (Default: false)

Allow httpd to run gpg in gpg-web domain

Module: apache

Layer: services

httpd_use_nfs (Default: false)

Allow httpd to access nfs file systems

Module: apache

Layer: services

httpd_use_openstack (Default: false)

Allow httpd to access openstack ports

Module: apache

Layer: services

httpd_verify_dns (Default: false)

Allow Apache to query NS records

Module: icecast

Layer: services

icecast_connect_any (Default: false)

Determine whether icecast can listen on and connect to any TCP port.

Module: init

Layer: system

init_upstart (Default: false)

Enable support for upstart as the init program.

Module: irc

Layer: apps

irssi_use_full_network (Default: false)

Allow the Irssi IRC Client to connect to any port, and to bind to any unreserved port.

Module: kdumpgui

Layer: apps

kdumpgui_run_bootloader (Default: false)

Allow s-c-kdump to run bootloader in bootloader_t.

Module: logging

Layer: system

logging_syslog_can_read_tmp (Default: false)

Allow syslogd daemon to read user tmp content

Module: logging

Layer: system

logging_syslogd_can_sendmail (Default: false)

Allow syslogd daemon to send mail

Module: logging

Layer: system

logging_syslogd_use_tty (Default: true)

Allow syslogd the ability to read/write terminals

Module: logrotate

Layer: admin

logrotate_use_nfs (Default: false)

Allow logrotate to manage nfs files

Module: lsm

Layer: services

lsmd_plugin_connect_any (Default: false)

Determine whether lsmd_plugin can connect to all TCP ports.

Module: mcelog

Layer: admin

mcelog_foreground (Default: false)

Determine whether mcelog can use all the user ttys.

Global
mmap_low_allowed (Default: false)

Allow certain domains to map low memory in the kernel

Module: mozilla

Layer: apps

mozilla_read_content (Default: false)

Control mozilla content access

Module: mysql

Layer: services

mysql_connect_any (Default: false)

Allow mysqld to connect to all ports

Module: nagios

Layer: services

nagios_run_sudo (Default: false)

Allow nagios/nrpe to call sudo from NRPE utils scripts.

Module: bind

Layer: services

named_bind_http_port (Default: false)

Allow BIND to bind apache port.

Module: bind

Layer: services

named_write_master_zones (Default: false)

Allow BIND to write the master zone files. Generally this is used for dynamic DNS or zone transfers.

Module: ncftool

Layer: admin

ncftool_read_user_content (Default: false)

Allow ncftool to read user content.

Module: nscd

Layer: services

nscd_use_shm (Default: false)

Allow confined applications to use nscd shared memory.

Module: nsplugin

Layer: apps

nsplugin_can_network (Default: true)

Allow nsplugin code to connect to unreserved ports

Module: openshift

Layer: services

openshift_use_nfs (Default: false)

Allow openshift to access nfs file systems without labels

Module: openvpn

Layer: services

openvpn_enable_homedirs (Default: false)

Allow openvpn to read home directories

Module: openvpn

Layer: services

openvpn_run_unconfined (Default: false)

Allow openvpn to run unconfined scripts

Module: pcp

Layer: services

pcp_bind_all_unreserved_ports (Default: false)

Allow pcp to bind to all unreserved_ports

Module: piranha

Layer: services

piranha_lvs_can_network_connect (Default: false)

Allow piranha-lvs domain to connect to the network using TCP.

Module: postgresql

Layer: services

postgresql_can_rsync (Default: false)

Allow postgresql to use ssh and rsync for point-in-time recovery

Module: ppp

Layer: services

pppd_can_insmod (Default: false)

Allow pppd to load kernel modules for certain modems

Module: ppp

Layer: services

pppd_for_user (Default: false)

Allow pppd to be run for a regular user

Module: privoxy

Layer: services

privoxy_connect_any (Default: false)

Allow privoxy to connect to all ports, not just HTTP, FTP, and Gopher ports.

Module: puppet

Layer: services

puppet_manage_all_files (Default: false)

Allow Puppet client to manage all file types.

