Master tunable index:

Global
allow_console_login (Default: false)

Allow users to connect to console (s390)

Module: cvs

Layer: services

allow_cvs_read_shadow (Default: false)

Allow cvs daemon to read shadow

Module: init

Layer: system

allow_daemons_dump_core (Default: false)

Allow all daemons to write corefiles to /

Module: init

Layer: system

allow_daemons_use_tty (Default: false)

Allow all daemons the ability to use unallocated ttys

Global
allow_execheap (Default: false)

Allow making the heap executable.

Global
allow_execmem (Default: false)

Allow making anonymous memory executable, e.g. for runtime-code generation or executable stack.

Global
allow_execmod (Default: false)

Allow making a modified private file mapping executable (text relocation).

Global
allow_execstack (Default: false)

Allow making the stack executable via mprotect. Also requires allow_execmem.

Module: ftp

Layer: services

allow_ftpd_anon_write (Default: false)

Allow ftp servers to modify public files used for public file transfer services.

Module: ftp

Layer: services

allow_ftpd_full_access (Default: false)

Allow ftp servers to login to local users and read/write all files on the system, governed by DAC.

Module: ftp

Layer: services

allow_ftpd_use_cifs (Default: false)

Allow ftp servers to use cifs used for public file transfer services.

Module: ftp

Layer: services

allow_ftpd_use_nfs (Default: false)

Allow ftp servers to use nfs used for public file transfer services.

Module: rpc

Layer: services

allow_gssd_read_tmp (Default: true)

Allow gssd to read temp directory.

Module: apache

Layer: services

allow_httpd_anon_write (Default: false)

Allow Apache to modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Module: apache

Layer: services

allow_httpd_dbus_avahi (Default: false)

Allow Apache to communicate with avahi service via dbus

Module: apache

Layer: services

allow_httpd_mod_auth_ntlm_winbind (Default: false)

Allow Apache to use mod_auth_pam

Module: apache

Layer: services

allow_httpd_mod_auth_pam (Default: false)

Allow Apache to use mod_auth_pam

Module: apache

Layer: services

allow_httpd_sys_script_anon_write (Default: false)

Allow apache scripts to write to public content. Directories/Files must be labeled public_content_rw_t.

Module: java

Layer: apps

allow_java_execstack (Default: false)

Allow java executable stack

Module: kerberos

Layer: services

allow_kerberos (Default: false)

Allow system to run with kerberos

Module: mount

Layer: system

allow_mount_anyfile (Default: false)

Allow mount to mount any file

Module: mount

Layer: system

allow_mounton_anydir (Default: true)

Allow mount to mount any dir

Module: mplayer

Layer: apps

allow_mplayer_execstack (Default: false)

Allow mplayer executable stack

Module: domain

Layer: kernel

allow_netlabel (Default: true)

Allow all domains to use netlabel labeled packets

Module: rpc

Layer: services

allow_nfsd_anon_write (Default: false)

Allow nfs servers to modify public files used for public file transfer services.

Global
allow_polyinstantiation (Default: false)

Enable polyinstantiated directory support.

Module: postfix

Layer: services

allow_postfix_local_write_mail_spool (Default: false)

Allow postfix_local domain full write access to mail_spool directories

Module: userdomain

Layer: system

allow_ptrace (Default: false)

Allow sysadm to ptrace all processes

Module: rsync

Layer: services

allow_rsync_anon_write (Default: false)

Allow rsync to modify public files used for public file transfer services.

Module: sasl

Layer: services

allow_saslauthd_read_shadow (Default: false)

Allow sasl to read shadow

Module: samba

Layer: services

allow_smbd_anon_write (Default: false)

Allow samba to modify public files used for public file transfer services.

Module: ssh

Layer: services

allow_ssh_keysign (Default: false)

allow host key based authentication

Module: tftp

Layer: services

allow_tftp_anon_write (Default: false)

Allow tftp to modify public files used for public file transfer services.

Module: domain

Layer: kernel

allow_unlabeled_packets (Default: true)

Allow unlabeled packets to work on system

Module: userdomain

Layer: system

allow_user_postgresql_connect (Default: false)

Allow users to connect to PostgreSQL

Module: xserver

Layer: services

allow_write_xshm (Default: false)

Allows clients to write to the X server shared memory segments.

Module: xserver

Layer: services

allow_xserver_execmem (Default: false)

Allows XServer to execute writable memory

Global
allow_ypbind (Default: false)

Allow system to run with NIS

Module: zebra

Layer: services

allow_zebra_write_config (Default: false)

Allow zebra daemon to write it configuration files

Module: cdrecord

Layer: apps

cdrecord_read_content (Default: false)

Allow cdrecord to read various content. nfs, samba, removable devices, user temp and untrusted content files

Module: exim

Layer: services

exim_can_connect_db (Default: false)

Allow exim to connect to databases (postgres, mysql)

Module: exim

Layer: services

exim_manage_user_files (Default: false)

Allow exim to create, read, write, and delete unprivileged user files.

Module: exim

Layer: services

exim_read_user_files (Default: false)

Allow exim to read unprivileged user files.

Module: cron

Layer: services

fcron_crond (Default: false)

Enable extra rules in the cron domain to support fcron.

Module: ftp

Layer: services

ftp_home_dir (Default: false)

Allow ftp to read and write files in the user home directories

Global
global_ssp (Default: false)

Enable reading of urandom for all domains.

