#

# This file is for the declaration of global tunables.

# To change the default value at build time, the booleans.conf

# file should be used.

#

## <desc>

## 

## Allow unconfined executables to make their heap memory executable.  Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla

## 

## </desc>

gen_tunable(allow_execheap,false)

## <desc>

## 

## Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla

## 

## </desc>

gen_tunable(allow_execmem,false)

## <desc>

## 

## Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t

## 

## </desc>

gen_tunable(allow_execmod,false)

## <desc>

## 

## Allow unconfined executables to make their stack executable.  This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla

## 

## </desc>

gen_tunable(allow_execstack,false)

## <desc>

## 

## Enable polyinstantiated directory support.

## 

## </desc>

gen_tunable(allow_polyinstantiation,false)

## <desc>

## 

## Allow system to run with NIS

## 

## </desc>

gen_tunable(allow_ypbind,false)

## <desc>

## 

## Enable reading of urandom for all domains.

## 

## 

## This should be enabled when all programs

## are compiled with ProPolice/SSP

## stack smashing protection.  All domains will

## be allowed to read from /dev/urandom.

## 

## </desc>

gen_tunable(global_ssp,false)

## <desc>

## 

## Allow any files/directories to be exported read/write via NFS.

## 

## </desc>

gen_tunable(nfs_export_all_rw,false)

## <desc>

## 

## Allow any files/directories to be exported read/only via NFS.

## 

## </desc>

gen_tunable(nfs_export_all_ro,false)

## <desc>

## 

## Support NFS home directories

## 

## </desc>

gen_tunable(use_nfs_home_dirs,false)

## <desc>

## 

## Support SAMBA home directories

## 

## </desc>

gen_tunable(use_samba_home_dirs,false)

## <desc>

## 

## Allow users to run TCP servers (bind to ports and accept connection from

## the same domain and outside users)  disabling this forces FTP passive mode

## and may change other protocols.

## 

## </desc>

gen_tunable(user_tcp_server,false)

## <desc>

## 

## Allow direct login to the console device. Required for System 390

## 

## </desc>

gen_tunable(allow_console_login,false)