Policy modules for administrative functions, such as package management.
Policy for the kernel modules, kernel image, and bootloader.
Execute bootloader in the bootloader domain. Domain allowed to transition. Execute bootloader interactively and do a domain transition to the bootloader domain. Domain allowed to transition. Role allowed access. Execute bootloader in the caller domain. Domain allowed access. Read the bootloader configuration file. Domain allowed access. Read and write the bootloader configuration file. Domain allowed access. Read and write the bootloader temporary data in /tmp. Domain allowed access. Create, read and write the bootloader runtime data. Domain allowed access.
Determine of the console connected to the controlling terminal.
Execute consoletype in the consoletype domain. Domain allowed to transition. Execute consoletype in the consoletype domain, and allow the specified role the consoletype domain. Domain allowed to transition. Role allowed access. Execute consoletype in the caller domain. Domain allowed access.
Policy for dmesg.
Execute dmesg in the dmesg domain. Domain allowed to transition. Execute dmesg in the caller domain. Domain allowed access.
Network analysis utilities
Execute network utilities in the netutils domain. Domain allowed to transition. Execute network utilities in the netutils domain, and allow the specified role the netutils domain. Domain allowed to transition. Role allowed access. Execute network utilities in the caller domain. Domain allowed access. Send generic signals to network utilities. Domain allowed access. Execute ping in the ping domain. Domain allowed to transition. Send a kill (SIGKILL) signal to ping. Domain allowed access. Send generic signals to ping. Domain allowed access. Execute ping in the ping domain, and allow the specified role the ping domain. Domain allowed to transition. Role allowed access. Conditionally execute ping in the ping domain, and allow the specified role the ping domain. Domain allowed to transition. Role allowed access. Execute ping in the caller domain. Domain allowed access. Execute traceroute in the traceroute domain. Domain allowed to transition. Execute traceroute in the traceroute domain, and allow the specified role the traceroute domain. Domain allowed to transition. Role allowed access. Conditionally execute traceroute in the traceroute domain, and allow the specified role the traceroute domain. Domain allowed to transition. Role allowed access. Execute traceroute in the caller domain. Domain allowed access.

Control users use of ping and traceroute

Run shells with substitute user and group
Restricted su domain template.

This template creates a derived domain which is allowed to change the linux user id, to run shells as a different user.

The prefix of the user domain (e.g., user is the prefix for user_t).
The type of the user domain.
The role associated with the user domain.
The role template for the su module.
The prefix of the user role (e.g., user is the prefix for user_r).
The role associated with the user domain.
The type of the user domain.
Execute su in the caller domain. Domain allowed access.
Execute a command with a substitute user
The role template for the sudo module.

This template creates a derived domain which is allowed to change the linux user id, to run commands as a different user.

The prefix of the user role (e.g., user is the prefix for user_r).
The user role.
The user domain associated with the role.
Send a SIGCHLD signal to the sudo domain. Domain allowed access.
Policy for managing user accounts.
Execute chfn in the chfn domain. Domain allowed to transition. Execute chfn in the chfn domain, and allow the specified role the chfn domain. Domain allowed to transition. Role allowed access. Execute groupadd in the groupadd domain. Domain allowed to transition. Execute groupadd in the groupadd domain, and allow the specified role the groupadd domain. Domain allowed to transition. Role allowed access. Execute passwd in the passwd domain. Domain allowed to transition. Send sigkills to passwd. Domain allowed access. Check if the passwd binary is executable. Domain allowed access. Execute passwd in the passwd domain, and allow the specified role the passwd domain. Domain allowed to transition. Role allowed access. Execute password admin functions in the admin passwd domain. Domain allowed to transition. Execute passwd admin functions in the admin passwd domain, and allow the specified role the admin passwd domain. Domain allowed to transition. Role allowed access. Do not audit attempts to use useradd fds. Domain to not audit. Execute useradd in the useradd domain. Domain allowed to transition. Check if the useradd binaries are executable. Domain allowed access. Execute useradd in the useradd domain, and allow the specified role the useradd domain. Domain allowed to transition. Role allowed access. Read the crack database. Domain allowed access.
Policy modules for applications
Filesystem namespacing/polyinstantiation application.
Execute a domain transition to run seunshare. Domain allowed to transition. Execute seunshare in the seunshare domain, and allow the specified role the seunshare domain. Domain allowed to transition. Role allowed access. Role access for seunshare Role allowed access. User domain for the role.
Contributed Reference Policy modules.
Automated bug-reporting tool.
Execute abrt in the abrt domain. Domain allowed to transition. Execute abrt in the caller domain. Domain allowed access. Send null signals to abrt. Domain allowed access. Read process state of abrt. Domain allowed access. Connect to abrt over an unix stream socket. Domain allowed access. Send and receive messages from abrt over dbus. Domain allowed access. Execute abrt-helper in the abrt helper domain. Domain allowed to transition. Execute abrt helper in the abrt helper domain, and allow the specified role the abrt helper domain. Domain allowed to transition. Role allowed access. Create, read, write, and delete abrt cache files. Domain allowed access. Create, read, write, and delete abrt cache content. Domain allowed access. Read abrt configuration files. Domain allowed access. Read abrt log files. Domain allowed access. Read abrt PID files. Domain allowed access. Create, read, write, and delete abrt PID files. Domain allowed access. All of the rules required to administrate an abrt environment, Domain allowed access. Role allowed access.

Determine whether ABRT can modify public files used for public file transfer services.

Determine whether abrt-handle-upload can modify public files used for public file transfer services in /var/spool/abrt-upload/.

Determine whether ABRT can run in the abrt_handle_event_t domain to handle ABRT event scripts.

AccountsService and daemon for manipulating user account information via D-Bus.
Execute a domain transition to run accountsd. Domain allowed to transition. Do not audit attempts to read and write Accounts Daemon fifo files. Domain to not audit. Send and receive messages from accountsd over dbus. Domain allowed access. Search accountsd lib directories. Domain allowed access. Read accountsd lib files. Domain allowed access. Create, read, write, and delete accountsd lib files. Domain allowed access. All of the rules required to administrate an accountsd environment. Domain allowed access. Role allowed access.
Berkeley process accounting.
Transition to the accounting management domain. Domain allowed to transition. Execute accounting management tools in the caller domain. Domain allowed access. Execute accounting management data in the caller domain. Domain allowed access. Create, read, write, and delete process accounting data. Domain allowed access. All of the rules required to administrate an acct environment. Domain allowed access. Role allowed access.
GNAT Ada95 compiler.
Execute the ada program in the ada domain. Domain allowed to transition. Execute ada in the ada domain, and allow the specified role the ada domain. Domain allowed to transition. Role allowed access.
Andrew Filesystem server.
Execute a domain transition to run the afs client. Domain allowed to transition. Read and write afs client UDP sockets. Domain allowed access. Read and write afs cache files. Domain allowed access. Execute afs server in the afs domain. Domain allowed to transition. All of the rules required to administrate an afs environment. Domain allowed access. Role allowed access.
Automatic IPv6 Connectivity Client Utility.
Execute a domain transition to run aiccu. Domain allowed to transition. Execute aiccu server in the aiccu domain. Domain allowed to transition. Read aiccu PID files. Domain allowed access. All of the rules required to administrate an aiccu environment. Domain allowed access. Role allowed access.
Aide filesystem integrity checker.
Execute aide in the aide domain. Domain allowed to transition. Execute aide programs in the AIDE domain and allow the specified role the AIDE domain. Domain allowed to transition. Role allowed access. All of the rules required to administrate an aide environment. Domain allowed access. Role allowed access.
Aisexec Cluster Engine.
Execute a domain transition to run aisexec. Domain allowed to transition. Connect to aisexec over a unix stream socket. Domain allowed access. Read aisexec log files content. Domain allowed access. All of the rules required to administrate an aisexec environment. Domain allowed access. Role allowed access.
Advanced Linux Sound Architecture utilities.
Role access for alsa.
Role allowed access.
User domain for the role.
Execute a domain transition to run Alsa. Domain allowed to transition. Execute a domain transition to run Alsa, and allow the specified role the Alsa domain. Domain allowed to transition. Role allowed access. Read and write Alsa semaphores. Domain allowed access. Read and write Alsa shared memory. Domain allowed access. Read writable Alsa configuration content. (Deprecated) Domain allowed access. Read Alsa configuration content. Domain allowed access. Manage writable Alsa config files. (Deprecated) Domain allowed access. Manage Alsa config files. Domain allowed access. Create, read, write, and delete alsa home files. Domain allowed access. Read Alsa home files. Domain allowed access. Relabel alsa home files. Domain allowed access. Create objects in user home directories with the generic alsa home type. Domain allowed access. Class of the object being created. The name of the object being created. Read Alsa lib files. Domain allowed access. Write Alsa lib files. Domain allowed access.
Advanced Maryland Automatic Network Disk Archiver.
Execute a domain transition to run Amanda recover. Domain allowed to transition. Execute a domain transition to run Amanda recover, and allow the specified role the Amanda recover domain. Domain allowed to transition. Role allowed access. Search Amanda library directories. Domain allowed access. Do not audit attempts to read /etc/dumpdates. Domain to not audit. Read and write /etc/dumpdates. Domain allowed access. Manage Amanda library directories. Domain allowed access. Read and append amanda log files. Domain allowed access. Search Amanda var library directories. Domain allowed access.
High-performance interface between an email server and content checkers.
Execute a domain transition to run amavis. Domain allowed to transition. Execute amavis server in the amavis domain. Domain allowed to transition. Read amavis spool files. Domain allowed access. Create, read, write, and delete amavis spool files. Domain allowed access. Create objects in the amavis spool directories with a private type. Domain allowed access. Private file type. Class of the object being created. The name of the object being created. Search amavis lib directories. Domain allowed access. Read amavis lib files. Domain allowed access. Create, read, write, and delete amavis lib files. Domain allowed access. Set attributes of amavis pid files. Domain allowed access. Create amavis pid files. Domain allowed access. All of the rules required to administrate an amavis environment. Domain allowed access. Role allowed access.

Determine whether amavis can use JIT compiler.

Abstract Machine Test Utility.
Execute a domain transition to run Amtu. Domain allowed to transition. Execute a domain transition to run Amtu, and allow the specified role the Amtu domain. Domain allowed to transition. Role allowed access. All of the rules required to administrate an amtu environment. Domain allowed access. Role allowed access.
Anaconda installer.
Various web servers.
Create a set of derived types for httpd web content.
The prefix to be used for deriving type names.
Role access for apache. Role allowed access User domain for the role. Read user httpd script executable files. Domain allowed access. Read user httpd content. Domain allowed access. Execute httpd with a domain transition. Domain allowed to transition. Execute httpd server in the httpd domain. Domain allowed to transition. Send generic signals to httpd. Domain allowed access. Send null signals to httpd. Domain allowed access. Send child terminated signals to httpd. Domain allowed access. Inherit and use file descriptors from httpd. Domain allowed access. Do not audit attempts to read and write httpd unnamed pipes. Domain to not audit. Do not audit attempts to read and write httpd unix domain stream sockets. Domain to not audit. Do not audit attempts to read and write httpd TCP sockets. Domain to not audit. Read all appendable content Domain allowed access. Append to all appendable web content Domain allowed access. Read all read/write content Domain allowed access. Manage all read/write content Domain allowed access. Read all web content. Domain allowed access. Search all apache content. Domain allowed access. Create, read, write, and delete all httpd content. Domain allowed access. Set attributes httpd cache directories. Domain allowed access. List httpd cache directories. Domain allowed access. Read and write httpd cache files. Domain allowed access. Delete httpd cache directories. Domain allowed access. Delete httpd cache files. Domain allowed access. Read httpd configuration files. Domain allowed access. Search httpd configuration directories. Domain allowed access. Create, read, write, and delete httpd configuration files. Domain allowed access. Execute the Apache helper program with a domain transition. Domain allowed access. Execute the Apache helper program with a domain transition, and allow the specified role the Apache helper domain. Domain allowed to transition. Role allowed access. Read httpd log files. Domain allowed access. Append httpd log files. Domain allowed access. Do not audit attempts to append httpd log files. Domain to not audit. Create, read, write, and delete httpd log files. Domain allowed access. Write apache log files. Domain allowed access. Do not audit attempts to search httpd module directories. Domain to not audit. List httpd module directories. Domain allowed access. Execute httpd module files. Domain allowed access. Read httpd module files. Domain allowed access. Execute a domain transition to run httpd_rotatelogs. Domain allowed to transition. List httpd system content directories. Domain allowed access. Create, read, write, and delete httpd system content files. Domain allowed access. Create, read, write, and delete httpd system rw content. Domain allowed access. Execute all httpd scripts in the system script domain. Domain allowed to transition. Do not audit attempts to read and write httpd system script unix domain stream sockets. Domain to not audit. Execute all user scripts in the user script domain. Domain allowed to transition. Execute all user scripts in the user script domain. Add user script domains to the specified role. Domain allowed to transition. Role allowed access. Read httpd squirrelmail data files. Domain allowed access. Append httpd squirrelmail data files. Domain allowed access. Search httpd system content. Domain allowed access. Read httpd system content. Domain allowed access. Search httpd system CGI directories. Domain allowed access. Create, read, write, and delete all user httpd content. Domain allowed access. Search system script state directories. Domain allowed access. Read httpd tmp files. Domain allowed access. Do not audit attempts to write httpd tmp files. Domain to not audit. Execute CGI in the specified domain.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Domain run the cgi script in. Type of the executable to enter the cgi domain. All of the rules required to administrate an apache environment. Domain allowed access. Role allowed access.

Determine whether httpd can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Determine whether httpd can use mod_auth_pam.

Determine whether httpd can use built in scripting.

Determine whether httpd can check spam.

Determine whether httpd scripts and modules can connect to the network using TCP.

Determine whether httpd scripts and modules can connect to cobbler over the network.

Determine whether scripts and modules can connect to databases over the network.

Determine whether httpd can connect to ldap over the network.

Determine whether httpd can connect to memcache server over the network.

Determine whether httpd can act as a relay.

Determine whether httpd daemon can connect to zabbix over the network.

Determine whether httpd can send mail.

Determine whether httpd can communicate with avahi service via dbus.

Determine wether httpd can use support.

Determine whether httpd can act as a FTP server by listening on the ftp port.

Determine whether httpd can traverse user home directories.

Determine whether httpd gpg can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Determine whether httpd can execute its temporary content.

Determine whether httpd scripts and modules can use execmem and execstack.

Determine whether httpd can connect to port 80 for graceful shutdown.

Determine whether httpd can manage IPA content files.

Determine whether httpd can use mod_auth_ntlm_winbind.

Determine whether httpd can read generic user home content files.

Determine whether httpd can change its resource limits.

Determine whether httpd can run SSI executables in the same domain as system CGI scripts.

Determine whether httpd can communicate with the terminal. Needed for entering the passphrase for certificates at the terminal.

Determine whether httpd can have full access to its content types.

Determine whether httpd can use cifs file systems.

Determine whether httpd can use fuse file systems.

Determine whether httpd can use gpg.

Determine whether httpd can use nfs file systems.

APC UPS monitoring daemon.
Execute a domain transition to run apcupsd. Domain allowed to transition. Execute apcupsd server in the apcupsd domain. Domain allowed to transition. Read apcupsd PID files. Domain allowed access. Read apcupsd log files. Domain allowed access. Append apcupsd log files. Domain allowed access. Execute a domain transition to run httpd_apcupsd_cgi_script. Domain allowed to transition. All of the rules required to administrate an apcupsd environment. Domain allowed access. Role allowed access.
Advanced power management.
Execute apm in the apm domain. Domain allowed to transition. Execute apm in the apm domain and allow the specified role the apm domain. Domain allowed to transition. Role allowed access. Use apmd file descriptors. Domain allowed access. Write apmd unnamed pipes. Domain allowed access. Read and write to apmd unix stream sockets. Domain allowed access. Append apmd log files. Domain allowed access. Connect to apmd over an unix stream socket. Domain allowed access. All of the rules required to administrate an apm environment. Domain allowed access. Role allowed access.
Advanced package tool.
Execute apt programs in the apt domain. Domain allowed to transition. Execute the apt in the caller domain. Domain allowed access. Execute apt programs in the apt domain. Domain allowed to transition. Role allowed access. Use apt file descriptors. Domain allowed access. Do not audit attempts to use apt file descriptors. Domain to not audit. Read apt unnamed pipes. Domain allowed access. Read and write apt unnamed pipes. Domain allowed access. Read and write apt ptys. Domain allowed access. Read apt package cache content. Domain allowed access. Read apt package database content. Domain allowed access. Create, read, write, and delete apt package database content. Domain allowed access. Do not audit attempts to create, read, write, and delete apt package database content. Domain to not audit.
Ethernet activity monitor.
Execute arpwatch server in the arpwatch domain. Domain allowed to transition. Search arpwatch data file directories. Domain allowed access. Create, read, write, and delete arpwatch data files. Domain allowed access. Read and write arpwatch temporary files. Domain allowed access. Create, read, write, and delete arpwatch temporary files. Domain allowed access. Do not audit attempts to read and write arpwatch packet sockets. Domain to not audit. All of the rules required to administrate an arpwatch environment. Domain allowed access. Role allowed access.
Asterisk IP telephony server.
Execute asterisk in the asterisk domain. Domain allowed to transition. Execute asterisk in the caller domain. Domain allowed access. Connect to asterisk over a unix domain. stream socket. Domain allowed access. Set attributes of asterisk log files and directories. Domain allowed access. Set attributes of the asterisk PID content. Domain allowed access. All of the rules required to administrate an asterisk environment. Domain allowed access. Role allowed access.
Tool for non-root processes to bind to reserved ports.
Execute authbind in the authbind domain. Domain allowed to transition. Execute authbind in the authbind domain, and allow the specified role the authbind domain. Domain allowed to transition. Role allowed access.
Filesystem automounter service.
Execute automount in the automount domain. Domain allowed to transition. Send generic signals to automount. Domain allowed access. Execute automount in the caller domain. Domain allowed access. Read automount process state. Domain to allow access. Do not audit attempts to use automount file descriptors. Domain to not audit. Do not audit attempts to write automount unnamed pipes. Domain to not audit. Do not audit attempts to get attributes of automount temporary directories. Domain to not audit. All of the rules required to administrate an automount environment. Domain allowed access. Role allowed access.
mDNS/DNS-SD daemon implementing Apple ZeroConf architecture.
Execute avahi server in the avahi domain. Domain allowed to transition. Execute avahi init scripts in the init script domain. Domain allowed to transition. Send generic signals to avahi. Domain allowed access. Send kill signals to avahi. Domain allowed access. Send null signals to avahi. Domain allowed access. Send and receive messages from avahi over dbus. Domain allowed access. Connect to avahi using a unix stream socket. Domain allowed access. Create avahi pid directories. Domain allowed access. Set attributes of avahi pid directories. Domain allowed access. Create, read, and write avahi pid files. Domain allowed access. Do not audit attempts to search avahi pid directories. Domain to not audit. Create specified objects in generic pid directories with the avahi pid file type. Domain allowed access. Class of the object being created. The name of the object being created. All of the rules required to administrate an avahi environment. Domain allowed access. Role allowed access.
Log file analyzer for advanced statistics.
Execute the awstats program in the awstats domain. Domain allowed to transition. Read and write awstats unnamed pipes. (Deprecated) Domain allowed access. Execute awstats cgi scripts in the caller domain. (Deprecated) Domain allowed access.

Determine whether awstats can purge httpd log files.

System backup scripts.
Execute backup in the backup domain. Domain allowed to transition. Execute backup in the backup domain, and allow the specified role the backup domain. Domain allowed to transition. Role allowed access. Create, read, and write backup store files. Domain allowed access.
Cross platform network backup.
Execute bacula admin bacula admin domain. Domain allowed to transition. Execute user interfaces in the bacula admin domain, and allow the specified role the bacula admin domain. Domain allowed to transition. Role allowed access. All of the rules required to administrate an bacula environment. Domain allowed access. Role allowed access.
configuration management suite.
Execute bcfg2 in the bcfg2 domain. Domain allowed to transition. Execute bcfg2 server in the bcfg2 domain. Domain allowed to transition. Search bcfg2 lib directories. Domain allowed access. Read bcfg2 lib files. Domain allowed access. Create, read, write, and delete bcfg2 lib files. Domain allowed access. Create, read, write, and delete bcfg2 lib directories. Domain allowed access. All of the rules required to administrate an bcfg2 environment. Domain allowed access. Role allowed access.
Berkeley Internet name domain DNS server.
Execute bind init scripts in the init script domain. Domain allowed to transition. Execute ndc in the ndc domain. Domain allowed to transition. Send generic signals to bind. Domain allowed access. Send null signals to bind. Domain allowed access. Send kill signals to bind. Domain allowed access. Execute ndc in the ndc domain, and allow the specified role the ndc domain. Domain allowed to transition. Role allowed access. Execute bind in the named domain. Domain allowed to transition. Read dnssec key files. Domain allowed access. Read bind named configuration files. Domain allowed access. Write bind named configuration files. Domain allowed access. Create, read, write, and delete bind configuration directories. Domain allowed access. Search bind cache directories. Domain allowed access. Create, read, write, and delete bind cache files. Domain allowed access. Set attributes of bind pid directories. Domain allowed access. Set attributes of bind zone directories. Domain allowed access. Read bind zone files. Domain allowed access. Create, read, write, and delete bind zone files. Domain allowed access. Send and receive datagrams to and from named. (Deprecated) Domain allowed access. All of the rules required to administrate an bind environment. Domain allowed access. Role allowed access.

Determine whether Bind can bind tcp socket to http ports.

Determine whether Bind can write to master zone files. Generally this is used for dynamic DNS or zone transfers.

BIRD Internet Routing Daemon.
All of the rules required to administrate an bird environment. Domain allowed access. Role allowed access.
Tunnels instant messaging traffic to a virtual IRC channel.
Read bitlbee configuration files. Domain allowed access. All of the rules required to administrate an bitlbee environment. Domain allowed access. Role allowed access.
Tool to manage Bluetooth devices.
Execute blueman in the blueman domain. Domain allowed to transition. Send and receive messages from blueman over dbus. Domain allowed access. Search blueman lib directories. Domain allowed access. Read blueman lib files. Domain allowed access. Create, read, write, and delete blueman lib files. Domain allowed access.
Bluetooth tools and system services.
Role access for bluetooth. Role allowed access User domain for the role Connect to bluetooth over a unix domain stream socket. Domain allowed access. Execute bluetooth in the bluetooth domain. Domain allowed to transition. Read bluetooth configuration files. Domain allowed access. Send and receive messages from bluetooth over dbus. Domain allowed access. Execute bluetooth_helper in the bluetooth_helper domain. (Deprecated) Domain allowed to transition. Execute bluetooth_helper in the bluetooth_helper domain, and allow the specified role the bluetooth_helper domain. (Deprecated) Domain allowed to transition. Role allowed access. The type of the terminal allow the bluetooth_helper domain to use. Do not audit attempts to read bluetooth process state files. Domain to not audit. All of the rules required to administrate an bluetooth environment. Domain allowed access. Role allowed access.
Platform for computing using volunteered resources.
All of the rules required to administrate an boinc environment. Domain allowed access. Role allowed access.

Determine whether boinc can execmem/execstack.

Utilities for configuring the Linux ethernet bridge.
Execute a domain transition to run brctl. Domain allowed to transition. Execute brctl in the brctl domain, and allow the specified role the brctl domain. Domain allowed to transition. Role allowed access.
Bugtracker.
Search bugzilla directories. Domain allowed access. Do not audit attempts to read and write bugzilla script unix domain stream sockets. Domain to not audit. All of the rules required to administrate an bugzilla environment. Domain allowed access. Role allowed access.
CacheFiles user-space management daemon.
All of the rules required to administrate an cachefilesd environment. Domain allowed access. Role allowed access.
Squid log analysis.
Execute the calamaris in the calamaris domain. Domain allowed to transition. Execute calamaris in the calamaris domain, and allow the specified role the calamaris domain. Domain allowed to transition. Role allowed access. Read calamaris www files. Domain allowed access. All of the rules required to administrate an calamaris environment. Domain allowed access. Role allowed access.
PBX software.
Execute callweaver in the caller domain. Domain allowed access. Connect to callweaver over a unix stream socket. Domain allowed access. All of the rules required to administrate an callweaver environment. Domain allowed access. Role allowed access.
Kana-kanji conversion server.
Connect to Canna using a unix domain stream socket. Domain allowed access. All of the rules required to administrate an canna environment. Domain allowed access. Role allowed access.
Cluster Configuration System.
Execute a domain transition to run ccs. Domain allowed to transition. Connect to ccs over an unix stream socket. Domain allowed access. Read cluster configuration files. Domain allowed access. Create, read, write, and delete cluster configuration files. Domain allowed access. All of the rules required to administrate an ccs environment. Domain allowed access. Role allowed access.
Record audio or data Compact Discs from a master.
Role access for cdrecord. Role allowed access. User domain for the role.

Determine whether cdrecord can read various content. nfs, samba, removable devices, user temp and untrusted content files

Remote certificate distribution framework.
Execute a domain transition to run certmaster. Domain allowed to transition. Execute certmaster in the caller domain. Domain allowed access. read certmaster logs. Domain allowed access. Append certmaster log files. Domain allowed access. Create, read, write, and delete certmaster log content. Domain allowed access. All of the rules required to administrate an certmaster environment. Domain allowed access. Role allowed access.
Certificate status monitor and PKI enrollment client.
Execute a domain transition to run certmonger. Domain allowed to transition. Send and receive messages from certmonger over dbus. Domain allowed access. Execute certmonger server in the certmonger domain. Domain allowed to transition. Read certmonger PID files. Domain allowed access. Search certmonger lib directories. Domain allowed access. Read certmonger lib files. Domain allowed access. Create, read, write, and delete certmonger lib files. Domain allowed access. All of the rules required to administrate an certmonger environment. Domain allowed access. Role allowed access.
Digital Certificate Tracking.
Domain transition to certwatch. Domain allowed to transition. Execute certwatch in the certwatch domain, and allow the specified role the certwatch domain. backchannel. Domain allowed to transition. Role allowed access. Execute certwatch in the certwatch domain, and allow the specified role the certwatch domain, and use the caller's terminal. Has a sigchld backchannel. (Deprecated) Domain allowed to transition. Role allowed access. The type of the terminal allow the certwatch domain to use.
System administration tool for networks.
The template to define a cfengine domain.
Domain prefix to be used.
Read cfengine lib files. Domain allowed access. Do not audit attempts to write cfengine log files. Domain to not audit. All of the rules required to administrate an cfengine environment. Domain allowed access. Role allowed access.
libcg is a library that abstracts the control group file system in Linux.
Execute a domain transition to run CG Clear. Domain allowed to transition. Execute a domain transition to run CG config parser. Domain allowed to transition. Execute CG config init scripts in the init script domain. Domain allowed to transition. Execute a domain transition to run CG rules engine daemon. Domain allowed to transition. Execute a domain transition to run CG rules engine daemon. domain. Domain allowed to transition. Execute a domain transition to run CG Clear and allow the specified role the CG Clear domain. Domain allowed to transition. Role allowed access. Connect to CG rules engine daemon over unix stream sockets. Domain allowed access. All of the rules required to administrate an cgroup environment. Domain allowed access. Role allowed access.
Chrony NTP background daemon.
Execute chronyd in the chronyd domain. Domain allowed to transition. Execute chronyd server in the chronyd domain. Domain allowed to transition. Execute chronyd in the caller domain. Domain allowed access. Read chronyd log files. Domain allowed access. Read and write chronyd shared memory. Domain allowed access. Connect to chronyd using a unix domain stream socket. Domain allowed access. Send to chronyd using a unix domain datagram socket. Domain allowed access. Read chronyd key files. Domain allowed access. All of the rules required to administrate an chronyd environment. Domain allowed access. Role allowed access.
Encrypted tunnel daemon.
All of the rules required to administrate an cipe environment. Domain allowed access. Role allowed access.
ClamAV Virus Scanner.
Execute a domain transition to run clamd. Domain allowed to transition. Connect to clamd using a unix domain stream socket. Domain allowed access. Append clamav log files. Domain allowed access. Create, read, write, and delete clamav pid content. Domain allowed access. Read clamav configuration files. Domain allowed access. Search clamav library directories. Domain allowed access. Execute a domain transition to run clamscan. Domain allowed to transition. Execute clamscan in the caller domain. Domain allowed access. Read clamd process state files. Domain allowed access. All of the rules required to administrate an clamav environment. Domain allowed access. Role allowed access.

Determine whether clamscan can read user content files.

Determine whether clamscan can read all non-security files.

Determine whether can clamd use JIT compiler.

