#

# This file is for the declaration of global tunables.

# To change the default value at build time, the booleans.conf

# file should be used.

#

########################################

#

# Common tunables

#

## <desc>

## 

## Allow making the heap executable.

## 

## </desc>

gen_tunable(allow_execheap,false)

## <desc>

## 

## Allow making anonymous memory executable, e.g. 

## for runtime-code generation or executable stack.

## 

## </desc>

gen_tunable(allow_execmem,false)

## <desc>

## 

## Allow making a modified private file

## mapping executable (text relocation).

## 

## </desc>

gen_tunable(allow_execmod,false)

## <desc>

## 

## Allow making the stack executable via mprotect.

## Also requires allow_execmem.

## 

## </desc>

gen_tunable(allow_execstack,false)

## <desc>

## 

## Enable polyinstantiated directory support.

## 

## </desc>

gen_tunable(allow_polyinstantiation,false)

## <desc>

## 

## Allow system to run with NIS

## 

## </desc>

gen_tunable(allow_ypbind,false)

## <desc>

## 

## Enable reading of urandom for all domains.

## 

## 

## This should be enabled when all programs

## are compiled with ProPolice/SSP

## stack smashing protection.  All domains will

## be allowed to read from /dev/urandom.

## 

## </desc>

gen_tunable(global_ssp,false)

## <desc>

## 

## Allow nfs to be exported read/write.

## 

## </desc>

gen_tunable(nfs_export_all_rw,false)

## <desc>

## 

## Allow nfs to be exported read only

## 

## </desc>

gen_tunable(nfs_export_all_ro,false)

## <desc>

## 

## Allow reading of default_t files.

## 

## </desc>

gen_tunable(read_default_t,false)

## <desc>

## 

## Support NFS home directories

## 

## </desc>

gen_tunable(use_nfs_home_dirs,false)

## <desc>

## 

## Support SAMBA home directories

## 

## </desc>

gen_tunable(use_samba_home_dirs,false)

########################################

#

# Strict policy specific

#

ifdef(`strict_policy',`

## <desc>

## 

## Allow email client to various content.

## nfs, samba, removable devices, user temp

## and untrusted content files

## 

## </desc>

gen_tunable(mail_read_content,false)

## <desc>

## 

## Allow applications to read untrusted content

## If this is disallowed, Internet content has

## to be manually relabeled for read access to be granted

## 

## </desc>

gen_tunable(read_untrusted_content,false)

## <desc>

## 

## Allow users to run TCP servers (bind to ports and accept connection from

## the same domain and outside users)  disabling this forces FTP passive mode

## and may change other protocols.

## 

## </desc>

gen_tunable(user_tcp_server,false)

## <desc>

## 

## Allow applications to write untrusted content

## If this is disallowed, no Internet content

## will be stored.

## 

## </desc>

gen_tunable(write_untrusted_content,false)

')