This should be enabled when all programs are compiled with ProPolice/SSP stack smashing protection. All domains will be allowed to read from /dev/urandom.

Module: apache

Layer: services

httpd_builtin_scripting (Default: false)

Allow httpd to use built in scripting (usually php)

Module: apache

Layer: services

httpd_can_network_connect (Default: false)

Allow HTTPD scripts and modules to connect to the network

Module: apache

Layer: services

httpd_can_network_connect_db (Default: false)

Allow HTTPD scripts and modules to network connect to databases, mysql/posgresql

Module: apache

Layer: services

httpd_can_network_relay (Default: false)

Allow httpd to act as a relay

Module: apache

Layer: services

httpd_can_sendmail (Default: false)

Allow http daemon to send mail

Module: apache

Layer: services

httpd_enable_cgi (Default: false)

Allow httpd cgi support

Module: apache

Layer: services

httpd_enable_ftp_server (Default: false)

Allow httpd to act as a FTP server by listening on the ftp port.

Module: apache

Layer: services

httpd_enable_homedirs (Default: false)

Allow httpd to read home directories

Module: apache

Layer: services

httpd_ssi_exec (Default: false)

Allow HTTPD to run SSI executables in the same domain as system CGI scripts

Module: apache

Layer: services

httpd_tty_comm (Default: false)

Unify HTTPD to communicate with the terminal. Needed for handling certificates

Module: apache

Layer: services

httpd_unified (Default: false)

Unify HTTPD handling of all content files

Module: apache

Layer: services

httpd_use_cifs (Default: false)

Allow httpd to access cifs file systems

Module: apache

Layer: services

httpd_use_nfs (Default: false)

Allow httpd to access nfs file systems

Global
mail_read_content (Default: false)

Allow email client to various content. nfs, samba, removable devices, user temp and untrusted content files

Module: bind

Layer: services

named_write_master_zones (Default: false)

Allow BIND to write the master zone files. Generally this is used for dynamic DNS.

Global
nfs_export_all_ro (Default: false)

Allow nfs to be exported read only

Global
nfs_export_all_rw (Default: false)

Allow nfs to be exported read/write.

Module: openvpn

Layer: services

openvpn_enable_homedirs (Default: false)

Allow openvpn to read home directories

Module: ppp

Layer: services

pppd_can_insmod (Default: false)

Allow pppd to load kernel modules for certain modems

Module: ppp

Layer: services

pppd_for_user (Default: false)

Allow pppd to be run for a regular user

Global
read_default_t (Default: false)

Allow reading of default_t files.

Global
read_untrusted_content (Default: false)

Allow applications to read untrusted content If this is disallowed, Internet content has to be manually relabeled for read access to be granted

Module: rsync

Layer: services

rsync_export_all_ro (Default: false)

Allow rsync export files read only

Module: samba

Layer: services

samba_domain_controller (Default: false)

Allow samba to run as the domain controller; add machines to passwd file

Module: samba

Layer: services

samba_enable_home_dirs (Default: false)

Allow samba to export user home directories.

Module: samba

Layer: services

samba_export_all_ro (Default: false)

Export all files on system read only.

Module: samba

Layer: services

samba_export_all_rw (Default: false)

Export all files on system read-write.

Module: samba

Layer: services

samba_run_unconfined (Default: false)

Allow samba to run unconfined scripts

Module: samba

Layer: services

samba_share_nfs (Default: false)

Allow samba to export NFS volumes.

Module: spamassassin

Layer: services

spamassassin_can_network (Default: false)

Allow user spamassassin clients to use the network.

Module: spamassassin

Layer: services

spamd_enable_home_dirs (Default: true)

Allow spamd to read/write user home directories.

Module: squid

Layer: services

squid_connect_any (Default: false)

Allow squid to connect to all ports, not just HTTP, FTP, and Gopher ports.

Module: ssh

Layer: services

ssh_sysadm_login (Default: false)

Allow ssh logins as sysadm_r:sysadm_t

Module: lpd

Layer: services

use_lpd_server (Default: false)

Use lpd server instead of cups

Global
use_nfs_home_dirs (Default: false)

Support NFS home directories

Global
use_samba_home_dirs (Default: false)

Support SAMBA home directories

Module: userdomain

Layer: system

user_direct_mouse (Default: false)

Allow regular users direct mouse access

Module: userdomain

Layer: system

user_dmesg (Default: false)

Allow users to read system messages.

Module: netutils

Layer: admin

user_ping (Default: false)

Control users use of ping and traceroute

Module: userdomain

Layer: system

user_rw_noexattrfile (Default: false)

Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)

Global
user_tcp_server (Default: false)

Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.

Module: userdomain

Layer: system

user_ttyfile_stat (Default: false)

Allow w to display everyone

Global
write_untrusted_content (Default: false)

Allow applications to write untrusted content If this is disallowed, no Internet content will be stored.

Module: xserver

Layer: services

xdm_sysadm_login (Default: false)

Allow xdm logins as sysadm

Global
xen_use_nfs (Default: false)

Allow xen to manage nfs files

Module: xguest

Layer: users

xguest_connect_network (Default: false)

Allow xguest to configure Network Manager

Module: xguest

Layer: users

xguest_mount_media (Default: false)

Allow xguest users to mount removable media

Module: xguest

Layer: users

xguest_use_bluetooth (Default: false)

Allow xguest to use blue tooth devices