Clock speed measurement and manipulation.
Execute clockspeed utilities in the clockspeed_cli domain. Domain allowed to transition. Execute clockspeed utilities in the clockspeed cli domain, and allow the specified role the clockspeed cli domain. Domain allowed to transition. Role allowed access.
Clustered Mirror Log Server.
Execute a domain transition to run clogd. Domain allowed to transition. Connect to clogd over a unix domain stream socket. (Deprecated) Domain allowed access. Read and write clogd semaphores. Domain allowed access. Read and write clogd shared memory. Domain allowed access.
Cluster mirror log daemon.
Execute a domain transition to run cmirrord. Domain allowed to transition. Execute cmirrord server in the cmirrord domain. Domain allowed to transition. Read cmirrord PID files. Domain allowed access. Read and write cmirrord shared memory. Domain allowed access. All of the rules required to administrate an cmirrord environment. Domain allowed access. Role allowed access.
Cobbler installation server.
Execute a domain transition to run cobblerd. Domain allowed to transition. Execute cobblerd init scripts in the init script domain. Domain allowed to transition. Read cobbler configuration files. Domain allowed access. Do not audit attempts to read and write cobbler log files. Domain to not audit. Search cobbler lib directories. Domain allowed access. Read cobbler lib files. Domain allowed access. Create, read, write, and delete cobbler lib files. Domain allowed access. All of the rules required to administrate an cobbler environment. Domain allowed access. Role allowed access. All of the rules required to administrate an cobbler environment. Domain allowed access. Role allowed access.

Determine whether Cobbler can modify public files used for public file transfer services.

Determine whether Cobbler can connect to the network using TCP.

Determine whether Cobbler can access cifs file systems.

Determine whether Cobbler can access nfs file systems.

Statistics collection daemon for filling RRD files.
All of the rules required to administrate an collectd environment. Domain allowed access. Role allowed access.

Determine whether collectd can connect to the network using TCP.

GNOME color manager.
Execute a domain transition to run colord. Domain allowed access. Send and receive messages from colord over dbus. Domain allowed access. Read colord lib files. Domain allowed access.
Comsat, a biff server.
High-Throughput Computing System.
The template to define a condor domain.
Domain prefix to be used.
All of the rules required to administrate an condor environment. Domain allowed access. Role allowed access.

Determine whether Condor can connect to the network using TCP.

Framework for facilitating multiple user sessions on desktops.
Execute a domain transition to run consolekit. Domain allowed to transition. Send and receive messages from consolekit over dbus. Domain allowed access. Read consolekit log files. Domain allowed access. Create, read, write, and delete consolekit log files. Domain allowed access. Read consolekit PID files. Domain allowed access.
Corosync Cluster Engine.
Execute a domain transition to run corosync. Domain allowed to transition. Execute corosync init scripts in the init script domain. Domain allowed to transition. Execute corosync in the caller domain. Domain allowed access. Read corosync log files. Domain allowed access. Connect to corosync over a unix domain stream socket. Domain allowed access. Read and write corosync tmpfs files. Domain allowed access. All of the rules required to administrate an corosync environment. Domain allowed access. Role allowed access. All of the rules required to administrate an corosync environment. Domain allowed access. Role allowed access.
Document database server.
Read couchdb log files. Domain allowed access. Read, write, and create couchdb lib files. Domain allowed access. Read couchdb config files. Domain allowed access. Read couchdb pid files. Domain allowed access. All of the rules required to administrate an couchdb environment. Domain allowed access. Role allowed access.
Courier IMAP and POP3 email servers.
The template to define a courier domain.
Domain prefix to be used.
Execute the courier authentication daemon with a domain transition. Domain allowed to transition. Connect to courier-authdaemon over a unix stream socket. Domain allowed access. Execute the courier POP3 and IMAP server with a domain transition. Domain allowed to transition. Read courier config files. Domain allowed access. Create, read, write, and delete courier spool directories. Domain allowed access. Create, read, write, and delete courier spool files. Domain allowed access. Read courier spool files. Domain allowed access. Read and write courier spool pipes. Domain allowed access.
Services for loading CPU microcode and CPU frequency scaling.
CPUcontrol stub interface. No access allowed. Domain allowed access.
Command-line CPU frequency settings.
Send and receive messages from cpufreq-selector over dbus. Domain allowed access.
Periodic execution of scheduled commands.
The template to define a crontab domain.
Domain prefix to be used.
Role access for cron. Role allowed access. User domain for the role. Role access for unconfined cron. Role allowed access. User domain for the role. Role access for admin cron. Role allowed access. User domain for the role. Make the specified program domain accessable from the system cron jobs. The type of the process to transition to. The type of the file used as an entrypoint to this domain. Execute cron in the cron system domain. Domain allowed to transition. Execute crond in the caller domain. Domain allowed access. Execute crond server in the crond domain. Domain allowed to transition. Use crond file descriptors. Domain allowed access. Send child terminated signals to crond. Domain allowed access. Set the attributes of cron log files. Domain allowed access. Create cron log files. Domain allowed access. Write to cron log files. Domain allowed access. Create, read, write and delete cron log files. Domain allowed access. Create specified objects in generic log directories with the cron log file type. Domain allowed access. Class of the object being created. The name of the object being created. Read cron daemon unnamed pipes. Domain allowed access. Do not audit attempts to write cron daemon unnamed pipes. Domain to not audit. Read and write crond unnamed pipes. Domain allowed access. Read and write crond TCP sockets. Domain allowed access. Do not audit attempts to read and write cron daemon TCP sockets. Domain to not audit. Search cron spool directories. Domain allowed access. Create, read, write, and delete crond pid files. Domain allowed access. Execute anacron in the cron system domain. Domain allowed to transition. Use system cron job file descriptors. Domain allowed access. Read system cron job lib files. Domain allowed access. Create, read, write, and delete system cron job lib files. Domain allowed access. Write system cron job unnamed pipes. Domain allowed access. Read and write system cron job unnamed pipes. Domain allowed access. Read and write inherited system cron job unix domain stream sockets. Domain allowed access. Read system cron job temporary files. Domain allowed access. Do not audit attempts to append temporary system cron job files. Domain to not audit. Do not audit attempts to write temporary system cron job files. Domain to not audit. All of the rules required to administrate a cron environment. Domain allowed access. Role allowed access.

Determine whether system cron jobs can relabel filesystem for restoring file contexts.

Determine whether crond can execute jobs in the user domain as opposed to the the generic cronjob domain.

Determine whether extra rules should be enabled to support fcron.

Clustered Database based on Samba Trivial Database.
Create, read, write, and delete ctdbd lib files. Domain allowed access. Connect to ctdbd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an ctdb environment. Domain allowed access. Role allowed access.
Common UNIX printing system.
Create a domain which can be started by cupsd. Domain allowed to transition. Type of the program to be used as an entry point to this domain. Execute cups in the cups domain. Domain allowed to transition. Connect to cupsd over an unix domain stream socket. Domain allowed access. Connect to cups over TCP. (Deprecated) Domain allowed access. Send and receive messages from cups over dbus. Domain allowed access. Read cups PID files. Domain allowed access. Execute cups_config in the cups config domain. Domain allowed to transition. Send generic signals to the cups configuration daemon. Domain allowed access. Send and receive messages from cupsd_config over dbus. Domain allowed access. Read cups configuration files. Domain allowed access. Read cups-writable configuration files. Domain allowed access. Read cups log files. Domain allowed access. Append cups log files. Domain allowed access. Write cups log files. Domain allowed access. Connect to ptal over an unix domain stream socket. Domain allowed access. Read the process state (/proc/pid) of cupsd. Domain allowed access. All of the rules required to administrate an cups environment. Domain allowed access. Role allowed access.
Concurrent versions system.
Read CVS data and metadata content. Domain allowed access. Execute cvs in the caller domain. Domain allowed access. All of the rules required to administrate an cvs environment Domain allowed access. Role allowed access.

Determine whether cvs can read shadow password files.

Cyphesis WorldForge game server.
Execute a domain transition to run cyphesis. Domain allowed to transition. All of the rules required to administrate an cyphesis environment. Domain allowed access. Role allowed access.
Cyrus is an IMAP service intended to be run on sealed servers.
Create, read, write, and delete cyrus data files. Domain allowed access. Connect to Cyrus using a unix domain stream socket. Domain allowed access. All of the rules required to administrate an cyrus environment. Domain allowed access. Role allowed access.
Collection of tools for managing UNIX services.
An ipc channel between the supervised domain and svc_start_t. Domain allowed access. Create a domain which can be started by daemontools. Type to be used as a domain. Type of the program to be used as an entry point to this domain. Execute svc start in the svc start domain. Domain allowed to transition. Execute svc start in the svc start domain, and allow the specified role the svc start domain. Domain allowed to transition. Role allowed access. Execute avc run in the svc run domain. Domain allowed to transition. Send child terminated signals to svc run. Domain allowed access. Execute avc multilog in the svc multilog domain. Domain allowed to transition. Search svc svc directories. Domain allowed access. Read svc avc files. Domain allowed access. Create, read, write and delete svc svc content. Domain allowed access.
Dante msproxy and socks4/5 proxy server.
All of the rules required to administrate an dante environment. Domain allowed access. Role allowed access.
Database administrator role.
Change to the database administrator role. Role allowed access. Change from the database administrator role.

Change from the database administrator role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.

Determine whether dbadm can manage generic user files.

Determine whether dbadm can read generic user files.

Dictionary server for the SKK Japanese input method system.
Desktop messaging bus.
DBUS stub interface. No access allowed. Domain allowed access Role access for dbus. The prefix of the user role (e.g., user is the prefix for user_r). Role allowed access User domain for the role Template for creating connections to the system bus. Domain allowed access. Acquire service on DBUS session bus. Domain allowed access. Acquire service on all DBUS session busses. Domain allowed access. Acquire service on specified DBUS session bus. The prefix of the user role (e.g., user is the prefix for user_r). Domain allowed access. Creating connections to DBUS session bus. Domain allowed access. Creating connections to all DBUS session busses. Domain allowed access. Creating connections to specified DBUS session bus. The prefix of the user role (e.g., user is the prefix for user_r). Domain allowed access. Send messages to DBUS session bus. Domain allowed access. Send messages to all DBUS session busses. Domain allowed access. Send messages to specified DBUS session busses. The prefix of the user role (e.g., user is the prefix for user_r). Domain allowed access. Read dbus configuration content. Domain allowed access. Read system dbus lib files. Domain allowed access. Create, read, write, and delete system dbus lib files. Domain allowed access. Allow a application domain to be started by the specified session bus. The prefix of the user role (e.g., user is the prefix for user_r). Type to be used as a domain. Type of the program to be used as an entry point to this domain. Allow a application domain to be started by the specified session bus. Type to be used as a domain. Type of the program to be used as an entry point to this domain. Allow a application domain to be started by the specified session bus. The prefix of the user role (e.g., user is the prefix for user_r). Type to be used as a domain. Type of the program to be used as an entry point to this domain. Acquire service on the DBUS system bus. Domain allowed access. Send messages to the DBUS system bus. Domain allowed access. Unconfined access to DBUS system bus. Domain allowed access. Create a domain for processes which can be started by the DBUS system bus. Type to be used as a domain. Type of the program to be used as an entry point to this domain. Use and inherit DBUS system bus file descriptors. Domain allowed access. Do not audit attempts to read and write DBUS system bus TCP sockets. Domain to not audit. Unconfined access to DBUS. Domain allowed access.
Distributed checksum clearinghouse spam filtering.
Execute cdcc in the cdcc domain. Domain allowed to transition. Execute cdcc in the cdcc domain, and allow the specified role the cdcc domain. Domain allowed to transition. Role allowed access. Execute dcc client in the dcc client domain. Domain allowed to transition. Send generic signals to dcc client. Domain allowed access. Execute dcc client in the dcc client domain, and allow the specified role the dcc client domain. Domain allowed to transition. Role allowed access. Execute dbclean in the dcc dbclean domain. Domain allowed to transition. Execute dbclean in the dcc dbclean domain, and allow the specified role the dcc dbclean domain. Domain allowed to transition. Role allowed access. Connect to dccifd over a unix domain stream socket. Domain allowed access.
Update dynamic IP address at DynDNS.org.
Execute ddclient in the ddclient domain. Domain allowed to transition. Execute ddclient in the ddclient domain, and allow the specified role the ddclient domain. Domain allowed to transition. Role allowed access. All of the rules required to administrate an ddclient environment. Domain allowed access. Role allowed access.
ddcprobe retrieves monitor and graphics card information.
Execute ddcprobe in the ddcprobe domain. Domain allowed to transition. Execute ddcprobe in the ddcprobe domain, and allow the specified role the ddcprobe domain. Domain allowed to transition. Role allowed access.
SSH dictionary attack mitigation.
Execute a domain transition to run denyhosts. Domain allowed to transition. Execute denyhost server in the denyhost domain. Domain allowed to transition. All of the rules required to administrate an denyhosts environment. Domain allowed access. Role allowed access.
Devicekit modular hardware abstraction layer.
Execute a domain transition to run devicekit. Domain allowed to transition. Send to devicekit over a unix domain datagram socket. Domain allowed access. Send and receive messages from devicekit over dbus. Domain allowed access. Send and receive messages from devicekit disk over dbus. Domain allowed access. Send generic signals to devicekit power. Domain allowed access. Send and receive messages from devicekit power over dbus. Domain allowed access. Use and inherit devicekit power file descriptors. Domain allowed access. Append inherited devicekit log files. Domain allowed access. Create, read, write, and delete devicekit log files. Domain allowed access. Relabel devicekit log files. Domain allowed access. Read devicekit PID files. Domain allowed access. Create, read, write, and delete devicekit PID files. Domain allowed access. All of the rules required to administrate an devicekit environment. Domain allowed access. Role allowed access.
Dynamic host configuration protocol server.
Execute a domain transition to run dhcpd. Domain allowed to transition. Set attributes of dhcpd server state files. Domain allowed access. Execute dhcp server in the dhcp domain. Domain allowed to transition. All of the rules required to administrate an dhcpd environment. Domain allowed access. Role allowed access.

Determine whether DHCP daemon can use LDAP backends.

Dictionary daemon.
Use dictionary services by connecting over TCP. (Deprecated) Domain allowed access. All of the rules required to administrate an dictd environment. Domain allowed access. Role allowed access.
Server for managing and downloading certificate revocation lists.
All of the rules required to administrate an dirmngr environment. Domain allowed access. Role allowed access.
Distributed compiler daemon.
All of the rules required to administrate an distcc environment. Domain allowed access. Role allowed access.
Small and secure DNS daemon.
The template to define a djbdns domain.
Domain prefix to be used.
Search djbdns-tinydns key ring. Domain allowed access. Link djbdns-tinydns key ring. Domain allowed access.
DomainKeys Identified Mail milter.
All of the rules required to administrate an dkim environment. Domain allowed access. Role allowed access.
Decode DMI data for x86/ia64 bioses.
Execute dmidecode in the dmidecode domain. Domain allowed to transition. Execute dmidecode in the dmidecode domain, and allow the specified role the dmidecode domain. Domain allowed to transition. Role allowed access.
DNS forwarder and DHCP server.
Execute dnsmasq server in the dnsmasq domain. Domain allowed to transition. Execute the dnsmasq init script in the init script domain. Domain allowed to transition. Send generic signals to dnsmasq. Domain allowed access. Send null signals to dnsmasq. Domain allowed access. Send kill signals to dnsmasq. Domain allowed access. Read dnsmasq config files. Domain allowed access. Write dnsmasq config files. Domain allowed access. Delete dnsmasq pid files. Domain allowed access. Create, read, write, and delete dnsmasq pid files Domain allowed access. Read dnsmasq pid files. Domain allowed access. Create dnsmasq pid directories. Domain allowed access. Create specified objects in specified directories with a type transition to the dnsmasq pid file type. Domain allowed access. Directory to transition on. The object class of the object being created. The name of the object being created. All of the rules required to administrate an dnsmasq environment. Domain allowed access. Role allowed access.
Enables DNSSEC protection for DNS traffic.
All of the rules required to administrate an dnssec environment. Domain allowed access. Role allowed access.
POP and IMAP mail server.
Connect to dovecot using a unix domain stream socket. Domain allowed access. Connect to dovecot using a unix domain stream socket. Domain allowed access. Execute dovecot_deliver in the dovecot_deliver domain. Domain allowed to transition. Create, read, write, and delete dovecot spool files. Domain allowed access. Do not audit attempts to delete dovecot lib files. Domain to not audit. Write inherited dovecot tmp files. Domain to not audit. All of the rules required to administrate an dovecot environment. Domain allowed access. Role allowed access.
Debian package manager.
Execute dpkg programs in the dpkg domain. Domain allowed to transition. Execute the dkpg in the caller domain. Domain allowed access. Execute dpkg_script programs in the dpkg_script domain. Domain allowed to transition. Execute dpkg programs in the dpkg domain. Domain allowed to transition. Role allowed access. Inherit and use file descriptors from dpkg. Domain allowed access. Read from unnamed dpkg pipes. Domain allowed access. Read and write unnamed dpkg pipes. Domain allowed access. Inherit and use file descriptors from dpkg scripts. Domain allowed access. Read dpkg package database content. Domain allowed access. Create, read, write, and delete dpkg package database content. Domain allowed access. Do not audit attempts to create, read, write, and delete dpkg package database content. Domain to not audit. Create, read, write, and delete dpkg lock files. Domain allowed access.
Mirrors a block device over the network to another machine.
Execute a domain transition to run drbd. Domain allowed to transition. All of the rules required to administrate an drbd environment. Domain allowed access. Role allowed access.
Content-based spam filter designed for multi-user enterprise systems.
Execute a domain transition to run dspam. Domain allowed access. Connect to dspam using a unix domain stream socket. Domain allowed access. All of the rules required to administrate an dspam environment. Domain allowed access. Role allowed access.
Generate entropy from audio input.
All of the rules required to administrate an entropyd environment. Domain allowed access. Role allowed access.

Determine whether entropyd can use audio devices as the source for the entropy feeds.

Evolution email client.
Role access for evolution. Role allowed access. User domain for the role. Create objects in the evolution home directories with a private type. Domain allowed access. Private file type. Class of the object being created. The name of the object being created. Connect to evolution using a unix domain stream socket. Domain allowed access. Read evolution orbit temporary files. Domain allowed access. Send and receive messages from evolution over dbus. Domain allowed access. Send and receive messages from evolution_alarm over dbus. Domain allowed access.

Allow evolution to create and write user certificates in addition to being able to read them

Mail transfer agent.
Execute a domain transition to run exim. Domain allowed to transition. Execute exim in the exim domain, and allow the specified role the exim domain. Domain allowed to transition. Role allowed access. Do not audit attempts to read exim temporary tmp files. Domain to not audit. Read exim temporary files. Domain allowed access. Read exim pid files. Domain allowed access. Read exim log files. Domain allowed access. Append exim log files. Domain allowed access. Create, read, write, and delete exim log files. Domain allowed access. Create, read, write, and delete exim spool directories. Domain allowed access. Read exim spool files. Domain allowed access. Create, read, write, and delete exim spool files. Domain allowed access. Read exim var lib files. Domain allowed access. Create, read, and write exim var lib files. Domain allowed access. All of the rules required to administrate an exim environment. Domain allowed access. Role allowed access.

Determine whether exim can connect to databases.

Determine whether exim can read generic user content files.

Determine whether exim can create, read, write, and delete generic user content files.

Update firewall filtering to ban IP addresses with too many password failures.
Execute a domain transition to run fail2ban. Domain allowed to transition. Execute the fail2ban client in the fail2ban client domain. Domain allowed to transition. Execute fail2ban client in the fail2ban client domain, and allow the specified role the fail2ban client domain. Domain allowed to transition. Role allowed access. Connect to fail2ban over a unix domain stream socket. Domain allowed access. Read and write inherited temporary files. Domain allowed access. Do not audit attempts to use fail2ban file descriptors. Domain to not audit. Do not audit attempts to read and write fail2ban unix stream sockets Domain to not audit. Read and write fail2ban unix stream sockets. Domain allowed access. Read fail2ban lib files. Domain allowed access. Read fail2ban log files. Domain allowed access. Append fail2ban log files. Domain allowed access. Read fail2ban pid files. Domain allowed access. All of the rules required to administrate an fail2ban environment. Domain allowed access. Role allowed access.
Fibre Channel over Ethernet utilities.
Send to fcoemon with a unix dgram socket. Domain allowed access. All of the rules required to administrate an fcoemon environment. Domain allowed access. Role allowed access.
Remote-mail retrieval and forwarding utility.
All of the rules required to administrate an fetchmail environment. Domain allowed access. Role allowed access.
Finger user information service.
Execute fingerd in the fingerd domain. Domain allowed to transition. Connect to fingerd with a tcp socket. (Deprecated) Domain allowed access.
Service daemon with a D-BUS interface that provides a dynamic managed firewall.
Read firewalld configuration files. Domain allowed access. Send and receive messages from firewalld over dbus. Domain allowed access. Do not audit attempts to read, snd write firewalld temporary files. Domain to not audit. Read firewalld runtime files. Domain allowed access. All of the rules required to administrate an firewalld environment. Domain allowed access. Role allowed access.
system-config-firewall dbus system service.
Send and receive messages from firewallgui over dbus. Domain allowed access. Do not audit attempts to read and write firewallgui unnamed pipes. Domain to not audit.
Initial system configuration utility.
Execute firstboot in the firstboot domain. Domain allowed to transition. Execute firstboot in the firstboot domain, and allow the specified role the firstboot domain. Domain allowed to transition. Role allowed access. Inherit and use firstboot file descriptors. Domain allowed access. Do not audit attempts to inherit firstboot file descriptors. Domain to not audit. Write firstboot unnamed pipes. Domain allowed access. Read and Write firstboot unnamed pipes. Domain allowed access. Do not audit attemps to read and write firstboot unnamed pipes. Domain to not audit. Do not audit attemps to read and write firstboot unix domain stream sockets. Domain to not audit.
DBus fingerprint reader service.
Execute a domain transition to run fprintd. Domain allowed to transition. Send and receive messages from fprintd over dbus. Domain allowed access.
File transfer protocol service.
Execute a dyntransition to run anon sftpd. Domain allowed to transition. Connect to over ftpd over TCP. (Deprecated) Domain allowed access. Read ftpd configuration files. Domain allowed access. Execute FTP daemon entry point programs. Domain allowed access. Read ftpd log files. Domain allowed access. Execute the ftpdctl in the ftpdctl domain. Domain allowed to transition. Execute the ftpdctl in the ftpdctl domain, and allow the specified role the ftpctl domain. Domain allowed to transition. Role allowed access. Execute a dyntransition to run sftpd. Domain allowed to transition. All of the rules required to administrate an ftp environment. Domain allowed access. Role allowed access.

Determine whether ftpd can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Determine whether ftpd can login to local users and can read and write all files on the system, governed by DAC.

Determine whether ftpd can use CIFS used for public file transfer services.

Determine whether ftpd can use NFS used for public file transfer services.

Determine whether ftpd can connect to databases over the TCP network.

Determine whether ftpd can bind to all unreserved ports for passive mode.

Determine whether ftpd can connect to all unreserved ports.

Determine whether ftpd can read and write files in user home directories.

Determine whether sftpd can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Determine whether sftpd-can read and write files in user home directories.

Determine whether sftpd-can login to local users and read and write all files on the system, governed by DAC.

Determine whether sftpd can read and write files in user ssh home directories.

Various games.
Role access for games. Role allowed access. User domain for the role. Read and write games data files. games data. Domain allowed access.
OpenH.323 Voice-Over-IP Gatekeeper.
All of the rules required to administrate an gatekeeper environment. Domain allowed access. Role allowed access.
GNUstep distributed object mapper.
Read gdomap configuration files. Domain allowed access. All of the rules required to administrate an gdomap environment. Domain allowed access. Role allowed access.
Geoclue is a D-Bus service that provides location information.
Peer to peer file sharing tool.
Role access for gift. Role allowed access. User domain for the role.
GIT revision control system.
Role access for Git session.
Role allowed access.
User domain for the role.
Read generic system content files. Domain allowed access.

Determine whether Git CGI can search home directories.

Determine whether Git CGI can access cifs file systems.

Determine whether Git CGI can access nfs file systems.

Determine whether Git session daemon can bind TCP sockets to all unreserved ports.

Determine whether calling user domains can execute Git daemon in the git_session_t domain.

Determine whether Git session daemons can send syslog messages.

Determine whether Git system daemon can search home directories.

Determine whether Git system daemon can access cifs file systems.

Determine whether Git system daemon can access nfs file systems.

Tools for managing and hosting git repositories.
Execute a domain transition to run gitosis. Domain allowed to transition. Execute gitosis-serve in the gitosis domain, and allow the specified role the gitosis domain. Domain allowed to transition. Role allowed access. Read gitosis lib files. Domain allowed access. Create, read, write, and delete gitosis lib files. Domain allowed access.

Determine whether Gitosis can send mail.

OpenStack image registry and delivery service.
Execute a domain transition to run glance registry. Domain allowed to transition. Execute a domain transition to run glance api. Domain allowed to transition. Read glance log files. Domain allowed access. Append glance log files. Domain allowed access. Create, read, write, and delete glance log files. Domain allowed access. Search glance lib directories. Domain allowed access. Read glance lib files. Domain allowed access. Create, read, write, and delete glance lib files. Domain allowed access. Create, read, write, and delete glance lib directories. Domain allowed access. Read glance pid files. Domain allowed access. Create, read, write, and delete glance pid files. Domain allowed access. All of the rules required to administrate an glance environment. Domain allowed access. Role allowed access.
Cluster File System binary, daemon and command line.
All of the rules required to administrate an glusterfs environment. Domain allowed access. Role allowed access. All of the rules required to administrate an glusterfs environment. Domain allowed access. Role allowed access.
GNU network object model environment.
Role access for gnome. (Deprecated) Role allowed access. User domain for the role. The role template for gnome. The prefix of the user domain (e.g., user is the prefix for user_t). The role associated with the user domain. The type of the user domain. Execute gconf in the caller domain. Domain allowed access. Read gconf configuration content. Domain allowed access. Do not audit attempts to read inherited gconf configuration files. Domain to not audit. Create, read, write, and delete gconf configuration content. Domain allowed access. Connect to gconf using a unix domain stream socket. Domain allowed access. Run gconfd in gconfd domain. Domain allowed to transition. Create generic gnome home directories. Domain allowed access. Set attributes of generic gnome user home directories. (Deprecated) Domain allowed access. Set attributes of generic gnome user home directories. Domain allowed access. Read generic gnome user home content. (Deprecated) Domain allowed access. Read generic gnome home content. Domain allowed access. Create, read, write, and delete generic gnome user home content. (Deprecated) Domain allowed access. Create, read, write, and delete generic gnome home content. Domain allowed access. Search generic gnome home directories. Domain allowed access. Create objects in gnome user home directories with a private type. Domain allowed access. Private file type. Class of the object being created. The name of the object being created. Create generic gconf home directories. Domain allowed access. Read generic gconf home content. Domain allowed access. Create, read, write, and delete generic gconf home content. Domain allowed access. Search generic gconf home directories. Domain allowed access. Create objects in user home directories with the generic gconf home type. Domain allowed access. Class of the object being created. The name of the object being created. Create objects in user home directories with the generic gnome home type. Domain allowed access. Class of the object being created. The name of the object being created. Create objects in gnome gconf home directories with a private type. Domain allowed access. Private file type. Class of the object being created. The name of the object being created. Create objects in user home directories with the gstreamer orcexec type. Domain allowed access. Class of the object being created. The name of the object being created. Create objects in the user runtime directories with the gstreamer orcexec type. Domain allowed access. Class of the object being created. The name of the object being created. Read generic gnome keyring home files. Domain allowed access. Send and receive messages from gnome keyring daemon over dbus. The prefix of the user domain (e.g., user is the prefix for user_t). Domain allowed access. Send and receive messages from all gnome keyring daemon over dbus. Domain allowed access. Run all gkeyringd in gkeyringd domain. Domain allowed to transition. Connect to gnome keyring daemon with a unix stream socket. The prefix of the user domain (e.g., user is the prefix for user_t). Domain allowed access. Connect to all gnome keyring daemon with a unix stream socket. Domain allowed access. Manage gstreamer ORC optimized code. Domain allowed access. Mmap gstreamer ORC optimized code. Domain allowed access.
Gnome clock handler for setting the time.
Execute a domain transition to run gnomeclock. Domain allowed to transition. Execute gnomeclock in the gnomeclock domain, and allow the specified role the gnomeclock domain. Domain allowed to transition. Role allowed access. Send and receive messages from gnomeclock over dbus. Domain allowed access. Do not audit attempts to send and receive messages from gnomeclock over dbus. Domain to not audit.
Policy for GNU Privacy Guard and related programs.
Role access for gpg. Role allowed access. User domain for the role. Execute the gpg in the gpg domain. Domain allowed to transition. Execute the gpg in the caller domain. Domain allowed access. Execute gpg in a specified domain.