Module: puppet

Layer: services

puppetmaster_use_db (Default: false)

Allow Puppet master to use connect to mysql and postgresql database

Module: qemu

Layer: apps

qemu_full_network (Default: false)

Allow qemu to connect fully to the network

Module: qemu

Layer: apps

qemu_use_cifs (Default: true)

Allow qemu to use cifs/Samba file systems

Module: qemu

Layer: apps

qemu_use_comm (Default: false)

Allow qemu to user serial/parallel communication ports

Module: qemu

Layer: apps

qemu_use_nfs (Default: true)

Allow qemu to use nfs file systems

Module: qemu

Layer: apps

qemu_use_usb (Default: true)

Allow qemu to use usb devices

Module: ipsec

Layer: system

racoon_read_shadow (Default: false)

Allow racoon to read shadow

Module: rgmanager

Layer: services

rgmanager_can_network_connect (Default: false)

Allow rgmanager domain to connect to the network using TCP.

Module: rsync

Layer: services

rsync_client (Default: false)

Allow rsync to run as a client

Module: rsync

Layer: services

rsync_export_all_ro (Default: false)

Allow rsync to export any files/directories read only.

Module: rsync

Layer: services

rsync_use_cifs (Default: false)

Allow rsync servers to share cifs files systems

Module: rsync

Layer: services

rsync_use_nfs (Default: false)

Allow rsync servers to share nfs files systems

Module: samba

Layer: services

samba_create_home_dirs (Default: false)

Allow samba to create new home directories (e.g. via PAM)

Module: samba

Layer: services

samba_domain_controller (Default: false)

Allow samba to act as the domain controller, add users, groups and change passwords.

Module: samba

Layer: services

samba_enable_home_dirs (Default: false)

Allow samba to share users home directories.

Module: samba

Layer: services

samba_export_all_ro (Default: false)

Allow samba to share any file/directory read only.

Module: samba

Layer: services

samba_export_all_rw (Default: false)

Allow samba to share any file/directory read/write.

Module: samba

Layer: services

samba_portmapper (Default: false)

Allow samba to act as a portmapper

Module: samba

Layer: services

samba_run_unconfined (Default: false)

Allow samba to run unconfined scripts

Module: samba

Layer: services

samba_share_fusefs (Default: false)

Allow samba to export ntfs/fusefs volumes.

Module: samba

Layer: services

samba_share_nfs (Default: false)

Allow samba to export NFS volumes.

Module: sanlock

Layer: services

sanlock_use_fusefs (Default: false)

Allow sanlock to read/write fuse files

Module: sanlock

Layer: services

sanlock_use_nfs (Default: false)

Allow sanlock to manage nfs files

Module: sanlock

Layer: services

sanlock_use_samba (Default: false)

Allow sanlock to manage cifs files

Module: postgresql

Layer: services

sepgsql_enable_users_ddl (Default: true)

Allow unprivileged users to execute DDL statement

Module: postgresql

Layer: services

sepgsql_unconfined_dbadm (Default: true)

Allow database admins to execute DML statement

Module: sge

Layer: services

sge_domain_can_network_connect (Default: false)

Allow sge to connect to the network using any TCP port

Module: sge

Layer: services

sge_use_nfs (Default: false)

Allow sge to access nfs file systems.

Module: smartmon

Layer: services

smartmon_3ware (Default: false)

Enable additional permissions needed to support devices on 3ware controllers.

Module: spamassassin

Layer: services

spamassassin_can_network (Default: false)

Allow user spamassassin clients to use the network.

Module: spamassassin

Layer: services

spamd_enable_home_dirs (Default: true)

Allow spamd to read/write user home directories.

Module: squid

Layer: services

squid_connect_any (Default: false)

Allow squid to connect to all ports, not just HTTP, FTP, and Gopher ports.

Module: squid

Layer: services

squid_use_tproxy (Default: false)

Allow squid to run as a transparent proxy (TPROXY)

Module: ssh

Layer: services

ssh_chroot_full_access (Default: false)

Allow ssh with chroot env to manage all files

Module: ssh

Layer: services

ssh_chroot_manage_apache_content (Default: false)

Allow ssh with chroot env to apache content

Module: ssh

Layer: services

ssh_chroot_rw_homedirs (Default: false)

Allow ssh with chroot env to read and write files in the user home directories

Module: ssh

Layer: services

ssh_sysadm_login (Default: false)

Allow ssh logins as sysadm_r:sysadm_t

Module: swift

Layer: services

swift_can_network (Default: false)

Determine whether swift can connect to all TCP ports

Module: telepathy

Layer: apps

telepathy_tcp_connect_generic_network_ports (Default: false)

Allow the Telepathy connection managers to connect to any generic TCP port.

