Changeset 207

Timestamp:

07/08/08 11:31:21 (2 months ago)

Author:

jmowery

Message:

updated to include new booleans and updated descriptions from new release

Files:

• branch/RHEL-5.2-20080702merge/src/selinux-policy-clip/policy/booleans.conf (modified) (8 diffs)

branch/RHEL-5.2-20080702merge/src/selinux-policy-clip/policy/booleans.conf

@@ -36 +36 @@
-
-#
+# Allow usage of the gpg-agent --write-env-file option.
+# This also allows gpg-agent to manage user files.
+# 
+gpg_agent_env_file = false
+
+#
-# Allow java executable stack
-# 
@@ -49 +55 @@
-# 
-allow_mplayer_execstack = false
+
+#
+# Allow qemu to connect fully to the network
+# 
+qemu_full_network = false
+
+#
+# Allow sysadm to debug or ptrace all processes.
+# 
+allow_ptrace = false
-
-#
@@ -195 +211 @@
-
-#
+# Allow unprived users to execute DDL statement
+# 
+sepgsql_enable_users_ddl = true
+
+#
-# Allow pppd to load kernel modules for certain modems
-# 
@@ -304 +325 @@
-
-#
+# Allow virt to manage nfs files
+# 
+virt_use_nfs = false
+
+#
+# Allow virt to manage cifs files
+# 
+virt_use_samba = false
+
+#
-# Allows clients to write to the X server shared
-# memory segments.
@@ -315 +346 @@
-
-#
+# Support X userspace object manager
+# 
+xserver_object_manager = false
+
+#
-# Allow zebra daemon to write it configuration files
-# 
-allow_zebra_write_config = false
+
+#
+# Enable support for upstart as the init program.
+# 
+init_upstart = false
-
-#
@@ -361 +402 @@
-
-#
-making the heap executable.
+unconfined executables to make their heap memory executable.  Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla
-# 
-allow_execheap = false
-
-#
-
-
+
-# 
-allow_execmem = false
-
-#
-
-
+
-# 
-allow_execmod = false
-
-#
-
-
+
-# 
-allow_execstack = false
@@ -414 +452 @@
-
-#
-nfs to be exported read/write
+any files/directories to be exported read/write via NFS
-# 
-nfs_export_all_rw = false
-
-#
-nfs to be exported read only
+any files/directories to be exported read/only via NFS.
-# 
-nfs_export_all_ro = false
@@ -460 +498 @@
-
-#
-applications to write untrusted content
+spamd to read/write user home directories.
-# 
-spamd_enable_home_dirs = true
-
-#
-applications to write untrusted content
+user spamassassin clients to use the network.
-# 
-spamassassin_can_network = false
-
-#
-applications to write untrusted content
+samba to share users home directories.
-# 
-samba_enable_home_dirs = false
-
-#
-applications to write untrusted content
+pppd to be run for a regular user
-# 
-pppd_for_user = false
-
-#
-applications to write untrusted content
+confined applications to run with kerberos
-# 
-allow_kerberos = false