Execute gpg in a specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Execute gpg in the gpg web domain. (Deprecated) Domain allowed to transition. Make gpg executable files an entrypoint for the specified domain. The domain for which gpg_exec_t is an entrypoint. Send generic signals to gpg. Domain allowed access. Read and write gpg agent pipes. Domain allowed access. Connect to gpg agent socket Domain allowed access. Send messages to and from gpg pinentry over DBUS. Domain allowed access. List gpg user secrets. Domain allowed access.

Determine whether GPG agent can manage generic user home content files. This is required by the --write-env-file option.

General Purpose Mouse driver.
Connect to GPM over a unix domain stream socket. Domain allowed access. Get attributes of gpm control channel named sock files. Domain allowed access. Do not audit attempts to get attributes of gpm control channel named sock files. Domain to not audit. Set attributes of gpm control channel named sock files. Domain allowed access. All of the rules required to administrate an gpm environment. Domain allowed access. Role allowed access.
gpsd monitor daemon.
Execute a domain transition to run gpsd. Domain allowed to transition. Execute gpsd in the gpsd domain, and allow the specified role the gpsd domain. Domain allowed to transition. Role allowed access. Read and write gpsd shared memory. Domain allowed access. All of the rules required to administrate an gpsd environment. Domain allowed access. Role allowed access.
Least privledge terminal user role.
Change to the guest role. Role allowed access. Change from the guest role.

Change from the guest role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.
Software for reliable, scalable, distributed computing.
The template to define a hadoop domain.
Domain prefix to be used.
Role access for hadoop. Role allowed access. Domain allowed access. Execute hadoop in the hadoop domain. Domain allowed to transition. Receive from hadoop peer. Domain allowed access. Execute zookeeper client in the zookeeper client domain. Domain allowed to transition. Receive from zookeeper peer. Domain allowed access. Execute zookeeper server in the zookeeper server domain. Domain allowed to transition. Receive from zookeeper server peer. Domain allowed access. Execute zookeeper server in the zookeeper domain. Domain allowed to transition. Receive from datanode peer. Domain allowed access. Read hadoop configuration files. Domain allowed access. Execute hadoop configuration files. Domain allowed access. Receive from jobtracker peer. Domain allowed access. Match hadoop lan association. Domain allowed access. Receive from namenode peer. Domain allowed access. Receive from secondary namenode peer. Domain allowed access. Receive from tasktracker peer. Domain allowed access. All of the rules required to administrate an hadoop environment. Domain allowed access. Role allowed access.
Hardware abstraction layer.
Execute hal in the hal domain. Domain allowed to transition. Get attributes of hald processes. Domain allowed access. Read hal process state files. Domain allowed access. Trace hald processes. Domain allowed access. Inherit and use hald file descriptors. Domain allowed access. Do not audit attempts to inherited and use hald file descriptors. Domain to not audit. Read and write hald unnamed pipes. Domain allowed access. Do not audit attempts to read and write hald unnamed pipes. Domain to not audit. Send to hald over a unix domain datagram socket. Domain allowed access. Send to hald over a unix domain stream socket. Domain allowed access. Do not audit attempts to read and write hald unix datagram sockets. Domain to not audit. Send messages to hald over dbus. Domain allowed access. Send and receive messages from hald over dbus. Domain allowed access. Execute hal mac in the hal mac domain. Domain allowed to transition. Write hald log files. Domain allowed access. Do not audit attempts to write hald log files. Domain to not audit. Create, read, write, and delete hald log files. Domain allowed access. Read hald temporary files. Domain allowed access. Do not audit attempts to append hald libraries files. Domain to not audit. Read hald pid files. Domain allowed access. Read and write hald pid files. Domain allowed access. Create, read, write, and delete hald pid directories. Domain allowed access. Create, read, write, and delete hald pid files. Domain allowed access.
Hard disk temperature tool running as a daemon.
Execute a domain transition to run hddtemp. Domain allowed to transition. Execute hddtemp in the caller domain. Domain allowed access. All of the rules required to administrate an hddtemp environment. Domain allowed access. Role allowed access.
Port of Apple Rendezvous multicast DNS.
Send generic signals to howl. Domain allowed access. All of the rules required to administrate an howl environment. Domain allowed access. Role allowed access.
Dump topology and locality information from hardware tables.
Execute hwloc dhwd in the hwloc dhwd domain. Domain allowed to transition. Execute hwloc dhwd in the hwloc dhwd domain, and allow the specified role the hwloc dhwd domain, Domain allowed to transition. Role allowed access. Execute hwloc dhwd in the caller domain. Domain allowed access. Read hwloc runtime files. Domain allowed access. All of the rules required to administrate an hwloc environment. Domain allowed access.
HyperV key value pair (KVP).
All of the rules required to administrate an hypervkvp environment. Domain allowed access. Role allowed access.
IIIMF htt server.
Use i18n_input over a TCP connection. (Deprecated) Domain allowed access. All of the rules required to administrate an i18n input environment. Domain allowed access. Role allowed access.
ShoutCast compatible streaming media server.
Execute a domain transition to run icecast. Domain allowed to transition. Send generic signals to icecast. Domain allowed access. Execute icecast server in the icecast domain. Domain allowed to transition. Read icecast pid files. Domain allowed access. Create, read, write, and delete icecast pid files. Domain allowed access. Read icecast log files. Domain allowed access. Append icecast log files. Domain allowed access. Create, read, write, and delete icecast log files. Domain allow access. All of the rules required to administrate an icecast environment. Domain allowed access. Role allowed access.

Determine whether icecast can listen on and connect to any TCP port.

Bring up/down ethernet interfaces based on cable detection.
Execute a domain transition to run ifplugd. Domain allowed to transition. Send generic signals to ifplugd. Domain allowed access. Read ifplugd configuration files. Domain allowed access. Create, read, write, and delete ifplugd configuration content. Domain allowed access. Read ifplugd pid files. Domain allowed access. All of the rules required to administrate an ifplugd environment. Domain allowed access. Role allowed access.
iMaze game server.
Internet services daemon.
Define the specified domain as a inetd service.

Define the specified domain as a inetd service. The inetd_service_domain(), inetd_tcp_service_domain(), or inetd_udp_service_domain() interfaces should be used instead of this interface, as this interface only provides the common rules to these three interfaces.

The type associated with the inetd service process. The type associated with the process program. Define the specified domain as a TCP inetd service. The type associated with the inetd service process. The type associated with the process program. Define the specified domain as a UDP inetd service. The type associated with the inetd service process. The type associated with the process program. Define the specified domain as a TCP and UDP inetd service. The type associated with the inetd service process. The type associated with the process program. Inherit and use inetd file descriptors. Domain allowed access. Connect to the inetd service using a TCP connection. (Deprecated) Domain allowed access. Run inetd child process in the inet child domain. Domain allowed to transition. Send UDP network traffic to inetd. (Deprecated) Domain allowed access. Read and write inetd TCP sockets. Domain allowed access.
Internet News NNTP server.
Execute innd in the caller domain. Domain allowed access. Execute inn configuration files. Domain allowed access. Create, read, write, and delete innd log files. Domain allowed access. Create specified objects in generic log directories with the innd log file type. Domain allowed access. Class of the object being created. The name of the object being created. Create, read, write, and delete innd pid content. Domain allowed access. Read innd configuration content. Domain allowed access. Read innd news library content. Domain allowed access. Read innd news spool content. Domain allowed access. Send to a innd unix dgram socket. Domain allowed access. Execute innd in the innd domain. Domain allowed to transition. All of the rules required to administrate an inn environment. Domain allowed access. Role allowed access.
IP over DNS tunneling daemon.
All of the rules required to administrate an iodined environment Domain allowed access. Role allowed access. All of the rules required to administrate an iodined environment Domain allowed access. Role allowed access.
IRC client policy.
Role access for IRC. Role allowed access. User domain for the role.

Determine whether irc clients can listen on and connect to any unreserved TCP ports.

IRC servers.
All of the rules required to administrate an ircd environment. Domain allowed access. Role allowed access.
IRQ balancing daemon.
All of the rules required to administrate an irqbalance environment. Domain allowed access. Role allowed access.
Establish connections to iSCSI devices.
Execute a domain transition to run iscsid. Domain allowed to transition. Create, read, write, and delete iscsid sempaphores. Domain allowed access. Connect to iscsid using a unix domain stream socket. Domain allowed access. Read iscsid lib files. Domain allowed access. All of the rules required to administrate an iscsi environment. Domain allowed access. Role allowed access.
Internet Storage Name Service.
All of the rules required to administrate an isnsd environment. Domain allowed access. Role allowed access.
Jabber instant messaging servers.
The template to define a jabber domain.
Domain prefix to be used.
Create, read, write, and delete jabber lib files. Domain allowed access. Connect to jabber over a TCP socket (Deprecated) Domain allowed access. All of the rules required to administrate an jabber environment. Domain allowed access. Role allowed access.
Java virtual machine
Role access for java. Role allowed access. User domain for the role. The role template for the java module.

This template creates a derived domains which are used for java applications.

The prefix of the user domain (e.g., user is the prefix for user_t). The role associated with the user domain. The type of the user domain. Execute the java program in the java domain. Domain allowed to transition. Execute java in the java domain, and allow the specified role the java domain. Domain allowed to transition. Role allowed access. Execute the java program in the unconfined java domain. Domain allowed to transition. Execute the java program in the unconfined java domain and allow the specified role the java domain. Domain allowed to transition. Role allowed access. Execute the java program in the callers domain. Domain allowed access. Create, read, write, and delete generic java home content. Domain allowed access. Create specified objects in user home directories with the generic java home type. Domain allowed access. Class of the object being created. The name of the object being created.

Determine whether java can make its stack executable.

Jockey driver manager.
Kernel crash dumping mechanism.
Execute kdump in the kdump domain. Domain allowed to transition. Execute kdump init scripts in the init script domain. Domain allowed to transition. Read kdump configuration files. Domain allowed access. Create, read, write, and delete kdmup configuration files. Domain allowed access. All of the rules required to administrate an kdump environment. Domain allowed access. Role allowed access.
System-config-kdump GUI.
MIT Kerberos admin and KDC.
Role access for kerberos.
Role allowed access.
User domain for the role.
Execute kadmind in the caller domain. Domain allowed access. Execute a domain transition to run kpropd. Domain allowed to transition. Support kerberos services. Domain allowed access. Read kerberos configuration files. Domain allowed access. Do not audit attempts to write kerberos configuration files. Domain to not audit. Read and write kerberos configuration files. Domain allowed access. Create, read, write, and delete kerberos home files. Domain allowed access. Relabel kerberos home files. Domain allowed access. Create objects in user home directories with the krb5 home type. Domain allowed access. Class of the object being created. The name of the object being created. Read kerberos key table files. Domain allowed access. Read and write kerberos key table files. Domain allowed access. Create, read, write, and delete kerberos key table files. Domain allowed access. Create specified objects in generic etc directories with the kerberos keytab file type. Domain allowed access. Class of the object being created. The name of the object being created. Create a derived type for kerberos keytab files. The prefix to be used for deriving type names. Domain allowed access. Read kerberos kdc configuration files. Domain allowed access. Create, read, write, and delete kerberos host rcache files. Domain allowed access. Create objects in generic temporary directories with the kerberos host rcache type. Domain allowed to transition. Class of the object being created. The name of the object being created. Connect to krb524 service. Domain allowed access. All of the rules required to administrate an kerberos environment. Domain allowed access. Role allowed access.

Determine whether kerberos is supported.

Service for reporting kernel oopses to kerneloops.org.
Execute a domain transition to run kerneloops. Domain allowed to transition. Send and receive messages from kerneloops over dbus. Domain allowed access. Do not audit attempts to Send and receive messages from kerneloops over dbus. Domain to not audit. Create, read, write, and delete kerneloops temporary files. Domain allowed access. All of the rules required to administrate an kerneloops environment. Domain allowed access. Role allowed access.
Xorg.conf keyboard layout callout.
Read keyboardd unnamed pipes. Domain allowed access.
Python implementation of the OpenStack identity service API.
All of the rules required to administrate an keystone environment. Domain allowed access. Role allowed access.
IEEE 802.11 wireless LAN sniffer.
Role access for kismet.
Role allowed access.
User domain for the role.
Execute a domain transition to run kismet. Domain allowed to transition. Execute kismet in the kismet domain, and allow the specified role the kismet domain. Domain allowed to transition. Role allowed access. Read kismet pid files. Domain allowed access. Create, read, write, and delete kismet pid files. Domain allowed access. Search kismet lib directories. Domain allowed access. Read kismet lib files. Domain allowed access. Create, read, write, and delete kismet lib files. Domain allowed access. Create, read, write, and delete kismet lib content. Domain allowed access. Read kismet log files. Domain allowed access. Append kismet log files. Domain allowed access. Create, read, write, and delete kismet log content. Domain allowed access. All of the rules required to administrate an kismet environment. Domain allowed access. Role allowed access.
Kernel Samepage Merging Tuning Daemon.
Execute a domain transition to run ksmtuned. Domain allowed to transition. Execute ksmtuned server in the ksmtuned domain. Domain allowed to transition. All of the rules required to administrate an ksmtuned environment. Domain allowed access. Role allowed access.
KDE Talk daemon.
Hardware detection and configuration tools.
Execute kudzu in the kudzu domain. Domain allowed to transition. Execute kudzu in the kudzu domain, and allow the specified role the kudzu domain. Domain allowed to transition. Role allowed access. Get attributes of kudzu executable files. Domain allowed access. All of the rules required to administrate an kudzu environment. Domain allowed access. Role allowed access.
Layer 2 Tunneling Protocol.
Send to l2tpd with a unix domain dgram socket. Domain allowed access. Read and write l2tpd sockets. Domain allowed access. Connect to l2tpd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an l2tp environment. Domain allowed access. Role allowed access.
OpenLDAP directory server.
List ldap database directories. Domain allowed access. Read ldap configuration files. Domain allowed access. Use LDAP over TCP connection. (Deprecated) Domain allowed access. Connect to slapd over an unix stream socket. Domain allowed access. Connect to ldap over the network. Domain allowed access. All of the rules required to administrate an ldap environment. Domain allowed access. Role allowed access.
Log analyzer for squid proxy.
Execute the lightsquid program in the lightsquid domain. Domain allowed to transition. Execute lightsquid in the lightsquid domain, and allow the specified role the lightsquid domain. Domain allowed to transition. Role allowed access. All of the rules required to administrate an lightsquid environment. Domain allowed access. Role allowed access.
Likewise Active Directory support for UNIX.
The template to define a likewise domain.
The type of daemon to be used.
Connect to lsassd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an likewise environment. Domain allowed access. Role allowed access.
Linux infared remote control daemon.
Execute a domain transition to run lircd. Domain allowed to transition. Connect to lircd over a unix domain stream socket. Domain allowed access. Read lircd etc files. Domain allowed access. All of the rules required to administrate a lircd environment. Domain allowed access. Role allowed access.
Tool for building alternate livecd for different os and policy versions.
Execute a domain transition to run livecd. Domain allowed to transition. Execute livecd in the livecd domain, and allow the specified role the livecd domain. Domain allowed to transition. Role allowed access. Read livecd temporary files. Domain allowed access. Read and write livecd temporary files. Domain allowed access. Read and write livecd semaphores. Domain allowed access.
Intel LLDP Agent.
Send to lldpad with a unix dgram socket. Domain allowed access. All of the rules required to administrate an lldpad environment. Domain allowed access. Role allowed access.
Load keyboard mappings.
Execute the loadkeys program in the loadkeys domain. Domain allowed to transition. Execute the loadkeys program in the loadkeys domain, and allow the specified role the loadkeys domain. Domain allowed to transition. Role allowed access. Execute the loadkeys in the caller domain. Domain allowed access.
Library for locking devices.
Role access for lockdev. Role allowed access. User domain for the role.
Rotates, compresses, removes and mails system log files.
Execute logrotate in the logrotate domain. Domain allowed to transition. Execute logrotate in the logrotate domain, and allow the specified role the logrotate domain. Domain allowed to transition. Role allowed access. Execute logrotate in the caller domain. Domain allowed access. Inherit and use logrotate file descriptors. Domain allowed access. Do not audit attempts to inherit logrotate file descriptors. Domain to not audit. Read logrotate temporary files. Domain allowed access.
System log analyzer and reporter.
Read logwatch temporary files. Domain allowed access. Search logwatch cache directories. Domain allowed access.

Determine whether logwatch can connect to mail over the network.

Line printer daemon.
Role access for lpd. Role allowed access. User domain for the role. Execute lpd in the lpd domain. Domain allowed to transition. Execute amrecover in the lpd domain, and allow the specified role the lpd domain. Domain allowed to transition. Role allowed access. List printer spool directories. Domain allowed access. Read printer spool files. Domain allowed access. Create, read, write, and delete printer spool content. Domain allowed access. Relabel spool files. Domain allowed access. Read printer configuration files. Domain allowed access. Transition to a user lpr domain. Domain allowed to transition. Execute lpr in the lpr domain, and allow the specified role the lpr domain. Domain allowed to transition. Role allowed access. Execute lpr in the caller domain. Domain allowed access.

Determine whether to support lpd server.

Storage array management library.
All of the rules required to administrate an lsmd environment. Domain allowed access. Role allowed access.
Manage electronic mail discussion and e-newsletter lists.
The template to define a mailman domain.
Domain prefix to be used.
Execute mailman in the mailman domain. Domain allowed to transition. Execute the mailman program in the mailman domain and allow the specified role the mailman domain. Domain allowed to transition. Role allowed access. Execute mailman CGI scripts in the mailman CGI domain. Domain allowed to transition. Execute mailman in the caller domain. Domain allowd access. Send generic signals to mailman cgi. Domain allowed access. Search mailman data directories. Domain allowed access. Read mailman data content. Domain allowed access. Create, read, write, and delete mailman data files. Domain allowed access. List mailman data directories. Domain allowed access. Read mailman data symbolic links. Domain allowed access. Read mailman log files. Domain allowed access. Append mailman log files. Domain allowed access. Create, read, write, and delete mailman log content. Domain allowed access. Read mailman archive content. Domain allowed access. Execute mailman_queue in the mailman_queue domain. Domain allowed to transition.
E-mail security and anti-spam package for e-mail gateway systems.
Create, read, write, and delete mscan spool content. Domain allowed access. All of the rules required to administrate an mscan environment Domain allowed access. Role allowed access.
A Unix manpage-to-HTML converter.
On-line manual database.
Execute the mandb program in the mandb domain. Domain allowed to transition. Execute mandb in the mandb domain, and allow the specified role the mandb domain. Domain allowed to transition. Role allowed access. Search mandb cache directories. Domain allowed access. Delete mandb cache content. Domain allowed access. Read mandb cache content. Domain allowed access. Create, read, write, and delete mandb cache files. Domain allowed access. All of the rules required to administrate an mandb environment. Domain allowed access. Role allowed access.
Linux hardware error daemon.
Execute a domain transition to run mcelog. Domain allowed to transition. All of the rules required to administrate an mcelog environment. Domain allowed access. Role allowed access.

Determine whether mcelog supports client mode.

Determine whether mcelog can execute scripts.

Determine whether mcelog can use all the user ttys.

Determine whether mcelog supports server mode.

Determine whether mcelog can use syslog.

Open source wiki package written in PHP.
High-performance memory object caching system.
Execute a domain transition to run memcached. Domain allowed to transition. Create, read, write, and delete memcached pid files. Domain allowed access. Read memcached pid files. Domain allowed access. Connect to memcached using a unix domain stream socket. Domain allowed access. Connect to memcache over the network. Domain allowed access. All of the rules required to administrate an memcached environment. Domain allowed access. Role allowed access.
Milter mail filters.
The template to define a milter domain.
Domain prefix to be used.
connect to all milter domains using a unix domain stream socket. Domain allowed access. Get attributes of all milter sock files. Domain allowed access. Create, read, write, and delete spamassissin milter data content. Domain allowed access.
MiniDLNA lightweight DLNA/UPnP media server
All of the rules required to administrate an minidlna environment. Domain allowed access. Role allowed access. Execute minidlna init scripts in the initrc domain. Domain allowed to transition.

Determine whether minidlna can read generic user content.

Daemon used by MiniUPnPc to speed up device discoveries.
Read minissdpd configuration files. Domain allowed access. All of the rules required to administrate an minissdpd environment. Domain allowed access. Role allowed access.
Provides a DBus interface to communicate with mobile broadband (GSM, CDMA, UMTS, ...) cards.
Execute a domain transition to run modemmanager. Domain allowed to transition. Send and receive messages from modemmanager over dbus. Domain allowed access.
MojoMojo Wiki.
All of the rules required to administrate an mojomojo environment. Domain allowed access. Role allowed access.
Scalable, high-performance, open source NoSQL database.
All of the rules required to administrate an mongodb environment. Domain allowed access. Role allowed access.
Run .NET server and client applications on Linux.
The role template for the mono module.

This template creates a derived domains which are used for mono applications.

The prefix of the user domain (e.g., user is the prefix for user_t).
The role associated with the user domain.
The type of the user domain.
Execute mono in the mono domain. Domain allowed to transition. Execute mono in the mono domain, and allow the specified role the mono domain. Domain allowed to transition. Role allowed access. Execute mono in the caller domain. Domain allowed access. Read and write mono shared memory. Domain allowed access.
Monopoly daemon.
All of the rules required to administrate an monop environment. Domain allowed access. Role allowed access.
Policy for Mozilla and related web browsers.
Role access for mozilla. Role allowed access. User domain for the role. Role access for mozilla plugin. Role allowed access. User domain for the role. Read mozilla home directory content. Domain allowed access. Write mozilla home directory files. Domain allowed access. Do not audit attempts to read and write mozilla home directory files. Domain to not audit. Do not audit attempt to Create, read, write, and delete mozilla home directory content. Domain to not audit. Execute mozilla home directory files. (Deprecated) Domain allowed access. Execute mozilla plugin home directory files. Domain allowed access. Mozilla home directory file text relocation. (Deprecated) Domain allowed access. Mozilla plugin home directory file text relocation. Domain allowed access. Run mozilla in the mozilla domain. Domain allowed to transition. Execute a domain transition to run mozilla plugin. Domain allowed to transition. Execute mozilla plugin in the mozilla plugin domain, and allow the specified role the mozilla plugin domain. Domain allowed to transition. Role allowed access. Execute a domain transition to run mozilla plugin config. Domain allowed to transition. Execute mozilla plugin config in the mozilla plugin config domain, and allow the specified role the mozilla plugin config domain. Domain allowed to transition. Role allowed access. Send and receive messages from mozilla over dbus. Domain allowed access. Send and receive messages from mozilla plugin over dbus. Domain allowed access. Read and write mozilla TCP sockets. Domain allowed access. Create, read, write, and delete mozilla plugin rw files. Domain allowed access. Read mozilla_plugin tmpfs files. Domain allowed access. Delete mozilla_plugin tmpfs files. Domain allowed access. Create, read, write, and delete generic mozilla plugin home content. Domain allowed access. Create objects in user home directories with the generic mozilla plugin home type. Domain allowed access. Class of the object being created. The name of the object being created.

Determine whether mozilla can make its stack executable.

Music Player Daemon.
Role access for mpd.
Role allowed access.
User domain for the role.
Execute a domain transition to run mpd. Domain allowed to transition. Execute mpd server in the mpd domain. Domain allowed to transition. Read mpd data files. Domain allowed access. Create, read, write, and delete mpd data files. Domain allowed access. Create, read, write, and delete mpd user data content. Domain allowed access. Relabel mpd user data content. Domain allowed access. Create objects in user home directories with the mpd user data type. Domain allowed access. Class of the object being created. The name of the object being created. Read mpd tmpfs files. Domain allowed access. Create, read, write, and delete mpd tmpfs files. Domain allowed access. Search mpd lib directories. Domain allowed access. Read mpd lib files. Domain allowed access. Create, read, write, and delete mpd lib files. Domain allowed access. Create specified objects in mpd lib directories with a private type. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Create, read, write, and delete mpd lib dirs. Domain allowed access. All of the rules required to administrate an mpd environment. Domain allowed access. Role allowed access.

Determine whether mpd can traverse user home directories.

Determine whether mpd can use cifs file systems.

Determine whether mpd can use nfs file systems.

Mplayer media player and encoder.
Role access for mplayer Role allowed access User domain for the role Run mplayer in mplayer domain. Domain allowed to transition. Execute mplayer in the caller domain. Domain allowed access. Read mplayer user home content files. Domain allowed access. Create, read, write, and delete generic mplayer home content. Domain allowed access. Create specified objects in user home directories with the generic mplayer home type. Domain allowed access. Class of the object being created. The name of the object being created.

Determine whether mplayer can make its stack executable.

Network traffic graphing.
Create and append mrtg log files. Domain allowed access. All of the rules required to administrate an mrtg environment. Domain allowed access. Role allowed access.
Common e-mail transfer agent policy.
MTA stub interface. No access allowed. Domain allowed access. The template to define a mail domain. Domain prefix to be used. Role access for mta. Role allowed access. User domain for the role. Make the specified domain usable for a mail server. Type to be used as a mail server domain. Type of the program to be used as an entry point to this domain. Make the specified type a MTA executable file. Type to be used as a mail client. Read mta mail home files. Domain allowed access. Create, read, write, and delete mta mail home files. Domain allowed access. Create specified objects in user home directories with the generic mail home type. Domain allowed access. Class of the object being created. The name of the object being created. Create, read, write, and delete mta mail home rw content. Domain allowed access. Create specified objects in user home directories with the generic mail home rw type. Domain allowed access. Class of the object being created. The name of the object being created. Make the specified type by a system MTA. Type to be used as a mail client. Modified mailserver interface for sendmail daemon use.

A modified MTA mail server interface for the sendmail program. It's design does not fit well with policy, and using the regular interface causes a type_transition conflict if direct running of init scripts is enabled.

This interface should most likely only be used by the sendmail policy.

The type to be used for the mail server. Make a type a mailserver type used for sending mail. Mail server domain type used for sending mail. Make a type a mailserver type used for delivering mail to local users. Mail server domain type used for delivering mail. Make a type a mailserver type used for sending mail on behalf of local users to the local mail spool. Mail server domain type used for sending local mail. Send mail from the system. Domain allowed to transition. Execute send mail in a specified domain.

Execute send mail in a specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Send signals to system mail. Domain allowed access. Send kill signals to system mail. Domain allowed access. Execute sendmail in the caller domain. Domain allowed access. Read mail server configuration content. Domain allowed access. Write mail server configuration files. Domain allowed access. Read mail address alias files. Domain allowed access. Create, read, write, and delete mail address alias content. Domain allowed access. Create specified object in generic etc directories with the mail address alias type. Domain allowed access. The object class of the object being created. The name of the object being created. Create specified objects in specified directories with a type transition to the mail address alias type. Domain allowed access. Directory to transition on. The object class of the object being created. The name of the object being created. Read and write mail alias files. Domain allowed access. Do not audit attempts to read and write TCP sockets of mail delivery domains. Domain to not audit. Connect to all mail servers over TCP. (Deprecated) Domain allowed access. Do not audit attempts to read mail spool symlinks. Domain to not audit. Get attributes of mail spool content. Domain allowed access. Do not audit attempts to get attributes of mail spool files. Domain to not audit. Create specified objects in the mail spool directory with a private type. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Read mail spool files. Domain allowed access. Read and write mail spool files. Domain allowed access. Create, read, and write mail spool files. Domain allowed access. Delete mail spool files. Domain allowed access. Create, read, write, and delete mail spool content. Domain allowed access. Create specified objects in the mail queue spool directory with a private type. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Search mail queue directories. Domain allowed access. List mail queue directories. Domain allowed access. Read mail queue files. Domain allowed access. Do not audit attempts to read and write mail queue content. Domain to not audit. Create, read, write, and delete mail queue content. Domain allowed access. Read sendmail binary. Domain allowed access. Read and write unix domain stream sockets of all base mail domains. Domain allowed access.
Munin network-wide load graphing.
The template to define a munin plugin domain.
Domain prefix to be used.
Connect to munin over a unix domain stream socket. Domain allowed access. Read munin configuration content. Domain allowed access. Append munin log files. Domain allowed access. Search munin library directories. Domain allowed access. Do not audit attempts to search munin library directories. Domain to not audit. All of the rules required to administrate an munin environment. Domain allowed access. Role allowed access.
Open source database.
Role access for mysql. Role allowed access. User domain for the role. Execute MySQL in the mysql domain. Domain allowed to transition. Execute mysqld in the mysqld domain, and allow the specified role the mysqld domain. Domain allowed to transition. Role allowed access. Send generic signals to mysqld. Domain allowed access. Connect to mysqld with a tcp socket. Domain allowed access. Connect to mysqld with a unix Domain allowed access. Read mysqld configuration content. Domain allowed access. Search mysqld db directories. Domain allowed access. Read and write mysqld database directories. Domain allowed access. Create, read, write, and delete mysqld database directories. Domain allowed access. Append mysqld database files. Domain allowed access. Read and write mysqld database files. Domain allowed access. Create, read, write, and delete mysqld database files. Domain allowed access. Read and write mysqld database sockets. named socket. Domain allowed access. Create, read, write, and delete mysqld home files. Domain allowed access. Relabel mysqld home files. Domain allowed access. Create objects in user home directories with the mysqld home type. Domain allowed access. Class of the object being created. The name of the object being created. Write mysqld log files. Domain allowed access. Execute mysqld safe in the mysqld safe domain. Domain allowed to transition. Read mysqld pid files. Domain allowed access. Search mysqld pid files. Domain allowed access. All of the rules required to administrate an mysqld environment. Domain allowed access. Role allowed access.