Module: tftp

Layer: services

tftp_anon_write (Default: false)

Allow tftp to modify public files used for public file transfer services.

Module: tftp

Layer: services

tftp_use_cifs (Default: false)

Allow tftp to read from a CIFS store for public file transfer services.

Module: tftp

Layer: services

tftp_use_nfs (Default: false)

Allow tftp to read from a NFS store for public file transfer services.

Module: tor

Layer: services

tor_bind_all_unreserved_ports (Default: false)

Allow tor daemon to bind tcp sockets to all unreserved ports.

Module: unconfineduser

Layer: roles

unconfined_login (Default: true)

Allow a user to login as an unconfined domain

Module: unconfineduser

Layer: roles

unconfined_mmap_zero_ignore (Default: false)

Ignore unconfined mmap_zero errors

Module: unconfineduser

Layer: roles

unconfined_mozilla_plugin_transition (Default: false)

Allow unconfined users to transition to the Mozilla plugin domain when running xulrunner plugin-container.

Global
use_fusefs_home_dirs (Default: false)

Support fusefs home directories

Module: lpd

Layer: services

use_lpd_server (Default: false)

Use lpd server instead of cups

Global
use_nfs_home_dirs (Default: false)

Support NFS home directories

Global
use_samba_home_dirs (Default: false)

Support SAMBA home directories

Module: xserver

Layer: services

user_direct_dri (Default: false)

Allow regular users direct dri device access

Module: userdomain

Layer: system

user_direct_mouse (Default: false)

Allow regular users direct mouse access

Module: netutils

Layer: admin

user_ping (Default: false)

Control users use of ping and traceroute

Module: userdomain

Layer: system

user_rw_noexattrfile (Default: false)

Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)

Module: userdomain

Layer: system

user_setrlimit (Default: false)

Allow user processes to change their priority

Global
user_tcp_server (Default: false)

Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.

Module: userdomain

Layer: system

user_ttyfile_stat (Default: false)

Allow w to display everyone

Module: varnishd

Layer: services

varnishd_connect_any (Default: false)

Allow varnishd to connect to all ports, not just HTTP.

Module: vbetool

Layer: admin

vbetool_mmap_zero_ignore (Default: false)

Ignore vbetool mmap_zero errors.

Module: virt

Layer: services

virt_use_comm (Default: false)

Allow virt to use serial/parallell communication ports

Module: virt

Layer: services

virt_use_execmem (Default: false)

Allow confined virtual guests to use executable memory and executable stack

Module: virt

Layer: services

virt_use_fusefs (Default: false)

Allow virt to read fuse files

Module: virt

Layer: services

virt_use_nfs (Default: false)

Allow virt to manage nfs files

Module: virt

Layer: services

virt_use_samba (Default: false)

Allow virt to manage cifs files

Module: virt

Layer: services

virt_use_sanlock (Default: false)

Allow confined virtual guests to interact with the sanlock

Module: virt

Layer: services

virt_use_sysfs (Default: false)

Allow virt to manage device configuration, (pci)

Module: virt

Layer: services

virt_use_usb (Default: true)

Allow virt to use usb devices

Module: virt

Layer: services

virt_use_xserver (Default: false)

Allow virtual machine to interact with the xserver

Module: webadm

Layer: roles

webadm_manage_user_files (Default: false)

Allow webadm to manage files in users home directories

Module: webadm

Layer: roles

webadm_read_user_files (Default: false)

Allow webadm to read files in users home directories

Module: wine

Layer: apps

wine_mmap_zero_ignore (Default: false)

Ignore wine mmap_zero errors

Module: xserver

Layer: services

xdm_exec_bootloader (Default: false)

Allows xdm to execute bootloader

Module: xserver

Layer: services

xdm_sysadm_login (Default: false)

Allow xdm logins as sysadm

Module: xen

Layer: system

xen_use_nfs (Default: false)

Allow xen to manage nfs files

Module: xguest

Layer: roles

xguest_connect_network (Default: true)

Allow xguest to configure Network Manager and connect to apache ports

Module: xguest

Layer: roles

xguest_mount_media (Default: true)

Allow xguest users to mount removable media

Module: xguest

Layer: roles

xguest_use_bluetooth (Default: true)

Allow xguest to use blue tooth devices

Module: xserver

Layer: services

xserver_object_manager (Default: false)

Support X userspace object manager

Module: zabbix

Layer: services

zabbix_can_network (Default: false)

Determine whether zabbix can connect to all TCP ports