#

# This file is for the declaration of global tunables.

# To change the default value at build time, the booleans.conf

# file should be used.

#

## <desc>

## 

## Allow unconfined executables to make their heap memory executable.  Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla

## 

## </desc>

gen_tunable(allow_execheap,false)

## <desc>

## 

## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla")

## 

## </desc>

gen_tunable(allow_execmem,false)

## <desc>

## 

## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t")

## 

## </desc>

gen_tunable(allow_execmod,false)

## <desc>

## 

## Allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla")

## 

## </desc>

gen_tunable(allow_execstack,false)

## <desc>

## 

## Enable polyinstantiated directory support.

## 

## </desc>

gen_tunable(allow_polyinstantiation,false)

## <desc>

## 

## Allow system to run with NIS

## 

## </desc>

gen_tunable(allow_ypbind,false)

## <desc>

## 

## Enable reading of urandom for all domains.

## 

## 

## This should be enabled when all programs

## are compiled with ProPolice/SSP

## stack smashing protection.  All domains will

## be allowed to read from /dev/urandom.

## 

## </desc>

gen_tunable(global_ssp,false)

## <desc>

## 

## Allow email client to various content.

## nfs, samba, removable devices, user temp

## and untrusted content files

## 

## </desc>

gen_tunable(mail_read_content,false)

## <desc>

## 

## Allow any files/directories to be exported read/write via NFS.

## 

## </desc>

gen_tunable(nfs_export_all_rw,false)

## <desc>

## 

## Allow any files/directories to be exported read/only via NFS.

## 

## </desc>

gen_tunable(nfs_export_all_ro,false)

## <desc>

## 

## Allow reading of default_t files.

## 

## </desc>

gen_tunable(read_default_t,false)

## <desc>

## 

## Allow applications to read untrusted content

## If this is disallowed, Internet content has

## to be manually relabeled for read access to be granted

## 

## </desc>

gen_tunable(read_untrusted_content,false)

## <desc>

## 

## Support NFS home directories

## 

## </desc>

gen_tunable(use_nfs_home_dirs,false)

## <desc>

## 

## Support SAMBA home directories

## 

## </desc>

gen_tunable(use_samba_home_dirs,false)

## <desc>

## 

## Allow users to run TCP servers (bind to ports and accept connection from

## the same domain and outside users)  disabling this forces FTP passive mode

## and may change other protocols.

## 

## </desc>

gen_tunable(user_tcp_server,false)

## <desc>

## 

## Allow applications to write untrusted content

## If this is disallowed, no Internet content

## will be stored.

## 

## </desc>

gen_tunable(write_untrusted_content,false)