Determine whether mysqld can connect to all TCP ports.

Network monitoring server.
The template to define a nagios plugin domain.
Domain prefix to be used.
Do not audit attempts to read or write nagios unnamed pipes. Domain to not audit. Read nagios configuration content. Domain allowed access. Read nagios log files. Domain allowed access. Do not audit attempts to read or write nagios log files. Domain to not audit. Search nagios spool directories. Domain allowed access. Read nagios temporary files. Domain allowed access. Execute nrpe with a domain transition. Domain allowed to transition. All of the rules required to administrate an nagios environment. Domain allowed access. Role allowed access.
Cross-platform network configuration library.
Execute a domain transition to run ncftool. Domain allowed to transition. Execute ncftool in the ncftool domain, and allow the specified role the ncftool domain. Domain allowed access Role allowed access.
Network scanning daemon.
Connect to nessus over a TCP socket (Deprecated) Domain allowed access. All of the rules required to administrate an nessus environment. Domain allowed access. Role allowed access.
Manager for dynamically switching between networks.
Read and write networkmanager udp sockets. Domain allowed access. Read and write networkmanager packet sockets. Domain allowed access. Relabel networkmanager tun socket. Domain allowed access. Read and write networkmanager netlink routing sockets. Domain allowed access. Execute networkmanager with a domain transition. Domain allowed to transition. Execute networkmanager scripts with an automatic domain transition to initrc. Domain allowed to transition. Send and receive messages from networkmanager over dbus. Domain allowed access. Read metworkmanager process state files. Domain allowed access. Send generic signals to networkmanager. Domain allowed access. Create, read, and write networkmanager library files. Domain allowed access. Read networkmanager lib files. Domain allowed access. Append networkmanager log files. Domain allowed access. Read networkmanager pid files. Domain allowed access. Connect to networkmanager over a unix domain stream socket. Domain allowed access. All of the rules required to administrate an networkmanager environment. Domain allowed access. Role allowed access.
Policy for NIS (YP) servers and clients.
Use the ypbind service to access NIS services unconditionally.

Use the ypbind service to access NIS services unconditionally.

This interface was added because of apache and spamassassin, to fix a nested conditionals problem. When that support is added, this should be removed, and the regular interface should be used.

Domain allowed access. Use the ypbind service to access NIS services.

Allow the specified domain to use the ypbind service to access Network Information Service (NIS) services. Information that can be retreived from NIS includes usernames, passwords, home directories, and groups. If the network is configured to have a single sign-on using NIS, it is likely that any program that does authentication will need this access.

Domain allowed access. Use nis to authenticate passwords. Domain allowed access. Execute ypbind in the ypbind domain. Domain allowed to transition. Execute ypbind in the caller domain. Domain allowed access. Execute ypbind in the ypbind domain, and allow the specified role the ypbind domain. Domain allowed to transition. Role allowed access. Send generic signals to ypbind. Domain allowed access. List nis data directories. Domain allowed access. Send UDP network traffic to NIS clients. (Deprecated) Domain allowed access. Connect to ypbind over TCP. (Deprecated) Domain allowed access. Read ypbind pid files. Domain allowed access. Delete ypbind pid files. Domain allowed access. Read ypserv configuration files. Domain allowed access. Execute ypxfr in the ypxfr domain. Domain allowed to transition. Execute nis init scripts in the init script domain. Domain allowed to transition. Execute ypbind init scripts in the init script domain. Domain allowed to transition. All of the rules required to administrate an nis environment. Domain allowed access. Role allowed access.
Name service cache daemon.
Send generic signals to nscd. Domain allowed access. Send kill signals to nscd. Domain allowed access. Send null signals to nscd. Domain allowed access. Execute nscd in the nscd domain. Domain allowed to transition. Execute nscd in the caller domain. Domain allowed access. Use nscd services by connecting using a unix domain stream socket. Domain allowed access. Use nscd services by mapping the database from an inherited nscd file descriptor. Domain allowed access. Use nscd services. Domain allowed access. Do not audit attempts to search nscd pid directories. Domain to not audit. Read nscd pid files. Domain allowed access. Unconfined access to nscd services. Domain allowed access. Execute nscd in the nscd domain, and allow the specified role the nscd domain. Domain allowed to transition. Role allowed access. Execute the nscd server init script in the initrc domain. Domain allowed to transition. All of the rules required to administrate an nscd environment. Domain allowed access. Role allowed access.

Determine whether confined applications can use nscd shared memory.

Authoritative only name server.
Send and receive datagrams from NSD. (Deprecated) Domain allowed access. Connect to NSD over a TCP socket (Deprecated) Domain allowed access. All of the rules required to administrate an nsd environment. Domain allowed access. Role allowed access.
Local LDAP name service daemon.
Execute a domain transition to run nslcd. Domain allowed to transition. Execute nslcd server in the nslcd domain. Domain allowed to transition. Read nslcd pid files. Domain allowed access. Connect to nslcd over an unix domain stream socket. Domain allowed access. All of the rules required to administrate an nslcd environment. Domain allowed access. Role allowed access.
A network traffic probe similar to the UNIX top command.
All of the rules required to administrate an ntop environment. Domain allowed access. Role allowed access.
Network time protocol daemon.
NTP stub interface. No access allowed. Domain allowed access. Execute ntp server in the ntpd domain. Domain allowed to transition. Execute ntp in the ntp domain, and allow the specified role the ntp domain. Domain allowed to transition. Role allowed access. Execute ntpdate server in the ntpd domain. Domain allowed to transition. Execute ntpd init scripts in the init script domain. Domain allowed to transition. Read ntp conf files. Domain allowed access. Read ntp drift files. Domain allowed access. Read and write ntpd shared memory. Domain allowed access. All of the rules required to administrate an ntp environment. Domain allowed access. Role allowed access.
Non-Uniform Memory Alignment Daemon.
All of the rules required to administrate an numad environment. Domain allowed access. Role allowed access.
Network UPS Tools
All of the rules required to administrate an nut environment. Domain allowed access. Role allowed access.
NX remote desktop.
Transition to nx server. Domain allowed to transition. Read nx home directory content. Domain allowed access. Search nx lib directories. Domain allowed access. Create specified objects in nx lib directories with a private type. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created.
Open AntiVirus scannerdaemon and signature update.
Execute oav_update in the oav_update domain. Domain allowed to transition. Execute oav_update in the oav update domain, and allow the specified role the oav_update domain. Domain allowed to transition. Role allowed access.
D-Bus service providing high-level OBEX client and server side functionality.
The role template for obex.
The prefix of the user domain (e.g., user is the prefix for user_t).
The role associated with the user domain.
The type of the user domain.
Execute obex in the obex domain. Domain allowed to transition. Send and receive messages from obex over dbus. Domain allowed access.
D-BUS service which runs odd jobs on behalf of client applications.
Execute a domain transition to run oddjob. Domain allowed to transition. Make the specified program domain accessable from the oddjob. The type of the process to transition to. The type of the file used as an entrypoint to this domain. Send and receive messages from oddjob over dbus. Domain allowed access. Execute a domain transition to run oddjob mkhomedir. Domain allowed to transition. Execute oddjob mkhomedir in the oddjob mkhomedir domain and allow the specified role the oddjob mkhomedir domain. Domain allowed to transition. Role allowed access. Do not audit attempts to read and write oddjob fifo files. Domain to not audit. Send child terminated signals to oddjob. Domain allowed access.
An ident daemon with IP masq/NAT support and the ability to specify responses.
Role access for oident. Role allowed access. User domain for the role. Read oidentd user home content. Domain allowed access. Create, read, write, and delete oidentd user home content. Domain allowed access. Relabel oidentd user home content. Domain allowed access. Create objects in user home directories with the oidentd home type. Domain allowed access. Class of the object being created. The name of the object being created. All of the rules required to administrate an oident environment. Domain allowed access. Role allowed access.
Open Certificate Authority.
Execute the openca with a domain transition. Domain allowed to transition. Send generic signals to openca. Domain allowed access. Send stop signals to openca. Domain allowed access. Send kill signals to openca. Domain allowed access.
Service for handling smart card readers.
Send null signals to openct. Domain allowed access. Execute openct in the caller domain. Domain allowed access. Execute a domain transition to run openct. Domain allowed to transition. Read openct pid files. Domain allowed access. Connect to openct over an unix domain stream socket. Domain allowed access. All of the rules required to administrate an openct environment. Domain allowed access. Role allowed access.
Open source implementation of the Service Availability Forum Hardware Platform Interface.
All of the rules required to administrate an openhpi environment. Domain allowed access. Role allowed access.
full-featured SSL VPN solution.
Execute openvpn clients in the openvpn domain. Domain allowed to transition. Execute openvpn clients in the openvpn domain, and allow the specified role the openvpn domain. Domain allowed to transition. Role allowed access. Send kill signals to openvpn. Domain allowed access. Send generic signals to openvpn. Domain allowed access. Send null signals to openvpn. Domain allowed access. Read openvpn configuration content. Domain allowed access. All of the rules required to administrate an openvpn environment. Domain allowed access. Role allowed access.

Determine whether openvpn can read generic user home content files.

Determine whether openvpn can connect to the TCP network.

Multilayer virtual switch.
Execute openvswitch in the openvswitch domain. Domain allowed to transition. Read openvswitch pid files. Domain allowed access. All of the rules required to administrate an openvswitch environment. Domain allowed access. Role allowed access.
A scalable high-availability cluster resource manager.
All of the rules required to administrate an pacemaker environment. Domain allowed access. Role allowed access.
Passive Asset Detection System.
All of the rules required to administrate an pads environment. Domain allowed access. Role allowed access.
Ruby on rails deployment for Apache and Nginx servers.
Execute passenger in the passenger domain. Domain allowed to transition. Execute passenger in the caller domain. Domain allowed access. Read passenger lib files. Domain allowed access.
PCMCIA card management services.
PCMCIA stub interface. No access allowed. Domain allowed access. Execute cardmgr in the cardmgr domain. Domain allowed to transition. Inherit and use cardmgr file descriptors. Domain allowed access. Execute cardctl in the cardmgr domain. Domain allowed to transition. Execute cardctl in the cardmgr domain, and allow the specified role the cardmgr domain. Domain allowed to transition. Role allowed access. Read cardmgr pid files. Domain allowed access. Create, read, write, and delete cardmgr pid files. Domain allowed access. Create, read, write, and delete cardmgr runtime character nodes. Domain allowed access.
PCSC smart card service.
Execute a domain transition to run pcscd. Domain allowed to transition. Read pcscd pid files. Domain allowed access. Read pcscd pid files. Domain allowed access. Create, read, write, and delete pcscd pid files. Domain allowed access. Create, read, write, and delete pcscd pid fifo files. Domain allowed access. Connect to pcscd over an unix domain stream socket. Domain allowed access. All of the rules required to administrate an pcscd environment. Domain allowed access. Role allowed access.
The Open Group Pegasus CIM/WBEM Server.
All of the rules required to administrate an pegasus environment. Domain allowed access. Role allowed access.
Perdition POP and IMAP proxy.
Connect to perdition over a TCP socket (Deprecated) Domain allowed access. All of the rules required to administrate an perdition environment. Domain allowed access. Role allowed access.
Pingd of the Whatsup cluster node up/down detection utility.
Execute a domain transition to run pingd. Domain allowed to transition. Read pingd etc configuration files. Domain allowed access. Create, read, write, and delete pingd etc configuration files. Domain allowed access. All of the rules required to administrate an pingd environment. Domain allowed access. Role allowed access.
Implementations of the Cryptoki specification.
All of the rules required to administrate an pkcs slotd environment. Domain allowed access. Role allowed access.
Plymouth graphical boot.
Execute a domain transition to run plymouthd. Domain allowed to transition. Execute plymouthd in the caller domain. Domain allowed access. Connect to plymouthd using a unix domain stream socket. Domain allowed access. Execute plymouth in the caller domain. Domain allowed access. Execute a domain transition to run plymouth. Domain allowed to transition. Search plymouthd spool directories. Domain allowed access. Read plymouthd spool files. Domain allowed access. Create, read, write, and delete plymouthd spool files. Domain allowed access. Search plymouthd lib directories. Domain allowed access. Read plymouthd lib files. Domain allowed access. Create, read, write, and delete plymouthd lib files. Domain allowed access. Read plymouthd pid files. Domain allowed access. All of the rules required to administrate an plymouthd environment. Domain allowed access. Role allowed access.
Podsleuth is a tool to get information about an Apple (TM) iPod (TM).
Execute a domain transition to run podsleuth. Domain allowed to transition. Execute podsleuth in the podsleuth domain, and allow the specified role the podsleuth domain. Domain allowed to transition. Role allowed access.
Policy framework for controlling privileges for system-wide services.
Send and receive messages from policykit over dbus. Domain allowed access. Send and receive messages from policykit auth over dbus. Domain allowed access. Execute a domain transition to run polkit_auth. Domain allowed to transition. Execute a policy_auth in the policy auth domain, and allow the specified role the policy auth domain. Domain allowed to transition. Role allowed access. Execute a domain transition to run polkit grant. Domain allowed to transition. Execute a policy_grant in the policy grant domain, and allow the specified role the policy grant domain. Domain allowed to transition. Role allowed access. Read policykit reload files. Domain allowed access. Read and write policykit reload files. Domain allowed access. Execute a domain transition to run polkit resolve. Domain allowed to transition. Search policykit lib directories. Domain allowed access. Read policykit lib files. Domain allowed access.
Lightweight forwarding and caching proxy server.
Role access for Polipo session.
Role allowed access.
User domain for the role.
Execute Polipo in the Polipo system domain. Domain allowed to transition. Create specified objects in generic log directories with the polipo log file type. Domain allowed access. Class of the object being created. The name of the object being created. All of the rules required to administrate an polipo environment. Domain allowed access. Role allowed access.

Determine whether Polipo system daemon can access CIFS file systems.

Determine whether Polipo system daemon can access NFS file systems.

Determine whether calling user domains can execute Polipo daemon in the polipo_session_t domain.

Determine whether Polipo session daemon can send syslog messages.

Package Management System.
Execute emerge in the portage domain. Domain allowed to transition. Execute emerge in the portage domain, and allow the specified role the portage domain. Domain allowed to transition. Role allowed access. Template for portage sandbox.

Template for portage sandbox. Portage does all compiling in the sandbox.

Domain Allowed Access Execute tree management functions (fetching, layman, ...) in the portage fetch domain. Domain allowed to transition. Execute tree management functions (fetching, layman, ...) in the portage fetch domain, and allow the specified role the portage fetch domain. Domain allowed to transition. Role allowed access. Execute gcc-config in the gcc config domain. Domain allowed to transition. Execute gcc-config in the gcc config domain, and allow the specified role the gcc_config domain. Domain allowed to transition. Role allowed access. Do not audit attempts to use portage file descriptors. Domain to not audit. Do not audit attempts to search the portage temporary directories. Domain to not audit. Do not audit attempts to read and write the portage temporary files. Domain to not audit.

Determine whether portage can use nfs filesystems.

RPC port mapping service.
Execute portmap helper in the helper domain. Domain allowed to transition. Execute portmap helper in the helper domain, and allow the specified role the helper domain. Domain allowed to transition. Role allowed access. Send UDP network traffic to portmap. (Deprecated) Domain allowed access. Send and receive UDP network traffic from portmap. (Deprecated) Domain allowed access. Connect to portmap over a TCP socket (Deprecated) Domain allowed access. All of the rules required to administrate an portmap environment. Domain allowed access. Role allowed access.
Reserve well-known ports in the RPC port range.
Execute a domain transition to run portreserve. Domain allowed to transition. Read portreserve configuration content. Domain allowed access. Create, read, write, and delete portreserve configuration content. Domain allowed access. Execute portreserve init scripts in the init script domain. Domain allowed to transition. All of the rules required to administrate an portreserve environment. Domain allowed access. Role allowed access.
Portslave terminal server software.
Execute portslave with a domain transition. Domain allowed to transition.
Postfix email server.
Postfix stub interface. No access allowed. Domain allowed access. The template to define a postfix domain. Domain prefix to be used. The template to define a postfix server domain. Domain prefix to be used. The template to define a postfix user domain. Domain prefix to be used. Read postfix configuration content. Domain allowed access. Create specified object in postfix etc directories with a type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Do not audit attempts to read and write postfix local delivery TCP sockets. Domain to not audit. Read and write postfix local pipes. Domain allowed access. Read postfix local process state files. Domain allowed access. Read and write inherited postfix master pipes. Domain allowed access. Read postfix master process state files. Domain allowed access. Use postfix master file descriptors. Domain allowed access. Do not audit attempts to use postfix master process file file descriptors. Domain to not audit. Execute postfix_map in the postfix_map domain. Domain allowed to transition. Execute postfix map in the postfix map domain, and allow the specified role the postfix_map domain. Domain allowed to transition. Role allowed access. Execute the master postfix program in the postfix_master domain. Domain allowed to transition. Execute the master postfix program in the caller domain. Domain allowed access. Connect to postfix master process using a unix domain stream socket. Domain allowed access. Read and write postfix master unnamed pipes. (Deprecated) Domain allowed access. Execute the master postdrop in the postfix postdrop domain. Domain allowed to transition. Execute the master postqueue in the postfix postqueue domain. Domain allowed to transition. Execute the master postqueue in the caller domain. (Deprecated) Domain allowed access. Execute postfix postqueue in the caller domain. Domain allowed access. Create postfix private sock files. Domain allowed access. Create, read, write, and delete postfix private sock files. Domain allowed access. Execute the smtp postfix program in the postfix smtp domain. Domain allowed to transition. Get attributes of all postfix mail spool files. Domain allowed access. Search postfix mail spool directories. Domain allowed access. List postfix mail spool directories. Domain allowed access. Read postfix mail spool files. Domain allowed access. Create, read, write, and delete postfix mail spool files. Domain allowed access. Execute postfix user mail programs in their respective domains. Domain allowed access. All of the rules required to administrate an postfix environment. Domain allowed access. Role allowed access.

Determine whether postfix local can manage mail spool content.

Postfix policy server.
All of the rules required to administrate an postfixpolicyd environment. Domain allowed access. Role allowed access.
Postfix grey-listing server.
Connect to postgrey using a unix domain stream socket. Domain allowed access. Search spool directories. Domain allowed access. All of the rules required to administrate an postgrey environment. Domain allowed access. Role allowed access.
Point to Point Protocol daemon creates links in ppp networks.
Role access for ppp. Role allowed access. User domain for the role. Create, read, write, and delete ppp home files. Domain allowed access. Read ppp user home content files. Domain allowed access. Relabel ppp home files. Domain allowed access. Create objects in user home directories with the ppp home type. Domain allowed access. Class of the object being created. The name of the object being created. Inherit and use ppp file discriptors. Domain allowed access. Do not audit attempts to inherit and use ppp file discriptors. Domain to not audit. Send child terminated signals to ppp. Domain allowed access. Send kill signals to ppp. Domain allowed access. Send generic signals to ppp. Domain allowed access. Send null signals to ppp. Domain allowed access. Execute pppd in the pppd domain. Domain allowed to transition. Conditionally execute pppd on behalf of a user or staff type. Domain allowed to transition. Role allowed access. Unconditionally execute ppp daemon on behalf of a user or staff type. Domain allowed to transition. Role allowed access. Execute domain in the caller domain. Domain allowed access. Read ppp configuration files. Domain allowed access. Read ppp writable configuration content. Domain allowed access. Read ppp secret files. Domain allowed access. Read ppp pid files. Domain allowed access. Create, read, write, and delete ppp pid files. Domain allowed access. Create specified pppd pid objects with a type transition. Domain allowed access. Class of the object being created. The name of the object being created. Execute pppd init script in the initrc domain. Domain allowed to transition. All of the rules required to administrate an ppp environment. Domain allowed access. Role allowed access.

Determine whether pppd can load kernel modules.

Determine whether common users can run pppd with a domain transition.

Prelink ELF shared library mappings.
Execute prelink in the prelink domain. Domain allowed to transition. Execute prelink in the caller domain. Domain allowed access. Execute prelink in the prelink domain, and allow the specified role the prelink domain. Domain allowed to transition. Role allowed access. Make the specified file type prelinkable. File type to be prelinked. Read prelink cache files. Domain allowed access. Delete prelink cache files. Domain allowed access. Create, read, write, and delete prelink log files. Domain allowed access. Create, read, write, and delete prelink var_lib files. Domain allowed access. Relabel from prelink lib files. Domain allowed access. Relabel prelink lib files. Domain allowed access.
Prelude hybrid intrusion detection system.
Execute a domain transition to run prelude. Domain allowed to transition. Execute a domain transition to run prelude audisp. Domain allowed to transition. Send generic signals to prelude audisp. Domain allowed access. Read prelude spool files. Domain allowed access. Create, read, write, and delete prelude manager spool files. Domain allowed access. All of the rules required to administrate an prelude environment. Domain allowed access. Role allowed access.
Privacy enhancing web proxy.
All of the rules required to administrate an privoxy environment. Domain allowed access. Role allowed access.

Determine whether privoxy can connect to all tcp ports.

Procmail mail delivery agent.
Execute procmail with a domain transition. Domain allowed to transition. Execute procmail in the caller domain. Domain allowed access. Create, read, write, and delete procmail home files. Domain allowed access. Read procmail user home content files. Domain allowed access. Relabel procmail home files. Domain allowed access. Create objects in user home directories with the procmail home type. Domain allowed access. Class of the object being created. The name of the object being created. Read procmail tmp files. Domain allowed access. Read and write procmail tmp files. Domain allowed access.
Intrusion Detection and Log Analysis with iptables.
Execute a domain transition to run psad. Domain allowed to transition. Send generic signals to psad. Domain allowed access. Send null signals to psad. Domain allowed access. Read psad configuration content. Domain allowed access. Create, read, write, and delete psad configuration content. Domain allowed access. Read psad pid files. Domain allowed access. Read and write psad pid files. Domain allowed access. Read psad log content. Domain allowed access. Append psad log files. Domain allowed access. Read and write psad fifo files. Domain allowed access. Read and write psad temporary files. Domain allowed access. All of the rules required to administrate an psad environment. Domain allowed access. Role allowed access.
helper function for grantpt(3), changes ownship and permissions of pseudotty.
Execute a domain transition to run ptchown. Domain allowed to transition. Execute ptchown in the caller domain. Domain allowed access. Execute ptchown in the ptchown domain, and allow the specified role the ptchown domain. Domain allowed to transition. Role allowed access.
publicfile supplies files to the public through HTTP and FTP.
Pulseaudio network sound server.
Role access for pulseaudio. Role allowed access. User domain for the role. Execute a domain transition to run pulseaudio. Domain allowed to transition. Execute pulseaudio in the pulseaudio domain, and allow the specified role the pulseaudio domain. Domain allowed to transition. Role allowed access. Execute pulseaudio in the caller domain. Domain allowed access. Do not audit attempts to execute pulseaudio. Domain to not audit. Send null signals to pulseaudio. processes. Domain allowed access. Use file descriptors for pulseaudio. Domain allowed access. Do not audit attempts to use the file descriptors for pulseaudio. Domain allowed access. Connect to pulseaudio with a unix domain stream socket. Domain allowed access. Send and receive messages from pulseaudio over dbus. Domain allowed access. Set attributes of pulseaudio home directories. Domain allowed access. Read pulseaudio home content. Domain allowed access. Read pulseaudio home content. Domain allowed access. Read and write Pulse Audio files. Domain allowed access. Create, read, write, and delete pulseaudio home content. Domain allowed access. Create, read, write, and delete pulseaudio home content. Domain allowed access. Create objects in user home directories with the pulseaudio home type. Domain allowed access. Class of the object being created. The name of the object being created. Make the specified tmpfs file type pulseaudio tmpfs content. File type to make pulseaudio tmpfs content. Read pulseaudio tmpfs files. Domain allowed access. Read and write pulseaudio tmpfs files. Domain allowed access.

Allow pulseaudio to execute code in writable memory

Configuration management system.
Execute puppetca in the puppetca domain. Domain allowed to transition. Execute puppetca in the puppetca domain and allow the specified role the puppetca domain. Domain allowed to transition. Role allowed access. Read puppet configuration content. Domain allowed access. Read Puppet lib files. Domain allowed access. Create, read, write, and delete puppet lib files. Domain allowed access. Append puppet log files. Domain allowed access. Create puppet log files. Domain allowed access. Read puppet log files. Domain allowed access. Read and write to puppet tempoprary files. Domain allowed access. All of the rules required to administrate an puppet environment. Domain allowed access. Role allowed access.

Determine whether puppet can manage all non-security files.

External plugin for mod_authnz_external authenticator.
Role access for pwauth. Role allowed access. User domain for the role. Execute pwauth in the pwauth domain. Domain allowed to transition. Execute pwauth in the pwauth domain, and allow the specified role the pwauth domain. Domain allowed to transition. Role allowed access.
Server for the PXE network boot protocol.
All of the rules required to administrate an pxe environment. Domain allowed access. Role allowed access.
ICQ transport for XMPP server.
All of the rules required to administrate an pyicqt environment. Domain allowed access. Role allowed access.
Pyzor is a distributed, collaborative spam detection and filtering network.
Role access for pyzor. Role allowed access User domain for the role Send generic signals to pyzor. Domain allowed access. Execute pyzor with a domain transition. Domain allowed to transition. Execute pyzor in the caller domain. Domain allowed access. All of the rules required to administrate an pyzor environment. Domain allowed access. Role allowed access.
QEMU machine emulator and virtualizer.
The template to define a qemu domain.
Domain prefix to be used.
Role access for qemu.
Role allowed access.
User domain for the role.
Execute a domain transition to run qemu. Domain allowed to transition. Execute a qemu in the caller domain. Domain allowed access. Execute qemu in the qemu domain, and allow the specified role the qemu domain. Domain allowed to transition. Role allowed access. Read qemu process state files. Domain to allow access. Set qemu scheduler. Domain allowed access. Send generic signals to qemu. Domain allowed access. Send kill signals to qemu. Domain allowed access. Execute a domain transition to run qemu unconfined. Domain allowed to transition. Create, read, write, and delete qemu temporary directories. Domain allowed access. Create, read, write, and delete qemu temporary files. Domain allowed access. Execute qemu in a specified domain.

Execute qemu in a specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Make qemu executable files an entrypoint for the specified domain. The domain for which qemu_exec_t is an entrypoint.

Determine whether qemu has full access to the network.

Qmail Mail Server.
Template for qmail parent/sub-domain pairs.
The prefix of the child domain.
The name of the parent domain.
Transition to qmail_inject_t. Domain allowed to transition. Transition to qmail_queue_t. Domain allowed to transition. Read qmail configuration files. Domain allowed access. Define the specified domain as a qmail-smtp service. Domain allowed access The type associated with the process program.
Apache QPID AMQP messaging server.
Execute a domain transition to run qpidd. Domain allowed to transition. Read and write access qpidd semaphores. Domain allowed access. Read and write qpidd shared memory. Domain allowed access. Execute qpidd init script in the initrc domain. Domain allowed to transition. Read qpidd pid files. Domain allowed access. Search qpidd lib directories. Domain allowed access. Read qpidd lib files. Domain allowed access. Create, read, write, and delete qpidd lib files. Domain allowed access. All of the rules required to administrate an qpidd environment. Domain allowed access. Role allowed access.
Virtual network service for Openstack.
All of the rules required to administrate an quantum environment. Domain allowed access. Role allowed access.
File system quota management.
Execute quota management tools in the quota domain. Domain allowed to transition. Execute quota management tools in the quota domain, and allow the specified role the quota domain. Domain allowed to transition. Role allowed access. Execute quota nld in the quota nld domain. Domain allowed to transition. Create, read, write, and delete quota db files. Domain allowed access. Create specified objects in specified directories with a type transition to the quota db file type. Domain allowed access. Directory to transition on. The object class of the object being created. The name of the object being created. Do not audit attempts to get attributes of filesystem quota data files. Domain to not audit. Create, read, write, and delete quota flag files. Domain allowed access. All of the rules required to administrate an quota environment. Domain allowed access. Role allowed access.
AMQP server written in Erlang.
Execute rabbitmq in the rabbitmq domain. Domain allowed to transition. All of the rules required to administrate an rabbitmq environment. Domain allowed access. Role allowed access.
RADIUS authentication and accounting server.
Use radius over a UDP connection. (Deprecated) Domain allowed access. All of the rules required to administrate an radius environment. Domain allowed access. Role allowed access.
IPv6 router advertisement daemon.
All of the rules required to administrate an radvd environment. Domain allowed access. Role allowed access.
RAID array management tools.
Execute software raid tools in the mdadm domain. Domain allowed to transition. Execute mdadm in the mdadm domain, and allow the specified role the mdadm domain. Role allowed access. Domain allowed to transition. Create, read, write, and delete mdadm pid files. Domain allowed access. All of the rules required to administrate an mdadm environment. Domain allowed access. Role allowed access.
A distributed, collaborative, spam detection and filtering network.
The template to define a razor domain.
Domain prefix to be used.
Role access for razor. Role allowed access. User domain for the role. Execute razor in the system razor domain. Domain allowed to transition. Create, read, write, and delete razor home content. Domain allowed access. Read razor lib files. Domain allowed access.
Network router discovery daemon.
Execute rdisc in the caller domain. Domain allowed access.
Read files into page cache for improved performance.
Execute a domain transition to run readahead. Domain allowed to transition.
Dbus system service which manages discovery and enrollment in realms and domains like Active Directory or IPA.
Execute realmd in the realmd domain. Domain allowed to transition. Send and receive messages from realmd over dbus. Domain allowed access.
Advanced key-value store.
All of the rules required to administrate an redis environment. Domain allowed access. Role allowed access.
Rshd, rlogind, and telnetd.
Domain transition to the remote login domain. Domain allowed to transition. Send generic signals to remote login. Domain allowed access. Create, read, write, and delete remote login temporary content. Domain allowed access. Relabel remote login temporary content. Domain allowed access.
Resource management daemon.
Connect to resmgrd over a unix domain stream socket. Domain allowed access. All of the rules required to administrate an resmgr environment. Domain allowed access. Role allowed access.
Resource Group Manager.
Execute a domain transition to run rgmanager. Domain allowed to transition. Connect to rgmanager with a unix domain stream socket. Domain allowed access. Create, read, write, and delete rgmanager tmp files. Domain allowed access. Create, read, write, and delete rgmanager tmpfs files. Domain allowed access. All of the rules required to administrate an rgmanager environment. Domain allowed access. Role allowed access.

Determine whether rgmanager can connect to the network using TCP.

Red Hat Cluster Suite.
The template to define a rhcs domain.
Domain prefix to be used.
Execute a domain transition to run dlm_controld. Domain allowed to transition. Get attributes of fenced executable files. Domain allowed access. Connect to dlm_controld with a unix domain stream socket. Domain allowed access. Read and write dlm_controld semaphores. Domain allowed access. Execute a domain transition to run fenced. Domain allowed to transition. Read and write fenced semaphores. Domain allowed access. Connect to all cluster domains with a unix domain stream socket. Domain allowed access. Connect to fenced with an unix domain stream socket. Domain allowed access. Execute a domain transition to run gfs_controld. Domain allowed to transition. Read and write gfs_controld semaphores. Domain allowed access. Read and write gfs_controld_t shared memory. Domain allowed access. Connect to gfs_controld_t with a unix domain stream socket. Domain allowed access. Execute a domain transition to run groupd. Domain allowed to transition. Connect to groupd with a unix domain stream socket. Domain allowed access. Read and write all cluster domains shared memory. Domain allowed access. Read and write all cluster domains semaphores. Domain allowed access. Read and write groupd semaphores. Domain allowed access. Read and write groupd shared memory. Domain allowed access. Execute a domain transition to run qdiskd. Domain allowed to transition. All of the rules required to administrate an rhcs environment. Domain allowed access. Role allowed access.

Determine whether fenced can connect to the TCP network.

Determine whether fenced can use ssh.

Red Hat Graphical Boot.
RHGB stub interface. No access allowed. N/A Inherit and use rhgb file descriptors. Domain allowed access. Get the process group of rhgb. Domain allowed access. Send generic signals to rhgb. Domain allowed access. Read and write inherited rhgb unix domain stream sockets. Domain allowed access. Do not audit attempts to read and write rhgb unix domain stream sockets. Domain to not audit. Connected to rhgb with a unix domain stream socket. Domain allowed access. Read and write to rhgb shared memory. Domain allowed access. Read and write rhgb pty devices. Domain allowed access. Do not audit attempts to read and write rhgb pty devices. Domain to not audit. Read and write to rhgb tmpfs files. Domain allowed access.
Subscription Management Certificate Daemon.
Execute rhsmcertd in the rhsmcertd domain. Domain allowed to transition. Execute rhsmcertd init scripts in the initrc domain. Domain allowed to transition. Read rhsmcertd log files. Domain allowed access. Append rhsmcertd log files. Domain allowed access. Create, read, write, and delete rhsmcertd log files. Domain allowed access. Search rhsmcertd lib directories. Domain allowed access. Read rhsmcertd lib files. Domain allowed access. Create, read, write, and delete rhsmcertd lib files. Domain allowed access. Create, read, write, and delete rhsmcertd lib directories. Domain allowed access. Read rhsmcertd pid files. Domain allowed access. Connect to rhsmcertd with a unix domain stream socket. Domain allowed access. Send and receive messages from rhsmcertd over dbus. Domain allowed access. Do not audit attempts to send and receive messages from rhsmcertd over dbus. Domain to not audit. All of the rules required to administrate an rhsmcertd environment. Domain allowed access. Role allowed access.
Ricci cluster management agent.
Execute a domain transition to run ricci. Domain allowed to transition. Execute a domain transition to run ricci modcluster. Domain allowed to transition. Do not audit attempts to use ricci modcluster file descriptors. Domain to not audit. Do not audit attempts to read write ricci modcluster unamed pipes. Domain to not audit. Connect to ricci_modclusterd with a unix domain stream socket. Domain allowed access. Execute a domain transition to run ricci modlog. Domain allowed to transition. Execute a domain transition to run ricci modrpm. Domain allowed to transition. Execute a domain transition to run ricci modservice. Domain allowed to transition. Execute a domain transition to run ricci modstorage. Domain allowed to transition. All of the rules required to administrate an ricci environment. Domain allowed access. Role allowed access.
Remote login daemon.
Execute rlogind in the rlogin domain. Domain allowed to transition. Read rlogin user home content. Domain allowed access. Create, read, write, and delete rlogind home files. Domain allowed access. Relabel rlogind home files. Domain allowed access. Create objects in user home directories with the rlogind home type. Domain allowed access. Class of the object being created. The name of the object being created. Create, read, write, and delete rlogind temporary content. Domain allowed access. Relabel rlogind temporary content. Domain allowed access.
Check and feed random data from hardware device to kernel random device.
All of the rules required to administrate an rng environment. Domain allowed access. Role allowed access.
Roundup Issue Tracking System.
All of the rules required to administrate an roundup environment. Domain allowed access. Role allowed access.
Remote Procedure Call Daemon.
RPC stub interface. No access allowed. Domain allowed access. The template to define a rpc domain. Domain prefix to be used. Send UDP network traffic to rpc and recieve UDP traffic from rpc. (Deprecated) Domain allowed access. Do not audit attempts to get attributes of export files. Domain to not audit. Read export files. Domain allowed access. Write export files. Domain allowed access. Execute nfsd in the nfsd domain. Domain allowed to transition. Execute nfsd init scripts in the initrc domain. Domain allowed to transition. Execute rpcd in the rpcd domain. Domain allowed to transition. Execute rpcd init scripts in the initrc domain. Domain allowed to transition. Read nfs exported content. Domain allowed access. Create, read, write, and delete nfs exported read write content. Domain allowed access. Create, read, write, and delete nfs exported read only content. Domain allowed access. Read and write to nfsd tcp sockets. Domain allowed access. Read and write to nfsd udp sockets. Domain allowed access. Send UDP traffic to NFSd. (Deprecated) Domain allowed access. Search nfs lib directories. Domain allowed access. Read nfs lib files. Domain allowed access. Create, read, write, and delete nfs lib files. Domain allowed access. All of the rules required to administrate an rpc environment. Domain allowed access. Role allowed access.

Determine whether gssd can read generic user temporary content.

Determine whether gssd can write generic user temporary content.

Determine whether nfs can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Universal Addresses to RPC Program Number Mapper.
Execute a domain transition to run rpcbind. Domain allowed to transition. Connect to rpcbind with a unix domain stream socket. Domain allowed access. Read rpcbind pid files. Domain allowed access. Search rpcbind lib directories. Domain allowed access. Read rpcbind lib files. Domain allowed access. Create, read, write, and delete rpcbind lib files. Domain allowed access. Send null signals to rpcbind. Domain allowed access. All of the rules required to administrate an rpcbind environment. Domain allowed access. Role allowed access.
Redhat package manager.
Execute rpm in the rpm domain. Domain allowed to transition. Execute debuginfo install in the rpm domain. Domain allowed to transition. Execute rpm scripts in the rpm script domain. Domain allowed to transition. Execute rpm in the rpm domain, and allow the specified roles the rpm domain. Domain allowed to transition. Role allowed access. Execute the rpm in the caller domain. Domain allowed access. Send null signals to rpm. Domain allowed access. Inherit and use file descriptors from rpm. Domain allowed access. Read rpm unnamed pipes. Domain allowed access. Read and write rpm unnamed pipes. Domain allowed access. Send and receive messages from rpm over dbus. Domain allowed access. Do not audit attempts to send and receive messages from rpm over dbus. Domain to not audit. Send and receive messages from rpm script over dbus. Domain allowed access. Search rpm log directories. Domain allowed access. Append rpm log files. Domain allowed access. Create, read, write, and delete rpm log files. Domain allowed access. Inherit and use rpm script file descriptors. Domain allowed access. Create, read, write, and delete rpm script temporary files. Domain allowed access. Append rpm temporary files. Domain allowed access. Create, read, write, and delete rpm temporary files. Domain allowed access. Read rpm script temporary files. Domain allowed access. Read rpm cache content. Domain allowed access. Create, read, write, and delete rpm cache content. Domain allowed access. Read rpm lib content. Domain allowed access. Delete rpm lib files. Domain allowed access. Create, read, write, and delete rpm lib files. Domain allowed access. Do not audit attempts to create, read, write, and delete rpm lib content. Domain to not audit. Read rpm pid files. Domain allowed access. Create, read, write, and delete rpm pid files. Domain allowed access. Create files in pid directories with the rpm pid file type. Domain allowed access. Create specified objects in pid directories with the rpm pid file type. Domain allowed access. Class of the object being created. The name of the object being created. All of the rules required to administrate an rpm environment. Domain allowed access. Role allowed access.
Remote shell service.
Execute rshd in the rshd domain. Domain allowed to transition.
Restricted (scp/sftp) only shell.
Role access for rssh. Role allowed access. User domain for the role. Execute rssh in the rssh domain. Domain allowed to transition. Execute the rssh program in the caller domain. Domain allowed access. Execute a domain transition to run rssh chroot helper. Domain allowed to transition. Read users rssh read-only content. Domain allowed access.
Fast incremental file transfer for synchronization.
Make rsync executable file an entry point for the specified domain. The domain for which rsync_exec_t is an entrypoint. Execute a rsync in a specified domain.

Execute a rsync in a specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Execute a rsync in a specified domain.

Execute a rsync in a specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Execute the rsync program in the rsync domain. Domain allowed to transition. Execute rsync in the rsync domain, and allow the specified role the rsync domain. Domain allowed to transition. Role allowed access. Execute rsync in the caller domain. Domain allowed access. Read rsync config files. Domain allowed access. Write rsync config files. Domain allowed access. Create, read, write, and delete rsync config files. Domain allowed access. Create specified objects in etc directories with rsync etc type. Domain allowed to transition. Class of the object being created. The name of the object being created. All of the rules required to administrate an rsync environment. Domain allowed access. Role allowed access.

Determine whether rsync can use cifs file systems.

Determine whether rsync can use fuse file systems.

Determine whether rsync can use nfs file systems.

Determine whether rsync can run as a client

Determine whether rsync can export all content read only.

Determine whether rsync can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Realtime scheduling for user processes.
Execute a domain transition to run rtkit_daemon. Domain allowed to transition. Send and receive messages from rtkit_daemon over dbus. Domain allowed access. Allow rtkit to control scheduling for your process. Domain allowed access. All of the rules required to administrate an rtkit environment. Domain allowed access. Role allowed access.
Who is logged in on other machines?
Execute a domain transition to run rwho. Domain allowed to transition. Search rwho log directories. Domain allowed access. Read rwho log files. Domain allowed access. Search rwho spool directories. Domain allowed access. Read rwho spool files. Domain allowed access. Create, read, write, and delete rwho spool files. Domain allowed access. All of the rules required to administrate an rwho environment. Domain allowed access. Role allowed access.
SMB and CIFS client/server programs.
Execute nmbd in the nmbd domain. Domain allowed to transition. Send generic signals to nmbd. Domain allowed access. Connect to nmbd with a unix domain stream socket. Domain allowed access. Execute samba init scripts in the init script domain. Domain allowed to transition. Execute samba net in the samba net domain. Domain allowed to transition. Execute samba net in the samba net domain, and allow the specified role the samba net domain. Domain allowed to transition. Role allowed access. Execute smbmount in the smbmount domain. Domain allowed to transition. Execute smbmount in the smbmount domain, and allow the specified role the smbmount domain. Domain allowed to transition. Role allowed access. Read samba configuration files. Domain allowed access. Read and write samba configuration files. Domain allowed access. Create, read, write, and delete samba configuration files. Domain allowed access. Read samba log files. Domain allowed access. Append to samba log files. Domain allowed access. Execute samba log files in the caller domain. Domain allowed access. Read samba secret files. Domain allowed access. Read samba share files. Domain allowed access. Search samba var directories. Domain allowed access. Read samba var files. Domain allowed access. Do not audit attempts to write samba var files. Domain to not audit. Read and write samba var files. Domain allowed access. Create, read, write, and delete samba var files. Domain allowed access. Execute smbcontrol in the smbcontrol domain. Domain allowed to transition. Execute smbcontrol in the smbcontrol domain, and allow the specified role the smbcontrol domain. Domain allowed to transition. Role allowed access. Execute smbd in the smbd domain. Domain allowed to transition. Send generic signals to smbd. Domain allowed access. Do not audit attempts to inherit and use smbd file descriptors. Domain to not audit. Write smbmount tcp sockets. Domain allowed access. Read and write smbmount tcp sockets. Domain allowed access. Execute winbind helper in the winbind helper domain. Domain allowed to transition. Get attributes of winbind executable files. Domain allowed access. Execute winbind helper in the winbind helper domain, and allow the specified role the winbind helper domain. Domain allowed to transition. Role allowed access. Read winbind pid files. Domain allowed access. Connect to winbind with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an samba environment. Domain allowed access. Role allowed access.

Determine whether samba can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Determine whether samba can create home directories via pam.

Determine whether samba can act as the domain controller, add users, groups and change passwords.

Determine whether samba can act as a portmapper.

Determine whether samba can share users home directories.

Determine whether samba can share any content read only.

Determine whether samba can share any content readable and writable.

Determine whether samba can run unconfined scripts.

Determine whether samba can use nfs file systems.

Determine whether samba can use fuse file systems.

system-config-samba dbus service.
Check file integrity.
The template to define a samhain domain.
Domain prefix to be used.
Execute samhain in the samhain domain Domain allowed to transition. Execute samhain in the samhain domain with the clearance security level and allow the specifiled role the samhain domain.

Execute samhain in the samhain domain with the clearance security level and allow the specifiled role the samhain domain.

The range_transition rule used in this interface requires that the calling domain should have the clearance security level otherwise the MLS constraint for process transition would fail.

Domain allowed to transition. Role allowed to access. Create, read, write, and delete samhain configuration files. Domain allowed access. Create, read, write, and delete samhain database files. Domain allowed access. Create, read, write, and delete samhain init script files. Domain allowed access. Create, read, write, and delete samhain log and log.lock files. Domain allowed access. Create, read, write, and delete samhain pid files. Domain allowed access. All of the rules required to administrate the samhain environment. Domain allowed access. Role allowed access.
shared storage lock manager.
Execute a domain transition to run sanlock. Domain allowed access. Execute sanlock init scripts in the initrc domain. Domain allowed to transition. Create, read, write, and delete sanlock pid files. Domain allowed access. Connect to sanlock with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an sanlock environment. Domain allowed access. Role allowed access.

Determine whether sanlock can use nfs file systems.

Determine whether sanlock can use cifs file systems.

SASL authentication server.
Connect to SASL. Domain allowed access. All of the rules required to administrate an sasl environment. Domain allowed access. Role allowed access.

Determine whether sasl can read shadow files.

Standards Based Linux Instrumentation for Manageability.
Execute gatherd in the gatherd domain. Domain allowed to transition. Read gatherd pid files. Domain allowed access. All of the rules required to administrate an sblim environment. Domain allowed access. Role allowed access.
GNU terminal multiplexer.
The role template for the screen module.
The prefix of the user role (e.g., user is the prefix for user_r).
The role associated with the user domain.
The type of the user domain.
Sectool security audit tool.
Role access for sectoolm. Role allowed access. User domain for the role.
Internetwork email routing facility.
Sendmail stub interface. No access allowed. Domain allowed access. Read and write sendmail unnamed pipes. Domain allowed access. Execute a domain transition to run sendmail. Domain allowed to transition. Execute the sendmail program in the sendmail domain, and allow the specified role the sendmail domain. Domain allowed to transition. Role allowed access. Send generic signals to sendmail. Domain allowed access. Read and write sendmail TCP sockets. Domain allowed access. Do not audit attempts to read and write sendmail TCP sockets. Domain to not audit. Read and write sendmail unix domain stream sockets. Domain allowed access. Do not audit attempts to read and write sendmail unix_stream_sockets. Domain to not audit. Read sendmail log files. Domain allowed access. Create, read, write, and delete sendmail log files. Domain allowed access. Create specified objects in generic log directories sendmail log file type. Domain allowed access. Create specified objects in generic log directories sendmail log file type. Domain allowed access. Class of the object being created. The name of the object being created. Create, read, write, and delete sendmail tmp files. Domain allowed access. Execute sendmail in the unconfined sendmail domain. Domain allowed to transition. Execute sendmail in the unconfined sendmail domain, and allow the specified role the unconfined sendmail domain. Domain allowed to transition. Role allowed access. All of the rules required to administrate an sendmail environment. Domain allowed access. Role allowed access.
Sensor information logging daemon.
All of the rules required to administrate an sensord environment. Domain allowed access. Role allowed access.
SELinux troubleshooting service.
Connect to setroubleshootd with a unix domain stream socket. Domain allowed access. Do not audit attempts to connect to setroubleshootd with a unix domain stream socket. Domain to not audit. Send null signals to setroubleshoot. Domain allowed access. Send and receive messages from setroubleshoot over dbus. Domain allowed access. Do not audit send and receive messages from setroubleshoot over dbus. Domain to not audit. Send and receive messages from setroubleshoot fixit over dbus. Domain allowed access. All of the rules required to administrate an setroubleshoot environment. Domain allowed access.
Shibboleth authentication deamon
Allow your application domain to access config files from shibboleth The domain which should be enabled. Allow the specified domain to connect to shibboleth with a unix socket. Domain allowed access.
Shoreline Firewall high-level tool for configuring netfilter.
Execute a domain transition to run shorewall. Domain allowed to transition. Execute a domain transition to run shorewall using executables from /var/lib. Domain allowed to transition. Read shorewall configuration files. Domain allowed access. Read shorewall pid files. Domain allowed access. Read and write shorewall pid files. Domain allowed access. Read shorewall lib files. Domain allowed access. Read and write shorewall lib files. Domain allowed access. Read shorewall temporary files. Domain allowed access. All of the rules required to administrate an shorewall environment. Domain allowed access. Role allowed access.
System shutdown command.
Role access for shutdown. Role allowed access. User domain for the role. Execute a domain transition to run shutdown. Domain allowed to transition. Execute shutdown in the shutdown domain, and allow the specified role the shutdown domain. Domain allowed to transition. Role allowed access. Send generic signals to shutdown. Domain allowed access. Send SIGCHLD signals to shutdown. Domain allowed access. Get attributes of shutdown executable files. Domain allowed access.
Update database for mlocate.
Create the locate log with append mode. Domain allowed access. Read locate lib files. Domain allowed access.
OpenSLP server daemon to dynamically register services.
All of the rules required to administrate an slpd environment. Domain allowed access. Role allowed access.
Service for downloading news feeds the slrn newsreader.
Search slrnpull spool directories. Domain allowed access. Create, read, write, and delete slrnpull spool content. Domain allowed access.
Smart disk monitoring daemon.
Read smartmon temporary files. Domain allowed access. All of the rules required to administrate an smartmon environment. Domain allowed access. Role allowed access.

Determine whether smartmon can support devices on 3ware controllers.

Smokeping network latency measurement.
Execute a domain transition to run smokeping. Domain allowed to transition. Execute smokeping init scripts in the initrc domain. Domain allowed to transition. Read smokeping pid files. Domain allowed access. Create, read, write, and delete smokeping pid files. Domain allowed access. Get attributes of smokeping lib files. Domain allowed access. Read smokeping lib files. Domain allowed access. Create, read, write, and delete smokeping lib files. Domain allowed access. All of the rules required to administrate a smokeping environment. Domain allowed access. Role allowed access.
The Fedora hardware profiler client.
Tools to send and receive short messages through GSM modems or mobile phones.
All of the rules required to administrate an smstools environment. Domain allowed access. Role allowed access.
Simple network management protocol services.
Connect to snmpd with a unix domain stream socket. Domain allowed access. Connect to snmp over the TCP network. Domain allowed access. Send and receive UDP traffic to SNMP (Deprecated) Domain allowed access. Create, read, write, and delete snmp lib directories. Domain allowed access. Create, read, write, and delete snmp lib files. Domain allowed access. Read snmpd lib content. Domain allowed access. Do not audit attempts to read snmpd lib content. Domain to not audit. Do not audit attempts to write snmpd lib files. Domain to not audit. All of the rules required to administrate an snmp environment. Domain allowed access. Role allowed access.
Snort network intrusion detection system.
Execute a domain transition to run snort. Domain allowed to transition. All of the rules required to administrate an snort environment. Domain allowed access. Role allowed access.
Generate debugging information for system.
Execute a domain transition to run sosreport. Domain allowed to transition. Execute sosreport in the sosreport domain, and allow the specified role the sosreport domain. Domain allowed access. Role allowed access. Role access for sosreport. Role allowed access. User domain for the role. Read sosreport temporary files. Domain allowed access. Append sosreport temporary files. Domain allowed access. Delete sosreport temporary files. Domain allowed access.
sound server for network audio server programs, nasd, yiff, etc
Connect to the sound server over a TCP socket (Deprecated) Domain allowed access. All of the rules required to administrate an soundd environment. Domain allowed access. Role allowed access.
Filter used for removing unsolicited email.
Role access for spamassassin. Role allowed access. User domain for the role. Execute the standalone spamassassin program in the caller directory. Domain allowed access. Send generic signals to spamd. Domain allowed access. Execute spamd in the caller domain. Domain allowed access. Execute spamc in the spamc domain. Domain allowed to transition. Execute spamc in the caller domain. Domain allowed access. Send kill signals to spamc. Domain allowed access. Execute spamassassin standalone client in the user spamassassin domain. Domain allowed to transition. Create, read, write, and delete spamd home content. Domain allowed access. Relabel spamd home content. Domain allowed access. Create objects in user home directories with the spamd home type. Domain allowed access. Class of the object being created. The name of the object being created. Read spamd lib files. Domain allowed access. Create, read, write, and delete spamd lib files. Domain allowed access. Read spamd pid files. Domain allowed access. Read temporary spamd files. Domain allowed access. Do not audit attempts to get attributes of temporary spamd sockets. Domain to not audit. Connect to spamd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an spamassassin environment. Domain allowed access. Role allowed access.

Determine whether spamassassin clients can use the network.

Determine whether spamd can manage generic user home content.

Alcatel speedtouch USB ADSL modem
Squid caching http proxy server.
Execute squid in the squid domain. Domain allowed to transition. Execute squid in the caller domain. Domain allowed access. Send generic signals to squid. Domain allowed access. Read and write squid unix domain stream sockets. Domain allowed access. Do not audit attempts to search squid cache directories. Domain to not audit. Read squid configuration files. Domain allowed access. Read squid log files. Domain allowed access. Append squid log files. Domain allowed access. Create, read, write, and delete squid log files. Domain allowed access. Use squid services by connecting over TCP. (Deprecated) Domain allowed access. All of the rules required to administrate an squid environment. Domain allowed access. Role allowed access.

Determine whether squid can connect to all TCP ports.

Determine whether squid can run as a transparent proxy.

System Security Services Daemon.
Get attributes of sssd executable files. Domain allowed access. Execute a domain transition to run sssd. Domain allowed to transition. Execute sssd init scripts in the initrc domain. Domain allowed to transition. Read sssd configuration content. Domain allowed access. Write sssd configuration files. Domain allowed access. Create, read, write, and delete sssd configuration files. Domain allowed access. Read sssd public files. Domain allowed access. Create, read, write, and delete sssd public files. Domain allowed access. Read sssd pid files. Domain allowed access. Create, read, write, and delete sssd pid content. Domain allowed access. Search sssd lib directories. Domain allowed access. Do not audit attempts to search sssd lib directories. Domain to not audit. Read sssd lib files. Domain allowed access. Create, read, write, and delete sssd lib files. Domain allowed access. Send and receive messages from sssd over dbus. Domain allowed access. Connect to sssd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an sssd environment. Domain allowed access. Role allowed access.
SSL Tunneling Proxy.
Define the specified domain as a stunnel inetd service. The type associated with the stunnel inetd service process. The type associated with the process program. Read stunnel configuration content. Domain allowed access.
Server for the svn repository access method.
All of the rules required to administrate an svnserve environment. Domain allowed access. Role allowed access.
SUID/SGID program monitoring.
Read sxid log files. Domain allowed access.
Application that lets you synchronize your files across multiple devices.
Role access for Syncthing Role allowed access User domain for the role
Reports on various system states.
Create, read, write, and delete sysstat log files. Domain allowed access. All of the rules required to administrate an sysstat environment. Domain allowed access. Role allowed access.
instrumentation system for Linux.
All of the rules required to administrate an stapserver environment. Domain allowed access. Role allowed access.
Utilities for the tboot TXT module.
Execute txt-stat in the txtstat domain. Domain allowed to transition. Execute txt-stat in the txtstat domain, and allow the specified role the txtstat domain. Domain allowed to transition. The role to be allowed the txtstat domain.
TCP daemon.
Execute tcpd in the tcpd domain. Domain allowed to transition. Create a domain for services that utilize tcp wrappers. Type to be used as a domain. Type of the program to be used as an entry point to this domain.
TSS Core Services daemon.
Execute a domain transition to run tcsd. Domain allowed to transition. Execute tcsd init scripts in the initrc domain. Domain allowed to transition. Search tcsd lib directories. Domain allowed access. Create, read, write, and delete tcsd lib directories. Domain allowed access. Read tcsd lib files. Domain allowed access. Create, read, write, and delete tcsd lib files. Domain allowed access. All of the rules required to administrate an tcsd environment. Domain allowed access. Role allowed access.
Telepathy communications framework.
The template to define a telepathy domain.
Domain prefix to be used.
The role template for the telepathy module.

This template creates a derived domains which are used for window manager applications.

The prefix of the user domain (e.g., user is the prefix for user_t).
The role associated with the user domain.
The type of the user domain.
Connect to gabble with a unix domain stream socket. Domain allowed access. Send dbus messages to and from gabble. Domain allowed access. Send dbus messages to and from mission control. Domain allowed access. Read mission control process state files. Domain allowed access. Connect to msn with a unix domain stream socket. Domain allowed access. Connect to salut with a unix domain stream socket. Domain allowed access.

Determine whether telepathy connection managers can connect to generic tcp ports.

Determine whether telepathy connection managers can connect to any port.

Telnet daemon.
Read and write telnetd pty devices. Domain allowed access.
Trivial file transfer protocol daemon.
Read tftp content files. Domain allowed access. Create, read, write, and delete tftp rw content. Domain allowed access. Read tftpd configuration files. Domain allowed access. Create, read, write, and delete tftpd configuration files. Domain allowed access. Create objects in etc directories with tftp conf type. Domain allowed to transition. Class of the object being created. The name of the object being created. Create objects in tftpdir directories with a private type. Domain allowed access. Private file type. Class of the object being created. The name of the object being created. All of the rules required to administrate an tftp environment. Domain allowed access.

Determine whether tftp can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t.

Determine whether tftp can manage generic user home content.

Linux Target Framework Daemon.
Read and write tgtd semaphores. Domain allowed access. Create, read, write, and delete tgtd sempaphores. Domain allowed access. Connect to tgtd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an tgtd environment. Domain allowed access. Role allowed access.
Thunderbird email client.
Role access for thunderbird. Role allowed access. User domain for the role. Execute thunderbird in the thunderbird domain. Domain allowed to transition.
MIDI to WAV converter and player configured as a service.
Manage temporary directory sizes and file ages.
Execute tmpreaper in the caller domain. Domain allowed access.
The onion router.
Execute a domain transition to run tor. Domain allowed to transition. All of the rules required to administrate an tor environment. Domain allowed access. Role allowed access.

Determine whether tor can bind tcp sockets to all unreserved ports.

Portable Transparent Proxy Solution.
All of the rules required to administrate an transproxy environment. Domain allowed access. Role allowed access.
File integrity checker.
Execute tripwire in the tripwire domain. Domain allowed to transition. Execute tripwire in the tripwire domain, and allow the specified role the tripwire domain. Domain allowed to transition. Role allowed access. Execute twadmin in the twadmin domain. Domain allowed to transition. Execute twadmin in the twadmin domain, and allow the specified role the twadmin domain. Domain allowed to transition. Role allowed access. Execute twprint in the twprint domain. Domain allowed to transition. Execute twprint in the twprint domain, and allow the specified role the twprint domain. Domain allowed to transition. Role allowed access. Execute siggen in the siggen domain. Domain allowed to transition. Execute siggen in the siggen domain, and allow the specified role the siggen domain. Domain allowed to transition. Role allowed access.
Dynamic adaptive system tuning daemon.
Execute a domain transition to run tuned. Domain allowed to transition. Execute tuned in the caller domain. Domain allowed access. Read tuned pid files. Domain allowed access. Create, read, write, and delete tuned pid files. Domain allowed access. Execute tuned init scripts in the initrc domain. Domain allowed to transition. All of the rules required to administrate an tuned environment. Domain allowed access. Role allowed access.
High quality television application.
Role access for tvtime Role allowed access User domain for the role
Time zone updater.
Execute a domain transition to run tzdata. Domain allowed to transition. Execute tzdata in the tzdata domain, and allow the specified role the tzdata domain. Domain allowed to transition. Role allowed access.
UNIX Client-Server Program Interface for TCP.
Define a specified domain as a ucspitcp service. Domain allowed access. The type associated with the process program.
Iptables/netfilter userspace logging daemon.
Execute a domain transition to run ulogd. Domain allowed to transition. Read ulogd configuration files. Domain allowed access. Read ulogd log files. Domain allowed access. Search ulogd log files. Domain allowed access. Append to ulogd log files. Domain allowed access. All of the rules required to administrate an ulogd environment. Domain allowed access. Role allowed access.
User mode linux tools and services.
Role access for uml. Role allowed access. User domain for the role. Set attributes of uml pid sock files. Domain allowed access. Create, read, write, and delete uml pid files. Domain allowed access.
Red Hat utility to change fstab.
Execute updfstab in the updfstab domain. Domain allowed to transition.
Daemon to record and keep track of system up times.
All of the rules required to administrate an uptime environment. Domain allowed access. Role allowed access.
List kernel modules of USB devices.
Execute usbmodules in the usbmodules domain. Domain allowed to transition. Execute usbmodules in the usbmodules domain, and allow the specified role the usbmodules domain. Domain allowed to transition. Role allowed access.
USB multiplexing daemon for communicating with Apple iPod Touch and iPhone.
Execute a domain transition to run usbmuxd. Domain allowed to transition. Connect to usbmuxd with a unix domain stream socket. Domain allowed access.
A wrapper that helps users run system programs.
The role template for the userhelper module.
The prefix of the user role (e.g., user is the prefix for user_r).
The user role.
The user domain associated with the role.
Search userhelper configuration directories. Domain allowed access. Do not audit attempts to search userhelper configuration directories. Domain to not audit. Send and receive messages from consolehelper over dbus. Domain allowed access. Use userhelper all userhelper file descriptors. Domain allowed access. Send child terminated signals to all userhelper. Domain allowed access. Execute the userhelper program in the caller domain. Domain allowed access. Execute the consolehelper program in the caller domain. Domain allowed access.
User network interface configuration helper.
Execute usernetctl in the usernetctl domain. Domain allowed to transition. Execute usernetctl in the usernetctl domain, and allow the specified role the usernetctl domain. Domain allowed to transition. Role allowed access.
Unix to Unix Copy.
Execute uucico in the uucpd_t domain. Domain allowed to transition. Append uucp log files. Domain allowed access. Create, read, write, and delete uucp spool files. Domain allowed access. Execute uux in the uux_t domain. Domain allowed to transition. All of the rules required to administrate an uucp environment. Domain allowed access. Role allowed access.
UUID generation daemon.
Execute uuidd in the uuidd domain. Domain allowed to transition. Execute uuidd init scripts in the initrc domain. Domain allowed access. Search uuidd lib directories. Domain allowed access. Read uuidd lib files. Domain allowed access. Create, read, write, and delete uuidd lib files. Domain allowed access. Create, read, write, and delete uuidd lib directories. Domain allowed access. Read uuidd pid files. Domain allowed access. Connect to uuidd with an unix domain stream socket. Domain allowed access. All of the rules required to administrate an uuidd environment. Domain allowed access. Role allowed access.
University of Washington IMAP toolkit POP3 and IMAP mail server.
Execute imapd in the imapd domain. Domain allowed to transition.
Varnishd http accelerator daemon.
Execute varnishd in the varnishd domain. Domain allowed to transition. Execute varnishd in the caller domain. Domain allowed access. Read varnishd configuration files. Domain allowed access. Read varnish lib files. Domain allowed access. Read varnish log files. Domain allowed access. Append varnish log files. Domain allowed access. Create, read, write, and delete varnish log files. Domain allowed access. All of the rules required to administrate an varnishlog environment. Domain allowed access. Role allowed access. All of the rules required to administrate an varnishd environment. Domain allowed access. Role allowed access.

Determine whether varnishd can use the full TCP network.

run real-mode video BIOS code to alter hardware state.
Execute vbetool in the vbetool domain. Domain allowed to transition. Execute vbetool in the vbetool domain, and allow the specified role the vbetool domain. Domain allowed to transition. Role allowed access.

Determine whether attempts by vbetool to mmap low regions should be silently blocked.

Spice agent for Linux.
Execute a domain transition to run vdagent. Domain allowed access. Get attributes of vdagent executable files. Domain allowed access. Get attributes of vdagent log files. Domain allowed access. Read vdagent pid files. Domain allowed access. Connect to vdagent with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an vdagent environment. Domain allowed access. Role allowed access.
Virtual host metrics daemon.
Execute a domain transition to run vhostmd. Domain allowed to transition. Execute vhostmd init scripts in the initrc domain. Domain allowed to transition. Read vhostmd tmpfs files. Domain allowed access. Do not audit attempts to read vhostmd tmpfs files Domain to not audit. Read and write vhostmd tmpfs files. Domain allowed access. Create, read, write, and delete vhostmd tmpfs files. Domain allowed access. Read vhostmd pid files. Domain allowed access. Create, read, write, and delete vhostmd pid files. Domain allowed access. Connect to vhostmd with a unix domain stream socket. Domain allowed access. Do not audit attempts to read and write vhostmd unix domain stream sockets. Domain to not audit. All of the rules required to administrate an vhostmd environment. Domain allowed access. Role allowed access.
Libvirt virtualization API.
The template to define a virt domain.
Domain prefix to be used.
The template to define a virt lxc domain.
Domain prefix to be used.
Make the specified type virt image type. Type to be used as a virtual image. Execute a domain transition to run virtd. Domain allowed to transition. Execute a domain transition to run virt qmf. Domain allowed to transition. Execute a domain transition to run virt bridgehelper. Domain allowed to transition. Execute a domain transition to run virt leaseshelper. Domain allowed to transition. Execute bridgehelper in the bridgehelper domain, and allow the specified role the bridgehelper domain. Domain allowed to transition. Role allowed access. Execute virt domain in the their domain, and allow the specified role that virt domain. Domain allowed to transition. Role allowed access. Send generic signals to all virt domains. Domain allowed access. Send kill signals to all virt domains. Domain allowed access. Execute svirt lxc domains in their domain, and allow the specified role that svirt lxc domain. Domain allowed to transition. Role allowed access. Get attributes of virtd executable files. Domain allowed access. Connect to virt with a unix domain stream socket. Domain allowed access. Attach to virt tun devices. Domain allowed access. Read virt configuration content. Domain allowed access. Create, read, write, and delete virt configuration content. Domain allowed access. Read virt content. Domain allowed access. Create, read, write, and delete virt content. Domain allowed access. Relabel virt content. Domain allowed access. Create specified objects in user home directories with the virt content type. Domain allowed access. Class of the object being created. The name of the object being created. Create, read, write, and delete svirt home content. Domain allowed access. Relabel svirt home content. Domain allowed access. Create specified objects in user home directories with the svirt home type. Domain allowed access. Class of the object being created. The name of the object being created. Create specified objects in generic virt home directories with private home type. Domain allowed access. Private file type. Class of the object being created. The name of the object being created. Create, read, write, and delete virt home files. Domain allowed access. Create, read, write, and delete virt home content. Domain allowed access. Relabel virt home content. Domain allowed access. Create specified objects in user home directories with the generic virt home type. Domain allowed access. Class of the object being created. The name of the object being created. Read virt pid files. Domain allowed access. Create, read, write, and delete virt pid files. Domain allowed access. Search virt lib directories. Domain allowed access. Read virt lib files. Domain allowed access. Create, read, write, and delete virt lib files. Domain allowed access. Create objects in virt pid directories with a private type. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Read virt log files. Domain allowed access. Append virt log files. Domain allowed access. Create, read, write, and delete virt log files. Domain allowed access. Search virt image directories. Domain allowed access. Read virt image files. Domain allowed access. Read and write all virt image character files. Domain allowed access. Create, read, write, and delete svirt cache files. Domain allowed access. Create, read, write, and delete virt cache content. Domain allowed access. Create, read, write, and delete virt image files. Domain allowed access. All of the rules required to administrate an virt environment. Domain allowed access. Role allowed access.

Determine whether confined virtual guests can use serial/parallel communication ports.

Determine whether confined virtual guests can use executable memory and can make their stack executable.

Determine whether confined virtual guests can use fuse file systems.

Determine whether confined virtual guests can use nfs file systems.

Determine whether confined virtual guests can use cifs file systems.

Determine whether confined virtual guests can manage device configuration.

Determine whether confined virtual guests can use usb devices.

Determine whether confined virtual guests can interact with xserver.

Determine whether confined virtual guests can use vfio for pci device pass through (vt-d).

Lock one or more sessions on the Linux console.
Execute vlock in the vlock domain. Domain allowed to transition. Execute vlock in the vlock domain, and allow the specified role the vlock domain. Domain allowed to transition. Role allowed to access.
VMWare Workstation virtual machines.
Role access for vmware. Role allowed access. User domain for the role. Execute vmware host executables Domain allowed access. Read vmware system configuration files. Domain allowed access. Append vmware system configuration files. Domain allowed access. Append vmware log files. Domain allowed access.
Console network traffic monitor.
Execute a domain transition to run vnstat. Domain allowed to transition. Execute vnstat in the vnstat domain, and allow the specified role the vnstat domain. Domain allowed to transition. Role allowed access. Execute a domain transition to run vnstatd. Domain allowed to transition. Search vnstatd lib directories. Domain allowed access. Create, read, write, and delete vnstatd lib directories. Domain allowed access. Read vnstatd lib files. Domain allowed access. Create, read, write, and delete vnstatd lib files. Domain allowed access. All of the rules required to administrate an vnstatd environment. Domain allowed access. Role allowed access.
Virtual Private Networking client.
Execute vpn clients in the vpnc domain. Domain allowed to transition. Execute vpn clients in the vpnc domain, and allow the specified role the vpnc domain. Domain allowed to transition. Role allowed access. Send kill signals to vpnc. Domain allowed access. Send generic signals to vpnc. Domain allowed access. Send null signals to vpnc. Domain allowed access. Send and receive messages from vpnc over dbus. Domain allowed access. Relabelfrom from vpnc socket. Domain allowed access.
W3C Markup Validator.
Software watchdog.
All of the rules required to administrate an watchdog environment. Domain allowed access. Role allowed access.
Watchdog multiplexing daemon.
Connect to wdmd with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an wdmd environment. Domain allowed access. Role allowed access.
Web administrator role.
Change to the web administrator role. Role allowed access. Change from the web administrator role.

Change from the web administrator role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.

Determine whether webadm can manage generic user files.

Determine whether webadm can read generic user files.

Web server log analysis.
Execute webalizer in the webalizer domain. Domain allowed to transition. Execute webalizer in the webalizer domain, and allow the specified role the webalizer domain. Domain allowed to transition. Role allowed access. Manage webalizer usage files Domain allowed to manage webalizer usage files
Run Windows programs in Linux.
Role access for wine. Role allowed access. User domain for the role. The role template for the wine module.

This template creates a derived domains which are used for wine applications.

The prefix of the user domain (e.g., user is the prefix for user_t). The role associated with the user domain. The type of the user domain. Execute the wine program in the wine domain. Domain allowed to transition. Execute wine in the wine domain, and allow the specified role the wine domain. Domain allowed to transition. Role allowed access. Read and write wine Shared memory segments. Domain allowed access.

Determine whether attempts by wine to mmap low regions should be silently blocked.

Wireshark packet capture tool.
Role access for wireshark. Role allowed access. User domain for the role. Execute wireshark in wireshark domain. Domain allowed to transition.
X Window Managers.
The role template for the wm module.

This template creates a derived domains which are used for window manager applications.

The prefix of the user domain (e.g., user is the prefix for user_t).
The role associated with the user domain.
The type of the user domain.
Execute wm in the caller domain. Domain allowed access. Send and receive messages from specified wm over dbus. The prefix of the user domain (e.g., user is the prefix for user_t). Domain allowed access.
Xen hypervisor.
Execute a domain transition to run xend. Domain allowed to transition. Execute xend in the caller domain. Domain allowed access. Inherit and use xen file descriptors. Domain allowed access. Do not audit attempts to inherit xen file descriptors. Domain to not audit. Create, read, write, and delete xend image directories. Domain allowed access. Read xend image files. Domain allowed access. Read and write xend image files. Domain allowed access. Append xend log files. Domain allowed access. Create, read, write, and delete xend log files. Domain allowed access. Read xenstored pid files. Domain allowed access. Do not audit attempts to read and write Xen unix domain stream sockets. Domain to not audit. Connect to xenstored with a unix domain stream socket. Domain allowed access. Connect to xend with a unix domain stream socket. Domain allowed access. Execute a domain transition to run xm. Domain allowed to transition. Connect to xm with a unix domain stream socket. Domain allowed access.

Determine whether xend can run blktapctrl and tapdisk.

Determine whether xen can use fusefs file systems.

Determine whether xen can use nfs file systems.

Determine whether xen can use samba file systems.

X Windows Font Server.
Read xfs temporary sock files. Domain allowed access. Connect to xfs with a unix domain stream socket. Domain allowed access. Execute xfs in the caller domain. Domain allowed access. All of the rules required to administrate an xfs environment. Domain allowed access. Role allowed access.
Least privledge xwindows user role.
Change to the xguest role. Role allowed access. Change from the xguest role.

Change from the xguest role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.

Determine whether xguest can mount removable media.

Determine whether xguest can configure network manager.

Determine whether xguest can use blue tooth devices.

A X11-based print system and API.
Modular screen saver and locker for X11.
Role access for xscreensaver. Role allowed access. User domain for the role.
Yum/Apt Mirroring.
Execute yam in the yam domain. Domain allowed to transition. Execute yam in the yam domain, and allow the specified role the yam domain. Domain allowed to transition. Role allowed access. Read yam content. Domain allowed access.
Distributed infrastructure monitoring.
Execute a domain transition to run zabbix. Domain allowed to transition. Connect to zabbit on the TCP network. Domain allowed access. Read zabbix log files. Domain allowed access. Append zabbix log files. Domain allowed access. Read zabbix pid files. Domain allowed access. Connect to zabbix agent on the TCP network. Domain allowed access. All of the rules required to administrate an zabbix environment. Domain allowed access. Role allowed access.

Determine whether zabbix can connect to all TCP ports

Zarafa collaboration platform.
The template to define a zarafa domain.
Domain prefix to be used.
search zarafa configuration directories. Domain allowed access. Execute a domain transition to run zarafa deliver. Domain allowed to transition. Execute a domain transition to run zarafa server. Domain allowed to transition. Connect to zarafa server with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an zarafa environment. Domain allowed access. Role allowed access.
Zebra border gateway protocol network routing service.
Read zebra configuration content. Domain allowed access. Connect to zebra with a unix domain stream socket. Domain allowed access. All of the rules required to administrate an zebra environment. Domain allowed access. Role allowed access.

Determine whether zebra daemon can manage its configuration files.

z/OS Remote-services Audit dispatcher plugin.
Execute a domain transition to run audispd-zos-remote. Domain allowed to transition. Execute zos remote in the zos remote domain, and allow the specified role the zos remote domain. Domain allowed to transition. Role allowed access.
Policy modules for kernel resources.
Core policy for shells, and generic programs in /bin, /sbin, /usr/bin, and /usr/sbin.
Contains the base bin and sbin directory types which need to be searched for the kernel to run init.
Make the specified type usable for files that are exectuables, such as binary programs. This does not include shared libraries. Type to be used for files. Create a aliased type to generic bin files. (Deprecated)

Create a aliased type to generic bin files. (Deprecated)

This is added to support targeted policy. Its use should be limited. It has no effect on the strict policy.

Alias type for bin_t. Make general progams in bin an entrypoint for the specified domain. The domain for which bin_t is an entrypoint. Make general progams in sbin an entrypoint for the specified domain. (Deprecated) The domain for which sbin programs are an entrypoint. Make the shell an entrypoint for the specified domain. The domain for which the shell is an entrypoint. Search the contents of bin directories. Domain allowed access. Do not audit attempts to search the contents of bin directories. Domain to not audit. List the contents of bin directories. Domain allowed access. Do not audit attempts to write bin directories. Domain to not audit. Get the attributes of files in bin directories. Domain allowed access. Do not audit attempts to get the attributes of files in bin directories. Domain to not audit. Read files in bin directories. Domain allowed access. Do not audit attempts to write bin files. Domain to not audit. Read symbolic links in bin directories. Domain allowed access. Read pipes in bin directories. Domain allowed access. Read named sockets in bin directories. Domain allowed access. Execute generic programs in bin directories, in the caller domain.

Allow the specified domain to execute generic programs in system bin directories (/bin, /sbin, /usr/bin, /usr/sbin) a without domain transition.

Typically, this interface should be used when the domain executes general system progams within the privileges of the source domain. Some examples of these programs are ls, cp, sed, python, and tar. This does not include shells, such as bash.

Related interface:

- corecmd_exec_shell()

Domain allowed access. Create, read, write, and delete bin files. Domain allowed access. Relabel to and from the bin type. Domain allowed access. Mmap a bin file as executable. Domain allowed access. Execute a file in a bin directory in the specified domain but do not do it automatically. This is an explicit transition, requiring the caller to use setexeccon().

Execute a file in a bin directory in the specified domain. This allows the specified domain to execute any file on these filesystems in the specified domain. This is not suggested.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

This interface was added to handle the userhelper policy.

Domain allowed to transition. The type of the new process. Execute a file in a bin directory in the specified domain.

Execute a file in a bin directory in the specified domain. This allows the specified domain to execute any file on these filesystems in the specified domain. This is not suggested.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

This interface was added to handle the ssh-agent policy.

Domain allowed to transition. The type of the new process. Search the contents of sbin directories. (Deprecated) Domain allowed access. Do not audit attempts to search sbin directories. (Deprecated) Domain to not audit. List the contents of sbin directories. (Deprecated) Domain allowed access. Do not audit attempts to write sbin directories. (Deprecated) Domain to not audit. Get the attributes of sbin files. (Deprecated) Domain allowed access. Do not audit attempts to get the attibutes of sbin files. (Deprecated) Domain to not audit. Read files in sbin directories. (Deprecated) Domain allowed access. Read symbolic links in sbin directories. (Deprecated) Domain allowed access. Read named pipes in sbin directories. (Deprecated) Domain allowed access. Read named sockets in sbin directories. (Deprecated) Domain allowed access. Execute generic programs in sbin directories, in the caller domain. (Deprecated) Domain allowed access. Create, read, write, and delete sbin files. (Deprecated) Domain allowed access. Relabel to and from the sbin type. (Deprecated) Domain allowed access. Mmap a sbin file as executable. (Deprecated) Domain allowed access. Execute a file in a sbin directory in the specified domain. (Deprecated)

Execute a file in a sbin directory in the specified domain. This allows the specified domain to execute any file on these filesystems in the specified domain. This is not suggested. (Deprecated)

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

This interface was added to handle the ssh-agent policy.

Domain allowed to transition. The type of the new process. Execute a file in a sbin directory in the specified domain but do not do it automatically. This is an explicit transition, requiring the caller to use setexeccon(). (Deprecated)

Execute a file in a sbin directory in the specified domain. This allows the specified domain to execute any file on these filesystems in the specified domain. This is not suggested. (Deprecated)

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

This interface was added to handle the userhelper policy.

Domain allowed to transition. The type of the new process. Check if a shell is executable (DAC-wise). Domain allowed access. Execute shells in the caller domain.

Allow the specified domain to execute shells without a domain transition.

Typically, this interface should be used when the domain executes shells within the privileges of the source domain. Some examples of these programs are bash, tcsh, and zsh.

Related interface:

- corecmd_exec_bin()

Domain allowed access. Execute ls in the caller domain. (Deprecated) Domain allowed access. Execute a shell in the target domain. This is an explicit transition, requiring the caller to use setexeccon().

Execute a shell in the target domain. This is an explicit transition, requiring the caller to use setexeccon().

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. The type of the shell process. Execute a shell in the specified domain.

Execute a shell in the specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. The type of the shell process. Execute chroot in the caller domain. Domain allowed access. Get the attributes of all executable files. Domain allowed access. Read all executable files. Domain allowed access. Execute all executable files. Domain allowed access. Do not audit attempts to execute all executables. Domain to not audit. Create, read, write, and all executable files. Domain allowed access. Relabel to and from the bin type. Domain allowed access. Mmap all executables as executable. Domain allowed access.
Policy controlling access to network objects
Contains the initial SIDs for network objects.
Define type to be a network port type

Define type to be a network port type

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for network ports. Define network type to be a reserved port (lt 1024)

Define network type to be a reserved port (lt 1024)

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for network ports. Define network type to be a rpc port ( 512 lt PORT lt 1024)

Define network type to be a rpc port ( 512 lt PORT lt 1024)

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for network ports. Define type to be a network node type

Define type to be a network node type

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for network nodes. Define type to be a network packet type

Define type to be a network packet type

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for a network packet. Define type to be a network client packet type

Define type to be a network client packet type

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for a network client packet. Define type to be a network server packet type

Define type to be a network server packet type

This is for supporting third party modules and its use is not allowed in upstream reference policy.

Type to be used for a network server packet. Make the specified type usable for labeled ipsec. Type to be used for labeled ipsec. Send and receive TCP network traffic on generic interfaces.

Allow the specified domain to send and receive TCP network traffic on generic network interfaces.

Related interface:

- corenet_all_recvfrom_unlabeled()
- corenet_tcp_sendrecv_generic_node()
- corenet_tcp_sendrecv_all_ports()
- corenet_tcp_connect_all_ports()

Example client being able to connect to all ports over generic nodes, without labeled networking:

allow myclient_t self:tcp_socket create_stream_socket_perms; corenet_tcp_sendrecv_generic_if(myclient_t) corenet_tcp_sendrecv_generic_node(myclient_t) corenet_tcp_sendrecv_all_ports(myclient_t) corenet_tcp_connect_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Send UDP network traffic on generic interfaces. Domain allowed access. Dontaudit attempts to send UDP network traffic on generic interfaces. Domain to not audit. Receive UDP network traffic on generic interfaces. Domain allowed access. Do not audit attempts to receive UDP network traffic on generic interfaces. Domain to not audit. Send and receive UDP network traffic on generic interfaces.

Allow the specified domain to send and receive UDP network traffic on generic network interfaces.

Related interface:

- corenet_all_recvfrom_unlabeled()
- corenet_udp_sendrecv_generic_node()
- corenet_udp_sendrecv_all_ports()

Example client being able to send to all ports over generic nodes, without labeled networking:

allow myclient_t self:udp_socket create_socket_perms; corenet_udp_sendrecv_generic_if(myclient_t) corenet_udp_sendrecv_generic_node(myclient_t) corenet_udp_sendrecv_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Do not audit attempts to send and receive UDP network traffic on generic interfaces. Domain to not audit. Send raw IP packets on generic interfaces. Domain allowed access. Receive raw IP packets on generic interfaces. Domain allowed access. Send and receive raw IP packets on generic interfaces. Domain allowed access. Allow outgoing network traffic on the generic interfaces. The peer label of the outgoing network traffic. Allow incoming traffic on the generic interfaces. The peer label of the incoming network traffic. Allow incoming and outgoing network traffic on the generic interfaces. The peer label of the network traffic. Send and receive TCP network traffic on all interfaces. Domain allowed access. Send UDP network traffic on all interfaces. Domain allowed access. Receive UDP network traffic on all interfaces. Domain allowed access. Send and receive UDP network traffic on all interfaces. Domain allowed access. Send raw IP packets on all interfaces. Domain allowed access. Receive raw IP packets on all interfaces. Domain allowed access. Send and receive raw IP packets on all interfaces. Domain allowed access. Send and receive TCP network traffic on generic nodes.

Allow the specified domain to send and receive TCP network traffic to/from generic network nodes (hostnames/networks).

Related interface:

- corenet_all_recvfrom_unlabeled()
- corenet_tcp_sendrecv_generic_if()
- corenet_tcp_sendrecv_all_ports()
- corenet_tcp_connect_all_ports()

Example client being able to connect to all ports over generic nodes, without labeled networking:

allow myclient_t self:tcp_socket create_stream_socket_perms; corenet_tcp_sendrecv_generic_if(myclient_t) corenet_tcp_sendrecv_generic_node(myclient_t) corenet_tcp_sendrecv_all_ports(myclient_t) corenet_tcp_connect_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Send UDP network traffic on generic nodes. Domain allowed access. Receive UDP network traffic on generic nodes. Domain allowed access. Send and receive UDP network traffic on generic nodes.

Allow the specified domain to send and receive UDP network traffic to/from generic network nodes (hostnames/networks).

Related interface:

- corenet_all_recvfrom_unlabeled()
- corenet_udp_sendrecv_generic_if()
- corenet_udp_sendrecv_all_ports()

Example client being able to send to all ports over generic nodes, without labeled networking:

allow myclient_t self:udp_socket create_socket_perms; corenet_udp_sendrecv_generic_if(myclient_t) corenet_udp_sendrecv_generic_node(myclient_t) corenet_udp_sendrecv_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Send raw IP packets on generic nodes. Domain allowed access. Receive raw IP packets on generic nodes. Domain allowed access. Send and receive raw IP packets on generic nodes. Domain allowed access. Bind TCP sockets to generic nodes.

Bind TCP sockets to generic nodes. This is necessary for binding a socket so it can be used for servers to listen for incoming connections.

Related interface:

- corenet_udp_bind_generic_node()

Domain allowed access. Bind UDP sockets to generic nodes.

Bind UDP sockets to generic nodes. This is necessary for binding a socket so it can be used for servers to listen for incoming connections.

Related interface:

- corenet_tcp_bind_generic_node()

Domain allowed access. Bind raw sockets to generic nodes. Domain allowed access. Allow outgoing network traffic to generic nodes. The peer label of the outgoing network traffic. Allow incoming network traffic from generic nodes. The peer label of the incoming network traffic. Allow incoming and outgoing network traffic with generic nodes. The peer label of the network traffic. Send and receive TCP network traffic on all nodes. Domain allowed access. Send UDP network traffic on all nodes. Domain allowed access. Do not audit attempts to send UDP network traffic on any nodes. Domain to not audit. Receive UDP network traffic on all nodes. Domain allowed access. Do not audit attempts to receive UDP network traffic on all nodes. Domain to not audit. Send and receive UDP network traffic on all nodes. Domain allowed access. Do not audit attempts to send and receive UDP network traffic on any nodes nodes. Domain to not audit. Send raw IP packets on all nodes. Domain allowed access. Receive raw IP packets on all nodes. Domain allowed access. Send and receive raw IP packets on all nodes. Domain allowed access. Bind TCP sockets to all nodes. Domain allowed access. Bind UDP sockets to all nodes. Domain allowed access. Bind raw sockets to all nodes. Domain allowed access. Send and receive TCP network traffic on generic ports. Domain allowed access. Do not audit send and receive TCP network traffic on generic ports. Domain allowed access. Send UDP network traffic on generic ports. Domain allowed access. Receive UDP network traffic on generic ports. Domain allowed access. Send and receive UDP network traffic on generic ports. Domain allowed access. Bind TCP sockets to generic ports. Domain allowed access. Do not audit bind TCP sockets to generic ports. Domain to not audit. Bind UDP sockets to generic ports. Domain allowed access. Connect TCP sockets to generic ports. Domain allowed access. Send and receive TCP network traffic on all ports.

Send and receive TCP network traffic on all ports. Related interfaces:

- corenet_all_recvfrom_unlabeled()
- corenet_tcp_sendrecv_generic_if()
- corenet_tcp_sendrecv_generic_node()
- corenet_tcp_connect_all_ports()
- corenet_tcp_bind_all_ports()

Example client being able to connect to all ports over generic nodes, without labeled networking:

allow myclient_t self:tcp_socket create_stream_socket_perms; corenet_tcp_sendrecv_generic_if(myclient_t) corenet_tcp_sendrecv_generic_node(myclient_t) corenet_tcp_sendrecv_all_ports(myclient_t) corenet_tcp_connect_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Send UDP network traffic on all ports. Domain allowed access. Receive UDP network traffic on all ports. Domain allowed access. Send and receive UDP network traffic on all ports.

Send and receive UDP network traffic on all ports. Related interfaces:

- corenet_all_recvfrom_unlabeled()
- corenet_udp_sendrecv_generic_if()
- corenet_udp_sendrecv_generic_node()
- corenet_udp_bind_all_ports()

Example client being able to send to all ports over generic nodes, without labeled networking:

allow myclient_t self:udp_socket create_socket_perms; corenet_udp_sendrecv_generic_if(myclient_t) corenet_udp_sendrecv_generic_node(myclient_t) corenet_udp_sendrecv_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Bind TCP sockets to all ports. Domain allowed access. Do not audit attepts to bind TCP sockets to any ports. Domain to not audit. Bind UDP sockets to all ports. Domain allowed access. Do not audit attepts to bind UDP sockets to any ports. Domain to not audit. Connect TCP sockets to all ports.

Connect TCP sockets to all ports

Related interfaces:

- corenet_all_recvfrom_unlabeled()
- corenet_tcp_sendrecv_generic_if()
- corenet_tcp_sendrecv_generic_node()
- corenet_tcp_sendrecv_all_ports()
- corenet_tcp_bind_all_ports()

Example client being able to connect to all ports over generic nodes, without labeled networking:

allow myclient_t self:tcp_socket create_stream_socket_perms; corenet_tcp_sendrecv_generic_if(myclient_t) corenet_tcp_sendrecv_generic_node(myclient_t) corenet_tcp_sendrecv_all_ports(myclient_t) corenet_tcp_connect_all_ports(myclient_t) corenet_all_recvfrom_unlabeled(myclient_t)

Domain allowed access. Do not audit attempts to connect TCP sockets to all ports. Domain to not audit. Send and receive TCP network traffic on generic reserved ports. Domain allowed access. Send UDP network traffic on generic reserved ports. Domain allowed access. Receive UDP network traffic on generic reserved ports. Domain allowed access. Send and receive UDP network traffic on generic reserved ports. Domain allowed access. Bind TCP sockets to generic reserved ports. Domain allowed access. Bind UDP sockets to generic reserved ports. Domain allowed access. Connect TCP sockets to generic reserved ports. Domain allowed access. Send and receive TCP network traffic on all reserved ports. Domain allowed access. Send UDP network traffic on all reserved ports. Domain allowed access. Receive UDP network traffic on all reserved ports. Domain allowed access. Send and receive UDP network traffic on all reserved ports. Domain allowed access. Bind TCP sockets to all reserved ports. Domain allowed access. Do not audit attempts to bind TCP sockets to all reserved ports. Domain to not audit. Bind UDP sockets to all reserved ports. Domain allowed access. Do not audit attempts to bind UDP sockets to all reserved ports. Domain to not audit. Bind TCP sockets to all ports > 1024. Domain allowed access. Bind UDP sockets to all ports > 1024. Domain allowed access. Connect TCP sockets to reserved ports. Domain allowed access. Connect TCP sockets to all ports > 1024. Domain allowed access. Do not audit attempts to connect TCP sockets all reserved ports. Domain to not audit. Connect TCP sockets to rpc ports. Domain allowed access. Do not audit attempts to connect TCP sockets all rpc ports. Domain to not audit. Read and write the TUN/TAP virtual network device. The domain allowed access. Do not audit attempts to read or write the TUN/TAP virtual network device. Domain to not audit. Getattr the point-to-point device. The domain allowed access. Read and write the point-to-point device. The domain allowed access. Bind TCP sockets to all RPC ports. Domain allowed access. Do not audit attempts to bind TCP sockets to all RPC ports. Domain to not audit. Bind UDP sockets to all RPC ports. Domain allowed access. Do not audit attempts to bind UDP sockets to all RPC ports. Domain to not audit. Send and receive messages on a non-encrypted (no IPSEC) network session.

Send and receive messages on a non-encrypted (no IPSEC) network session. (Deprecated)

The corenet_all_recvfrom_unlabeled() interface should be used instead of this one.

Domain allowed access. Do not audit attempts to send and receive messages on a non-encrypted (no IPSEC) network session.

Do not audit attempts to send and receive messages on a non-encrypted (no IPSEC) network session.

The corenet_dontaudit_all_recvfrom_unlabeled() interface should be used instead of this one.

Domain to not audit. Receive TCP packets from a NetLabel connection. Domain allowed access. Receive TCP packets from a NetLabel connection. Domain allowed access. Receive TCP packets from an unlabled connection. Domain allowed access. Do not audit attempts to receive TCP packets from a NetLabel connection. Domain to not audit. Do not audit attempts to receive TCP packets from a NetLabel connection. Domain to not audit. Do not audit attempts to receive TCP packets from an unlabeled connection. Domain to not audit. Receive UDP packets from a NetLabel connection. Domain allowed access. Receive UDP packets from a NetLabel connection. Domain allowed access. Receive UDP packets from an unlabeled connection. Domain allowed access. Do not audit attempts to receive UDP packets from a NetLabel connection. Domain to not audit. Do not audit attempts to receive UDP packets from a NetLabel connection. Domain to not audit. Do not audit attempts to receive UDP packets from an unlabeled connection. Domain to not audit. Receive Raw IP packets from a NetLabel connection. Domain allowed access. Receive Raw IP packets from a NetLabel connection. Domain allowed access. Receive Raw IP packets from an unlabeled connection. Domain allowed access. Do not audit attempts to receive Raw IP packets from a NetLabel connection. Domain to not audit. Do not audit attempts to receive Raw IP packets from a NetLabel connection. Domain to not audit. Do not audit attempts to receive Raw IP packets from an unlabeled connection. Domain to not audit. Receive packets from an unlabeled connection.

Allow the specified domain to receive packets from an unlabeled connection. On machines that do not utilize labeled networking, this will be required on all networking domains. On machines tha do utilize labeled networking, this will be required for any networking domain that is allowed to receive network traffic that does not have a label.

Domain allowed access. Receive packets from a NetLabel connection.

Allow the specified domain to receive NetLabel network traffic, which utilizes the Commercial IP Security Option (CIPSO) to set the MLS level of the network packets. This is required for all networking domains that receive NetLabel network traffic.

Domain allowed access. Do not audit attempts to receive packets from an unlabeled connection. Domain allowed access. Do not audit attempts to receive packets from a NetLabel connection. Domain to not audit. Rules for receiving labeled TCP packets.

Rules for receiving labeled TCP packets.

Due to the nature of TCP, this is bidirectional.

Domain allowed access. Peer domain. Rules for receiving labeled UDP packets. Domain allowed access. Peer domain. Rules for receiving labeled raw IP packets. Domain allowed access. Peer domain. Rules for receiving labeled packets via TCP, UDP and raw IP.

Rules for receiving labeled packets via TCP, UDP and raw IP.

Due to the nature of TCP, the rules (for TCP networking only) are bidirectional.

Domain allowed access. Peer domain. Allow specified type to set the context of a SPD entry for labeled ipsec associations. Domain allowed access. Send generic client packets. Domain allowed access. Receive generic client packets. Domain allowed access. Send and receive generic client packets. Domain allowed access. Relabel packets to the generic client packet type. Domain allowed access. Send generic server packets. Domain allowed access. Receive generic server packets. Domain allowed access. Send and receive generic server packets. Domain allowed access. Relabel packets to the generic server packet type. Domain allowed access. Send and receive unlabeled packets.

Send and receive unlabeled packets. These packets do not match any netfilter SECMARK rules.

Domain allowed access. Send all client packets. Domain allowed access. Receive all client packets. Domain allowed access. Send and receive all client packets. Domain allowed access. Relabel packets to any client packet type. Domain allowed access. Send all server packets. Domain allowed access. Receive all server packets. Domain allowed access. Send and receive all server packets. Domain allowed access. Relabel packets to any server packet type. Domain allowed access. Send all packets. Domain allowed access. Receive all packets. Domain allowed access. Send and receive all packets. Domain allowed access. Relabel packets to any packet type. Domain allowed access. Unconfined access to network objects. The domain allowed access. Send and receive TCP traffic on the afs_bos port. Domain allowed access. Send UDP traffic on the afs_bos port. Domain allowed access. Do not audit attempts to send UDP traffic on the afs_bos port. Domain to not audit. Receive UDP traffic on the afs_bos port. Domain allowed access. Do not audit attempts to receive UDP traffic on the afs_bos port. Domain to not audit. Send and receive UDP traffic on the afs_bos port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the afs_bos port. Domain to not audit. Bind TCP sockets to the afs_bos port. Domain allowed access. Bind UDP sockets to the afs_bos port. Domain allowed access. Make a TCP connection to the afs_bos port. Domain allowed access. Send afs_bos_client packets. Domain allowed access. Do not audit attempts to send afs_bos_client packets. Domain to not audit. Receive afs_bos_client packets. Domain allowed access. Do not audit attempts to receive afs_bos_client packets. Domain allowed access. Send and receive afs_bos_client packets. Domain allowed access. Do not audit attempts to send and receive afs_bos_client packets. Domain to not audit. Relabel packets to afs_bos_client the packet type. Domain allowed access. Send afs_bos_server packets. Domain allowed access. Do not audit attempts to send afs_bos_server packets. Domain to not audit. Receive afs_bos_server packets. Domain allowed access. Do not audit attempts to receive afs_bos_server packets. Domain allowed access. Send and receive afs_bos_server packets. Domain allowed access. Do not audit attempts to send and receive afs_bos_server packets. Domain to not audit. Relabel packets to afs_bos_server the packet type. Domain allowed access. Send and receive TCP traffic on the afs_fs port. Domain allowed access. Send UDP traffic on the afs_fs port. Domain allowed access. Do not audit attempts to send UDP traffic on the afs_fs port. Domain to not audit. Receive UDP traffic on the afs_fs port. Domain allowed access. Do not audit attempts to receive UDP traffic on the afs_fs port. Domain to not audit. Send and receive UDP traffic on the afs_fs port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the afs_fs port. Domain to not audit. Bind TCP sockets to the afs_fs port. Domain allowed access. Bind UDP sockets to the afs_fs port. Domain allowed access. Make a TCP connection to the afs_fs port. Domain allowed access. Send afs_fs_client packets. Domain allowed access. Do not audit attempts to send afs_fs_client packets. Domain to not audit. Receive afs_fs_client packets. Domain allowed access. Do not audit attempts to receive afs_fs_client packets. Domain allowed access. Send and receive afs_fs_client packets. Domain allowed access. Do not audit attempts to send and receive afs_fs_client packets. Domain to not audit. Relabel packets to afs_fs_client the packet type. Domain allowed access. Send afs_fs_server packets. Domain allowed access. Do not audit attempts to send afs_fs_server packets. Domain to not audit. Receive afs_fs_server packets. Domain allowed access. Do not audit attempts to receive afs_fs_server packets. Domain allowed access. Send and receive afs_fs_server packets. Domain allowed access. Do not audit attempts to send and receive afs_fs_server packets. Domain to not audit. Relabel packets to afs_fs_server the packet type. Domain allowed access. Send and receive TCP traffic on the afs_ka port. Domain allowed access. Send UDP traffic on the afs_ka port. Domain allowed access. Do not audit attempts to send UDP traffic on the afs_ka port. Domain to not audit. Receive UDP traffic on the afs_ka port. Domain allowed access. Do not audit attempts to receive UDP traffic on the afs_ka port. Domain to not audit. Send and receive UDP traffic on the afs_ka port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the afs_ka port. Domain to not audit. Bind TCP sockets to the afs_ka port. Domain allowed access. Bind UDP sockets to the afs_ka port. Domain allowed access. Make a TCP connection to the afs_ka port. Domain allowed access. Send afs_ka_client packets. Domain allowed access. Do not audit attempts to send afs_ka_client packets. Domain to not audit. Receive afs_ka_client packets. Domain allowed access. Do not audit attempts to receive afs_ka_client packets. Domain allowed access. Send and receive afs_ka_client packets. Domain allowed access. Do not audit attempts to send and receive afs_ka_client packets. Domain to not audit. Relabel packets to afs_ka_client the packet type. Domain allowed access. Send afs_ka_server packets. Domain allowed access. Do not audit attempts to send afs_ka_server packets. Domain to not audit. Receive afs_ka_server packets. Domain allowed access. Do not audit attempts to receive afs_ka_server packets. Domain allowed access. Send and receive afs_ka_server packets. Domain allowed access. Do not audit attempts to send and receive afs_ka_server packets. Domain to not audit. Relabel packets to afs_ka_server the packet type. Domain allowed access. Send and receive TCP traffic on the afs_pt port. Domain allowed access. Send UDP traffic on the afs_pt port. Domain allowed access. Do not audit attempts to send UDP traffic on the afs_pt port. Domain to not audit. Receive UDP traffic on the afs_pt port. Domain allowed access. Do not audit attempts to receive UDP traffic on the afs_pt port. Domain to not audit. Send and receive UDP traffic on the afs_pt port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the afs_pt port. Domain to not audit. Bind TCP sockets to the afs_pt port. Domain allowed access. Bind UDP sockets to the afs_pt port. Domain allowed access. Make a TCP connection to the afs_pt port. Domain allowed access. Send afs_pt_client packets. Domain allowed access. Do not audit attempts to send afs_pt_client packets. Domain to not audit. Receive afs_pt_client packets. Domain allowed access. Do not audit attempts to receive afs_pt_client packets. Domain allowed access. Send and receive afs_pt_client packets. Domain allowed access. Do not audit attempts to send and receive afs_pt_client packets. Domain to not audit. Relabel packets to afs_pt_client the packet type. Domain allowed access. Send afs_pt_server packets. Domain allowed access. Do not audit attempts to send afs_pt_server packets. Domain to not audit. Receive afs_pt_server packets. Domain allowed access. Do not audit attempts to receive afs_pt_server packets. Domain allowed access. Send and receive afs_pt_server packets. Domain allowed access. Do not audit attempts to send and receive afs_pt_server packets. Domain to not audit. Relabel packets to afs_pt_server the packet type. Domain allowed access. Send and receive TCP traffic on the afs_vl port. Domain allowed access. Send UDP traffic on the afs_vl port. Domain allowed access. Do not audit attempts to send UDP traffic on the afs_vl port. Domain to not audit. Receive UDP traffic on the afs_vl port. Domain allowed access. Do not audit attempts to receive UDP traffic on the afs_vl port. Domain to not audit. Send and receive UDP traffic on the afs_vl port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the afs_vl port. Domain to not audit. Bind TCP sockets to the afs_vl port. Domain allowed access. Bind UDP sockets to the afs_vl port. Domain allowed access. Make a TCP connection to the afs_vl port. Domain allowed access. Send afs_vl_client packets. Domain allowed access. Do not audit attempts to send afs_vl_client packets. Domain to not audit. Receive afs_vl_client packets. Domain allowed access. Do not audit attempts to receive afs_vl_client packets. Domain allowed access. Send and receive afs_vl_client packets. Domain allowed access. Do not audit attempts to send and receive afs_vl_client packets. Domain to not audit. Relabel packets to afs_vl_client the packet type. Domain allowed access. Send afs_vl_server packets. Domain allowed access. Do not audit attempts to send afs_vl_server packets. Domain to not audit. Receive afs_vl_server packets. Domain allowed access. Do not audit attempts to receive afs_vl_server packets. Domain allowed access. Send and receive afs_vl_server packets. Domain allowed access. Do not audit attempts to send and receive afs_vl_server packets. Domain to not audit. Relabel packets to afs_vl_server the packet type. Domain allowed access. Send and receive TCP traffic on the afs3_callback port. Domain allowed access. Send UDP traffic on the afs3_callback port. Domain allowed access. Do not audit attempts to send UDP traffic on the afs3_callback port. Domain to not audit. Receive UDP traffic on the afs3_callback port. Domain allowed access. Do not audit attempts to receive UDP traffic on the afs3_callback port. Domain to not audit. Send and receive UDP traffic on the afs3_callback port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the afs3_callback port. Domain to not audit. Bind TCP sockets to the afs3_callback port. Domain allowed access. Bind UDP sockets to the afs3_callback port. Domain allowed access. Make a TCP connection to the afs3_callback port. Domain allowed access. Send afs3_callback_client packets. Domain allowed access. Do not audit attempts to send afs3_callback_client packets. Domain to not audit. Receive afs3_callback_client packets. Domain allowed access. Do not audit attempts to receive afs3_callback_client packets. Domain allowed access. Send and receive afs3_callback_client packets. Domain allowed access. Do not audit attempts to send and receive afs3_callback_client packets. Domain to not audit. Relabel packets to afs3_callback_client the packet type. Domain allowed access. Send afs3_callback_server packets. Domain allowed access. Do not audit attempts to send afs3_callback_server packets. Domain to not audit. Receive afs3_callback_server packets. Domain allowed access. Do not audit attempts to receive afs3_callback_server packets. Domain allowed access. Send and receive afs3_callback_server packets. Domain allowed access. Do not audit attempts to send and receive afs3_callback_server packets. Domain to not audit. Relabel packets to afs3_callback_server the packet type. Domain allowed access. Send and receive TCP traffic on the agentx port. Domain allowed access. Send UDP traffic on the agentx port. Domain allowed access. Do not audit attempts to send UDP traffic on the agentx port. Domain to not audit. Receive UDP traffic on the agentx port. Domain allowed access. Do not audit attempts to receive UDP traffic on the agentx port. Domain to not audit. Send and receive UDP traffic on the agentx port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the agentx port. Domain to not audit. Bind TCP sockets to the agentx port. Domain allowed access. Bind UDP sockets to the agentx port. Domain allowed access. Make a TCP connection to the agentx port. Domain allowed access. Send agentx_client packets. Domain allowed access. Do not audit attempts to send agentx_client packets. Domain to not audit. Receive agentx_client packets. Domain allowed access. Do not audit attempts to receive agentx_client packets. Domain allowed access. Send and receive agentx_client packets. Domain allowed access. Do not audit attempts to send and receive agentx_client packets. Domain to not audit. Relabel packets to agentx_client the packet type. Domain allowed access. Send agentx_server packets. Domain allowed access. Do not audit attempts to send agentx_server packets. Domain to not audit. Receive agentx_server packets. Domain allowed access. Do not audit attempts to receive agentx_server packets. Domain allowed access. Send and receive agentx_server packets. Domain allowed access. Do not audit attempts to send and receive agentx_server packets. Domain to not audit. Relabel packets to agentx_server the packet type. Domain allowed access. Send and receive TCP traffic on the amanda port. Domain allowed access. Send UDP traffic on the amanda port. Domain allowed access. Do not audit attempts to send UDP traffic on the amanda port. Domain to not audit. Receive UDP traffic on the amanda port. Domain allowed access. Do not audit attempts to receive UDP traffic on the amanda port. Domain to not audit. Send and receive UDP traffic on the amanda port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the amanda port. Domain to not audit. Bind TCP sockets to the amanda port. Domain allowed access. Bind UDP sockets to the amanda port. Domain allowed access. Make a TCP connection to the amanda port. Domain allowed access. Send amanda_client packets. Domain allowed access. Do not audit attempts to send amanda_client packets. Domain to not audit. Receive amanda_client packets. Domain allowed access. Do not audit attempts to receive amanda_client packets. Domain allowed access. Send and receive amanda_client packets. Domain allowed access. Do not audit attempts to send and receive amanda_client packets. Domain to not audit. Relabel packets to amanda_client the packet type. Domain allowed access. Send amanda_server packets. Domain allowed access. Do not audit attempts to send amanda_server packets. Domain to not audit. Receive amanda_server packets. Domain allowed access. Do not audit attempts to receive amanda_server packets. Domain allowed access. Send and receive amanda_server packets. Domain allowed access. Do not audit attempts to send and receive amanda_server packets. Domain to not audit. Relabel packets to amanda_server the packet type. Domain allowed access. Send and receive TCP traffic on the amavisd_recv port. Domain allowed access. Send UDP traffic on the amavisd_recv port. Domain allowed access. Do not audit attempts to send UDP traffic on the amavisd_recv port. Domain to not audit. Receive UDP traffic on the amavisd_recv port. Domain allowed access. Do not audit attempts to receive UDP traffic on the amavisd_recv port. Domain to not audit. Send and receive UDP traffic on the amavisd_recv port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the amavisd_recv port. Domain to not audit. Bind TCP sockets to the amavisd_recv port. Domain allowed access. Bind UDP sockets to the amavisd_recv port. Domain allowed access. Make a TCP connection to the amavisd_recv port. Domain allowed access. Send amavisd_recv_client packets. Domain allowed access. Do not audit attempts to send amavisd_recv_client packets. Domain to not audit. Receive amavisd_recv_client packets. Domain allowed access. Do not audit attempts to receive amavisd_recv_client packets. Domain allowed access. Send and receive amavisd_recv_client packets. Domain allowed access. Do not audit attempts to send and receive amavisd_recv_client packets. Domain to not audit. Relabel packets to amavisd_recv_client the packet type. Domain allowed access. Send amavisd_recv_server packets. Domain allowed access. Do not audit attempts to send amavisd_recv_server packets. Domain to not audit. Receive amavisd_recv_server packets. Domain allowed access. Do not audit attempts to receive amavisd_recv_server packets. Domain allowed access. Send and receive amavisd_recv_server packets. Domain allowed access. Do not audit attempts to send and receive amavisd_recv_server packets. Domain to not audit. Relabel packets to amavisd_recv_server the packet type. Domain allowed access. Send and receive TCP traffic on the amavisd_send port. Domain allowed access. Send UDP traffic on the amavisd_send port. Domain allowed access. Do not audit attempts to send UDP traffic on the amavisd_send port. Domain to not audit. Receive UDP traffic on the amavisd_send port. Domain allowed access. Do not audit attempts to receive UDP traffic on the amavisd_send port. Domain to not audit. Send and receive UDP traffic on the amavisd_send port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the amavisd_send port. Domain to not audit. Bind TCP sockets to the amavisd_send port. Domain allowed access. Bind UDP sockets to the amavisd_send port. Domain allowed access. Make a TCP connection to the amavisd_send port. Domain allowed access. Send amavisd_send_client packets. Domain allowed access. Do not audit attempts to send amavisd_send_client packets. Domain to not audit. Receive amavisd_send_client packets. Domain allowed access. Do not audit attempts to receive amavisd_send_client packets. Domain allowed access. Send and receive amavisd_send_client packets. Domain allowed access. Do not audit attempts to send and receive amavisd_send_client packets. Domain to not audit. Relabel packets to amavisd_send_client the packet type. Domain allowed access. Send amavisd_send_server packets. Domain allowed access. Do not audit attempts to send amavisd_send_server packets. Domain to not audit. Receive amavisd_send_server packets. Domain allowed access. Do not audit attempts to receive amavisd_send_server packets. Domain allowed access. Send and receive amavisd_send_server packets. Domain allowed access. Do not audit attempts to send and receive amavisd_send_server packets. Domain to not audit. Relabel packets to amavisd_send_server the packet type. Domain allowed access. Send and receive TCP traffic on the amqp port. Domain allowed access. Send UDP traffic on the amqp port. Domain allowed access. Do not audit attempts to send UDP traffic on the amqp port. Domain to not audit. Receive UDP traffic on the amqp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the amqp port. Domain to not audit. Send and receive UDP traffic on the amqp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the amqp port. Domain to not audit. Bind TCP sockets to the amqp port. Domain allowed access. Bind UDP sockets to the amqp port. Domain allowed access. Make a TCP connection to the amqp port. Domain allowed access. Send amqp_client packets. Domain allowed access. Do not audit attempts to send amqp_client packets. Domain to not audit. Receive amqp_client packets. Domain allowed access. Do not audit attempts to receive amqp_client packets. Domain allowed access. Send and receive amqp_client packets. Domain allowed access. Do not audit attempts to send and receive amqp_client packets. Domain to not audit. Relabel packets to amqp_client the packet type. Domain allowed access. Send amqp_server packets. Domain allowed access. Do not audit attempts to send amqp_server packets. Domain to not audit. Receive amqp_server packets. Domain allowed access. Do not audit attempts to receive amqp_server packets. Domain allowed access. Send and receive amqp_server packets. Domain allowed access. Do not audit attempts to send and receive amqp_server packets. Domain to not audit. Relabel packets to amqp_server the packet type. Domain allowed access. Send and receive TCP traffic on the aol port. Domain allowed access. Send UDP traffic on the aol port. Domain allowed access. Do not audit attempts to send UDP traffic on the aol port. Domain to not audit. Receive UDP traffic on the aol port. Domain allowed access. Do not audit attempts to receive UDP traffic on the aol port. Domain to not audit. Send and receive UDP traffic on the aol port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the aol port. Domain to not audit. Bind TCP sockets to the aol port. Domain allowed access. Bind UDP sockets to the aol port. Domain allowed access. Make a TCP connection to the aol port. Domain allowed access. Send aol_client packets. Domain allowed access. Do not audit attempts to send aol_client packets. Domain to not audit. Receive aol_client packets. Domain allowed access. Do not audit attempts to receive aol_client packets. Domain allowed access. Send and receive aol_client packets. Domain allowed access. Do not audit attempts to send and receive aol_client packets. Domain to not audit. Relabel packets to aol_client the packet type. Domain allowed access. Send aol_server packets. Domain allowed access. Do not audit attempts to send aol_server packets. Domain to not audit. Receive aol_server packets. Domain allowed access. Do not audit attempts to receive aol_server packets. Domain allowed access. Send and receive aol_server packets. Domain allowed access. Do not audit attempts to send and receive aol_server packets. Domain to not audit. Relabel packets to aol_server the packet type. Domain allowed access. Send and receive TCP traffic on the apcupsd port. Domain allowed access. Send UDP traffic on the apcupsd port. Domain allowed access. Do not audit attempts to send UDP traffic on the apcupsd port. Domain to not audit. Receive UDP traffic on the apcupsd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the apcupsd port. Domain to not audit. Send and receive UDP traffic on the apcupsd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the apcupsd port. Domain to not audit. Bind TCP sockets to the apcupsd port. Domain allowed access. Bind UDP sockets to the apcupsd port. Domain allowed access. Make a TCP connection to the apcupsd port. Domain allowed access. Send apcupsd_client packets. Domain allowed access. Do not audit attempts to send apcupsd_client packets. Domain to not audit. Receive apcupsd_client packets. Domain allowed access. Do not audit attempts to receive apcupsd_client packets. Domain allowed access. Send and receive apcupsd_client packets. Domain allowed access. Do not audit attempts to send and receive apcupsd_client packets. Domain to not audit. Relabel packets to apcupsd_client the packet type. Domain allowed access. Send apcupsd_server packets. Domain allowed access. Do not audit attempts to send apcupsd_server packets. Domain to not audit. Receive apcupsd_server packets. Domain allowed access. Do not audit attempts to receive apcupsd_server packets. Domain allowed access. Send and receive apcupsd_server packets. Domain allowed access. Do not audit attempts to send and receive apcupsd_server packets. Domain to not audit. Relabel packets to apcupsd_server the packet type. Domain allowed access. Send and receive TCP traffic on the apertus_ldp port. Domain allowed access. Send UDP traffic on the apertus_ldp port. Domain allowed access. Do not audit attempts to send UDP traffic on the apertus_ldp port. Domain to not audit. Receive UDP traffic on the apertus_ldp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the apertus_ldp port. Domain to not audit. Send and receive UDP traffic on the apertus_ldp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the apertus_ldp port. Domain to not audit. Bind TCP sockets to the apertus_ldp port. Domain allowed access. Bind UDP sockets to the apertus_ldp port. Domain allowed access. Make a TCP connection to the apertus_ldp port. Domain allowed access. Send apertus_ldp_client packets. Domain allowed access. Do not audit attempts to send apertus_ldp_client packets. Domain to not audit. Receive apertus_ldp_client packets. Domain allowed access. Do not audit attempts to receive apertus_ldp_client packets. Domain allowed access. Send and receive apertus_ldp_client packets. Domain allowed access. Do not audit attempts to send and receive apertus_ldp_client packets. Domain to not audit. Relabel packets to apertus_ldp_client the packet type. Domain allowed access. Send apertus_ldp_server packets. Domain allowed access. Do not audit attempts to send apertus_ldp_server packets. Domain to not audit. Receive apertus_ldp_server packets. Domain allowed access. Do not audit attempts to receive apertus_ldp_server packets. Domain allowed access. Send and receive apertus_ldp_server packets. Domain allowed access. Do not audit attempts to send and receive apertus_ldp_server packets. Domain to not audit. Relabel packets to apertus_ldp_server the packet type. Domain allowed access. Send and receive TCP traffic on the armtechdaemon port. Domain allowed access. Send UDP traffic on the armtechdaemon port. Domain allowed access. Do not audit attempts to send UDP traffic on the armtechdaemon port. Domain to not audit. Receive UDP traffic on the armtechdaemon port. Domain allowed access. Do not audit attempts to receive UDP traffic on the armtechdaemon port. Domain to not audit. Send and receive UDP traffic on the armtechdaemon port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the armtechdaemon port. Domain to not audit. Bind TCP sockets to the armtechdaemon port. Domain allowed access. Bind UDP sockets to the armtechdaemon port. Domain allowed access. Make a TCP connection to the armtechdaemon port. Domain allowed access. Send armtechdaemon_client packets. Domain allowed access. Do not audit attempts to send armtechdaemon_client packets. Domain to not audit. Receive armtechdaemon_client packets. Domain allowed access. Do not audit attempts to receive armtechdaemon_client packets. Domain allowed access. Send and receive armtechdaemon_client packets. Domain allowed access. Do not audit attempts to send and receive armtechdaemon_client packets. Domain to not audit. Relabel packets to armtechdaemon_client the packet type. Domain allowed access. Send armtechdaemon_server packets. Domain allowed access. Do not audit attempts to send armtechdaemon_server packets. Domain to not audit. Receive armtechdaemon_server packets. Domain allowed access. Do not audit attempts to receive armtechdaemon_server packets. Domain allowed access. Send and receive armtechdaemon_server packets. Domain allowed access. Do not audit attempts to send and receive armtechdaemon_server packets. Domain to not audit. Relabel packets to armtechdaemon_server the packet type. Domain allowed access. Send and receive TCP traffic on the asterisk port. Domain allowed access. Send UDP traffic on the asterisk port. Domain allowed access. Do not audit attempts to send UDP traffic on the asterisk port. Domain to not audit. Receive UDP traffic on the asterisk port. Domain allowed access. Do not audit attempts to receive UDP traffic on the asterisk port. Domain to not audit. Send and receive UDP traffic on the asterisk port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the asterisk port. Domain to not audit. Bind TCP sockets to the asterisk port. Domain allowed access. Bind UDP sockets to the asterisk port. Domain allowed access. Make a TCP connection to the asterisk port. Domain allowed access. Send asterisk_client packets. Domain allowed access. Do not audit attempts to send asterisk_client packets. Domain to not audit. Receive asterisk_client packets. Domain allowed access. Do not audit attempts to receive asterisk_client packets. Domain allowed access. Send and receive asterisk_client packets. Domain allowed access. Do not audit attempts to send and receive asterisk_client packets. Domain to not audit. Relabel packets to asterisk_client the packet type. Domain allowed access. Send asterisk_server packets. Domain allowed access. Do not audit attempts to send asterisk_server packets. Domain to not audit. Receive asterisk_server packets. Domain allowed access. Do not audit attempts to receive asterisk_server packets. Domain allowed access. Send and receive asterisk_server packets. Domain allowed access. Do not audit attempts to send and receive asterisk_server packets. Domain to not audit. Relabel packets to asterisk_server the packet type. Domain allowed access. Send and receive TCP traffic on the audit port. Domain allowed access. Send UDP traffic on the audit port. Domain allowed access. Do not audit attempts to send UDP traffic on the audit port. Domain to not audit. Receive UDP traffic on the audit port. Domain allowed access. Do not audit attempts to receive UDP traffic on the audit port. Domain to not audit. Send and receive UDP traffic on the audit port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the audit port. Domain to not audit. Bind TCP sockets to the audit port. Domain allowed access. Bind UDP sockets to the audit port. Domain allowed access. Make a TCP connection to the audit port. Domain allowed access. Send audit_client packets. Domain allowed access. Do not audit attempts to send audit_client packets. Domain to not audit. Receive audit_client packets. Domain allowed access. Do not audit attempts to receive audit_client packets. Domain allowed access. Send and receive audit_client packets. Domain allowed access. Do not audit attempts to send and receive audit_client packets. Domain to not audit. Relabel packets to audit_client the packet type. Domain allowed access. Send audit_server packets. Domain allowed access. Do not audit attempts to send audit_server packets. Domain to not audit. Receive audit_server packets. Domain allowed access. Do not audit attempts to receive audit_server packets. Domain allowed access. Send and receive audit_server packets. Domain allowed access. Do not audit attempts to send and receive audit_server packets. Domain to not audit. Relabel packets to audit_server the packet type. Domain allowed access. Send and receive TCP traffic on the auth port. Domain allowed access. Send UDP traffic on the auth port. Domain allowed access. Do not audit attempts to send UDP traffic on the auth port. Domain to not audit. Receive UDP traffic on the auth port. Domain allowed access. Do not audit attempts to receive UDP traffic on the auth port. Domain to not audit. Send and receive UDP traffic on the auth port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the auth port. Domain to not audit. Bind TCP sockets to the auth port. Domain allowed access. Bind UDP sockets to the auth port. Domain allowed access. Make a TCP connection to the auth port. Domain allowed access. Send auth_client packets. Domain allowed access. Do not audit attempts to send auth_client packets. Domain to not audit. Receive auth_client packets. Domain allowed access. Do not audit attempts to receive auth_client packets. Domain allowed access. Send and receive auth_client packets. Domain allowed access. Do not audit attempts to send and receive auth_client packets. Domain to not audit. Relabel packets to auth_client the packet type. Domain allowed access. Send auth_server packets. Domain allowed access. Do not audit attempts to send auth_server packets. Domain to not audit. Receive auth_server packets. Domain allowed access. Do not audit attempts to receive auth_server packets. Domain allowed access. Send and receive auth_server packets. Domain allowed access. Do not audit attempts to send and receive auth_server packets. Domain to not audit. Relabel packets to auth_server the packet type. Domain allowed access. Send and receive TCP traffic on the bgp port. Domain allowed access. Send UDP traffic on the bgp port. Domain allowed access. Do not audit attempts to send UDP traffic on the bgp port. Domain to not audit. Receive UDP traffic on the bgp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the bgp port. Domain to not audit. Send and receive UDP traffic on the bgp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the bgp port. Domain to not audit. Bind TCP sockets to the bgp port. Domain allowed access. Bind UDP sockets to the bgp port. Domain allowed access. Make a TCP connection to the bgp port. Domain allowed access. Send bgp_client packets. Domain allowed access. Do not audit attempts to send bgp_client packets. Domain to not audit. Receive bgp_client packets. Domain allowed access. Do not audit attempts to receive bgp_client packets. Domain allowed access. Send and receive bgp_client packets. Domain allowed access. Do not audit attempts to send and receive bgp_client packets. Domain to not audit. Relabel packets to bgp_client the packet type. Domain allowed access. Send bgp_server packets. Domain allowed access. Do not audit attempts to send bgp_server packets. Domain to not audit. Receive bgp_server packets. Domain allowed access. Do not audit attempts to receive bgp_server packets. Domain allowed access. Send and receive bgp_server packets. Domain allowed access. Do not audit attempts to send and receive bgp_server packets. Domain to not audit. Relabel packets to bgp_server the packet type. Domain allowed access. Send and receive TCP traffic on the boinc port. Domain allowed access. Send UDP traffic on the boinc port. Domain allowed access. Do not audit attempts to send UDP traffic on the boinc port. Domain to not audit. Receive UDP traffic on the boinc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the boinc port. Domain to not audit. Send and receive UDP traffic on the boinc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the boinc port. Domain to not audit. Bind TCP sockets to the boinc port. Domain allowed access. Bind UDP sockets to the boinc port. Domain allowed access. Make a TCP connection to the boinc port. Domain allowed access. Send boinc_client packets. Domain allowed access. Do not audit attempts to send boinc_client packets. Domain to not audit. Receive boinc_client packets. Domain allowed access. Do not audit attempts to receive boinc_client packets. Domain allowed access. Send and receive boinc_client packets. Domain allowed access. Do not audit attempts to send and receive boinc_client packets. Domain to not audit. Relabel packets to boinc_client the packet type. Domain allowed access. Send boinc_server packets. Domain allowed access. Do not audit attempts to send boinc_server packets. Domain to not audit. Receive boinc_server packets. Domain allowed access. Do not audit attempts to receive boinc_server packets. Domain allowed access. Send and receive boinc_server packets. Domain allowed access. Do not audit attempts to send and receive boinc_server packets. Domain to not audit. Relabel packets to boinc_server the packet type. Domain allowed access. Send and receive TCP traffic on the boinc_client port. Domain allowed access. Send UDP traffic on the boinc_client port. Domain allowed access. Do not audit attempts to send UDP traffic on the boinc_client port. Domain to not audit. Receive UDP traffic on the boinc_client port. Domain allowed access. Do not audit attempts to receive UDP traffic on the boinc_client port. Domain to not audit. Send and receive UDP traffic on the boinc_client port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the boinc_client port. Domain to not audit. Bind TCP sockets to the boinc_client port. Domain allowed access. Bind UDP sockets to the boinc_client port. Domain allowed access. Make a TCP connection to the boinc_client port. Domain allowed access. Send boinc_client_client packets. Domain allowed access. Do not audit attempts to send boinc_client_client packets. Domain to not audit. Receive boinc_client_client packets. Domain allowed access. Do not audit attempts to receive boinc_client_client packets. Domain allowed access. Send and receive boinc_client_client packets. Domain allowed access. Do not audit attempts to send and receive boinc_client_client packets. Domain to not audit. Relabel packets to boinc_client_client the packet type. Domain allowed access. Send boinc_client_server packets. Domain allowed access. Do not audit attempts to send boinc_client_server packets. Domain to not audit. Receive boinc_client_server packets. Domain allowed access. Do not audit attempts to receive boinc_client_server packets. Domain allowed access. Send and receive boinc_client_server packets. Domain allowed access. Do not audit attempts to send and receive boinc_client_server packets. Domain to not audit. Relabel packets to boinc_client_server the packet type. Domain allowed access. Send and receive TCP traffic on the biff port. Domain allowed access. Send UDP traffic on the biff port. Domain allowed access. Do not audit attempts to send UDP traffic on the biff port. Domain to not audit. Receive UDP traffic on the biff port. Domain allowed access. Do not audit attempts to receive UDP traffic on the biff port. Domain to not audit. Send and receive UDP traffic on the biff port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the biff port. Domain to not audit. Bind TCP sockets to the biff port. Domain allowed access. Bind UDP sockets to the biff port. Domain allowed access. Make a TCP connection to the biff port. Domain allowed access. Send biff_client packets. Domain allowed access. Do not audit attempts to send biff_client packets. Domain to not audit. Receive biff_client packets. Domain allowed access. Do not audit attempts to receive biff_client packets. Domain allowed access. Send and receive biff_client packets. Domain allowed access. Do not audit attempts to send and receive biff_client packets. Domain to not audit. Relabel packets to biff_client the packet type. Domain allowed access. Send biff_server packets. Domain allowed access. Do not audit attempts to send biff_server packets. Domain to not audit. Receive biff_server packets. Domain allowed access. Do not audit attempts to receive biff_server packets. Domain allowed access. Send and receive biff_server packets. Domain allowed access. Do not audit attempts to send and receive biff_server packets. Domain to not audit. Relabel packets to biff_server the packet type. Domain allowed access. Send and receive TCP traffic on the certmaster port. Domain allowed access. Send UDP traffic on the certmaster port. Domain allowed access. Do not audit attempts to send UDP traffic on the certmaster port. Domain to not audit. Receive UDP traffic on the certmaster port. Domain allowed access. Do not audit attempts to receive UDP traffic on the certmaster port. Domain to not audit. Send and receive UDP traffic on the certmaster port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the certmaster port. Domain to not audit. Bind TCP sockets to the certmaster port. Domain allowed access. Bind UDP sockets to the certmaster port. Domain allowed access. Make a TCP connection to the certmaster port. Domain allowed access. Send certmaster_client packets. Domain allowed access. Do not audit attempts to send certmaster_client packets. Domain to not audit. Receive certmaster_client packets. Domain allowed access. Do not audit attempts to receive certmaster_client packets. Domain allowed access. Send and receive certmaster_client packets. Domain allowed access. Do not audit attempts to send and receive certmaster_client packets. Domain to not audit. Relabel packets to certmaster_client the packet type. Domain allowed access. Send certmaster_server packets. Domain allowed access. Do not audit attempts to send certmaster_server packets. Domain to not audit. Receive certmaster_server packets. Domain allowed access. Do not audit attempts to receive certmaster_server packets. Domain allowed access. Send and receive certmaster_server packets. Domain allowed access. Do not audit attempts to send and receive certmaster_server packets. Domain to not audit. Relabel packets to certmaster_server the packet type. Domain allowed access. Send and receive TCP traffic on the chronyd port. Domain allowed access. Send UDP traffic on the chronyd port. Domain allowed access. Do not audit attempts to send UDP traffic on the chronyd port. Domain to not audit. Receive UDP traffic on the chronyd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the chronyd port. Domain to not audit. Send and receive UDP traffic on the chronyd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the chronyd port. Domain to not audit. Bind TCP sockets to the chronyd port. Domain allowed access. Bind UDP sockets to the chronyd port. Domain allowed access. Make a TCP connection to the chronyd port. Domain allowed access. Send chronyd_client packets. Domain allowed access. Do not audit attempts to send chronyd_client packets. Domain to not audit. Receive chronyd_client packets. Domain allowed access. Do not audit attempts to receive chronyd_client packets. Domain allowed access. Send and receive chronyd_client packets. Domain allowed access. Do not audit attempts to send and receive chronyd_client packets. Domain to not audit. Relabel packets to chronyd_client the packet type. Domain allowed access. Send chronyd_server packets. Domain allowed access. Do not audit attempts to send chronyd_server packets. Domain to not audit. Receive chronyd_server packets. Domain allowed access. Do not audit attempts to receive chronyd_server packets. Domain allowed access. Send and receive chronyd_server packets. Domain allowed access. Do not audit attempts to send and receive chronyd_server packets. Domain to not audit. Relabel packets to chronyd_server the packet type. Domain allowed access. Send and receive TCP traffic on the clamd port. Domain allowed access. Send UDP traffic on the clamd port. Domain allowed access. Do not audit attempts to send UDP traffic on the clamd port. Domain to not audit. Receive UDP traffic on the clamd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the clamd port. Domain to not audit. Send and receive UDP traffic on the clamd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the clamd port. Domain to not audit. Bind TCP sockets to the clamd port. Domain allowed access. Bind UDP sockets to the clamd port. Domain allowed access. Make a TCP connection to the clamd port. Domain allowed access. Send clamd_client packets. Domain allowed access. Do not audit attempts to send clamd_client packets. Domain to not audit. Receive clamd_client packets. Domain allowed access. Do not audit attempts to receive clamd_client packets. Domain allowed access. Send and receive clamd_client packets. Domain allowed access. Do not audit attempts to send and receive clamd_client packets. Domain to not audit. Relabel packets to clamd_client the packet type. Domain allowed access. Send clamd_server packets. Domain allowed access. Do not audit attempts to send clamd_server packets. Domain to not audit. Receive clamd_server packets. Domain allowed access. Do not audit attempts to receive clamd_server packets. Domain allowed access. Send and receive clamd_server packets. Domain allowed access. Do not audit attempts to send and receive clamd_server packets. Domain to not audit. Relabel packets to clamd_server the packet type. Domain allowed access. Send and receive TCP traffic on the clockspeed port. Domain allowed access. Send UDP traffic on the clockspeed port. Domain allowed access. Do not audit attempts to send UDP traffic on the clockspeed port. Domain to not audit. Receive UDP traffic on the clockspeed port. Domain allowed access. Do not audit attempts to receive UDP traffic on the clockspeed port. Domain to not audit. Send and receive UDP traffic on the clockspeed port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the clockspeed port. Domain to not audit. Bind TCP sockets to the clockspeed port. Domain allowed access. Bind UDP sockets to the clockspeed port. Domain allowed access. Make a TCP connection to the clockspeed port. Domain allowed access. Send clockspeed_client packets. Domain allowed access. Do not audit attempts to send clockspeed_client packets. Domain to not audit. Receive clockspeed_client packets. Domain allowed access. Do not audit attempts to receive clockspeed_client packets. Domain allowed access. Send and receive clockspeed_client packets. Domain allowed access. Do not audit attempts to send and receive clockspeed_client packets. Domain to not audit. Relabel packets to clockspeed_client the packet type. Domain allowed access. Send clockspeed_server packets. Domain allowed access. Do not audit attempts to send clockspeed_server packets. Domain to not audit. Receive clockspeed_server packets. Domain allowed access. Do not audit attempts to receive clockspeed_server packets. Domain allowed access. Send and receive clockspeed_server packets. Domain allowed access. Do not audit attempts to send and receive clockspeed_server packets. Domain to not audit. Relabel packets to clockspeed_server the packet type. Domain allowed access. Send and receive TCP traffic on the cluster port. Domain allowed access. Send UDP traffic on the cluster port. Domain allowed access. Do not audit attempts to send UDP traffic on the cluster port. Domain to not audit. Receive UDP traffic on the cluster port. Domain allowed access. Do not audit attempts to receive UDP traffic on the cluster port. Domain to not audit. Send and receive UDP traffic on the cluster port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the cluster port. Domain to not audit. Bind TCP sockets to the cluster port. Domain allowed access. Bind UDP sockets to the cluster port. Domain allowed access. Make a TCP connection to the cluster port. Domain allowed access. Send cluster_client packets. Domain allowed access. Do not audit attempts to send cluster_client packets. Domain to not audit. Receive cluster_client packets. Domain allowed access. Do not audit attempts to receive cluster_client packets. Domain allowed access. Send and receive cluster_client packets. Domain allowed access. Do not audit attempts to send and receive cluster_client packets. Domain to not audit. Relabel packets to cluster_client the packet type. Domain allowed access. Send cluster_server packets. Domain allowed access. Do not audit attempts to send cluster_server packets. Domain to not audit. Receive cluster_server packets. Domain allowed access. Do not audit attempts to receive cluster_server packets. Domain allowed access. Send and receive cluster_server packets. Domain allowed access. Do not audit attempts to send and receive cluster_server packets. Domain to not audit. Relabel packets to cluster_server the packet type. Domain allowed access. Send and receive TCP traffic on the cma port. Domain allowed access. Send UDP traffic on the cma port. Domain allowed access. Do not audit attempts to send UDP traffic on the cma port. Domain to not audit. Receive UDP traffic on the cma port. Domain allowed access. Do not audit attempts to receive UDP traffic on the cma port. Domain to not audit. Send and receive UDP traffic on the cma port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the cma port. Domain to not audit. Bind TCP sockets to the cma port. Domain allowed access. Bind UDP sockets to the cma port. Domain allowed access. Make a TCP connection to the cma port. Domain allowed access. Send cma_client packets. Domain allowed access. Do not audit attempts to send cma_client packets. Domain to not audit. Receive cma_client packets. Domain allowed access. Do not audit attempts to receive cma_client packets. Domain allowed access. Send and receive cma_client packets. Domain allowed access. Do not audit attempts to send and receive cma_client packets. Domain to not audit. Relabel packets to cma_client the packet type. Domain allowed access. Send cma_server packets. Domain allowed access. Do not audit attempts to send cma_server packets. Domain to not audit. Receive cma_server packets. Domain allowed access. Do not audit attempts to receive cma_server packets. Domain allowed access. Send and receive cma_server packets. Domain allowed access. Do not audit attempts to send and receive cma_server packets. Domain to not audit. Relabel packets to cma_server the packet type. Domain allowed access. Send and receive TCP traffic on the cobbler port. Domain allowed access. Send UDP traffic on the cobbler port. Domain allowed access. Do not audit attempts to send UDP traffic on the cobbler port. Domain to not audit. Receive UDP traffic on the cobbler port. Domain allowed access. Do not audit attempts to receive UDP traffic on the cobbler port. Domain to not audit. Send and receive UDP traffic on the cobbler port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the cobbler port. Domain to not audit. Bind TCP sockets to the cobbler port. Domain allowed access. Bind UDP sockets to the cobbler port. Domain allowed access. Make a TCP connection to the cobbler port. Domain allowed access. Send cobbler_client packets. Domain allowed access. Do not audit attempts to send cobbler_client packets. Domain to not audit. Receive cobbler_client packets. Domain allowed access. Do not audit attempts to receive cobbler_client packets. Domain allowed access. Send and receive cobbler_client packets. Domain allowed access. Do not audit attempts to send and receive cobbler_client packets. Domain to not audit. Relabel packets to cobbler_client the packet type. Domain allowed access. Send cobbler_server packets. Domain allowed access. Do not audit attempts to send cobbler_server packets. Domain to not audit. Receive cobbler_server packets. Domain allowed access. Do not audit attempts to receive cobbler_server packets. Domain allowed access. Send and receive cobbler_server packets. Domain allowed access. Do not audit attempts to send and receive cobbler_server packets. Domain to not audit. Relabel packets to cobbler_server the packet type. Domain allowed access. Send and receive TCP traffic on the commplex_link port. Domain allowed access. Send UDP traffic on the commplex_link port. Domain allowed access. Do not audit attempts to send UDP traffic on the commplex_link port. Domain to not audit. Receive UDP traffic on the commplex_link port. Domain allowed access. Do not audit attempts to receive UDP traffic on the commplex_link port. Domain to not audit. Send and receive UDP traffic on the commplex_link port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the commplex_link port. Domain to not audit. Bind TCP sockets to the commplex_link port. Domain allowed access. Bind UDP sockets to the commplex_link port. Domain allowed access. Make a TCP connection to the commplex_link port. Domain allowed access. Send commplex_link_client packets. Domain allowed access. Do not audit attempts to send commplex_link_client packets. Domain to not audit. Receive commplex_link_client packets. Domain allowed access. Do not audit attempts to receive commplex_link_client packets. Domain allowed access. Send and receive commplex_link_client packets. Domain allowed access. Do not audit attempts to send and receive commplex_link_client packets. Domain to not audit. Relabel packets to commplex_link_client the packet type. Domain allowed access. Send commplex_link_server packets. Domain allowed access. Do not audit attempts to send commplex_link_server packets. Domain to not audit. Receive commplex_link_server packets. Domain allowed access. Do not audit attempts to receive commplex_link_server packets. Domain allowed access. Send and receive commplex_link_server packets. Domain allowed access. Do not audit attempts to send and receive commplex_link_server packets. Domain to not audit. Relabel packets to commplex_link_server the packet type. Domain allowed access. Send and receive TCP traffic on the commplex_main port. Domain allowed access. Send UDP traffic on the commplex_main port. Domain allowed access. Do not audit attempts to send UDP traffic on the commplex_main port. Domain to not audit. Receive UDP traffic on the commplex_main port. Domain allowed access. Do not audit attempts to receive UDP traffic on the commplex_main port. Domain to not audit. Send and receive UDP traffic on the commplex_main port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the commplex_main port. Domain to not audit. Bind TCP sockets to the commplex_main port. Domain allowed access. Bind UDP sockets to the commplex_main port. Domain allowed access. Make a TCP connection to the commplex_main port. Domain allowed access. Send commplex_main_client packets. Domain allowed access. Do not audit attempts to send commplex_main_client packets. Domain to not audit. Receive commplex_main_client packets. Domain allowed access. Do not audit attempts to receive commplex_main_client packets. Domain allowed access. Send and receive commplex_main_client packets. Domain allowed access. Do not audit attempts to send and receive commplex_main_client packets. Domain to not audit. Relabel packets to commplex_main_client the packet type. Domain allowed access. Send commplex_main_server packets. Domain allowed access. Do not audit attempts to send commplex_main_server packets. Domain to not audit. Receive commplex_main_server packets. Domain allowed access. Do not audit attempts to receive commplex_main_server packets. Domain allowed access. Send and receive commplex_main_server packets. Domain allowed access. Do not audit attempts to send and receive commplex_main_server packets. Domain to not audit. Relabel packets to commplex_main_server the packet type. Domain allowed access. Send and receive TCP traffic on the comsat port. Domain allowed access. Send UDP traffic on the comsat port. Domain allowed access. Do not audit attempts to send UDP traffic on the comsat port. Domain to not audit. Receive UDP traffic on the comsat port. Domain allowed access. Do not audit attempts to receive UDP traffic on the comsat port. Domain to not audit. Send and receive UDP traffic on the comsat port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the comsat port. Domain to not audit. Bind TCP sockets to the comsat port. Domain allowed access. Bind UDP sockets to the comsat port. Domain allowed access. Make a TCP connection to the comsat port. Domain allowed access. Send comsat_client packets. Domain allowed access. Do not audit attempts to send comsat_client packets. Domain to not audit. Receive comsat_client packets. Domain allowed access. Do not audit attempts to receive comsat_client packets. Domain allowed access. Send and receive comsat_client packets. Domain allowed access. Do not audit attempts to send and receive comsat_client packets. Domain to not audit. Relabel packets to comsat_client the packet type. Domain allowed access. Send comsat_server packets. Domain allowed access. Do not audit attempts to send comsat_server packets. Domain to not audit. Receive comsat_server packets. Domain allowed access. Do not audit attempts to receive comsat_server packets. Domain allowed access. Send and receive comsat_server packets. Domain allowed access. Do not audit attempts to send and receive comsat_server packets. Domain to not audit. Relabel packets to comsat_server the packet type. Domain allowed access. Send and receive TCP traffic on the condor port. Domain allowed access. Send UDP traffic on the condor port. Domain allowed access. Do not audit attempts to send UDP traffic on the condor port. Domain to not audit. Receive UDP traffic on the condor port. Domain allowed access. Do not audit attempts to receive UDP traffic on the condor port. Domain to not audit. Send and receive UDP traffic on the condor port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the condor port. Domain to not audit. Bind TCP sockets to the condor port. Domain allowed access. Bind UDP sockets to the condor port. Domain allowed access. Make a TCP connection to the condor port. Domain allowed access. Send condor_client packets. Domain allowed access. Do not audit attempts to send condor_client packets. Domain to not audit. Receive condor_client packets. Domain allowed access. Do not audit attempts to receive condor_client packets. Domain allowed access. Send and receive condor_client packets. Domain allowed access. Do not audit attempts to send and receive condor_client packets. Domain to not audit. Relabel packets to condor_client the packet type. Domain allowed access. Send condor_server packets. Domain allowed access. Do not audit attempts to send condor_server packets. Domain to not audit. Receive condor_server packets. Domain allowed access. Do not audit attempts to receive condor_server packets. Domain allowed access. Send and receive condor_server packets. Domain allowed access. Do not audit attempts to send and receive condor_server packets. Domain to not audit. Relabel packets to condor_server the packet type. Domain allowed access. Send and receive TCP traffic on the couchdb port. Domain allowed access. Send UDP traffic on the couchdb port. Domain allowed access. Do not audit attempts to send UDP traffic on the couchdb port. Domain to not audit. Receive UDP traffic on the couchdb port. Domain allowed access. Do not audit attempts to receive UDP traffic on the couchdb port. Domain to not audit. Send and receive UDP traffic on the couchdb port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the couchdb port. Domain to not audit. Bind TCP sockets to the couchdb port. Domain allowed access. Bind UDP sockets to the couchdb port. Domain allowed access. Make a TCP connection to the couchdb port. Domain allowed access. Send couchdb_client packets. Domain allowed access. Do not audit attempts to send couchdb_client packets. Domain to not audit. Receive couchdb_client packets. Domain allowed access. Do not audit attempts to receive couchdb_client packets. Domain allowed access. Send and receive couchdb_client packets. Domain allowed access. Do not audit attempts to send and receive couchdb_client packets. Domain to not audit. Relabel packets to couchdb_client the packet type. Domain allowed access. Send couchdb_server packets. Domain allowed access. Do not audit attempts to send couchdb_server packets. Domain to not audit. Receive couchdb_server packets. Domain allowed access. Do not audit attempts to receive couchdb_server packets. Domain allowed access. Send and receive couchdb_server packets. Domain allowed access. Do not audit attempts to send and receive couchdb_server packets. Domain to not audit. Relabel packets to couchdb_server the packet type. Domain allowed access. Send and receive TCP traffic on the cslistener port. Domain allowed access. Send UDP traffic on the cslistener port. Domain allowed access. Do not audit attempts to send UDP traffic on the cslistener port. Domain to not audit. Receive UDP traffic on the cslistener port. Domain allowed access. Do not audit attempts to receive UDP traffic on the cslistener port. Domain to not audit. Send and receive UDP traffic on the cslistener port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the cslistener port. Domain to not audit. Bind TCP sockets to the cslistener port. Domain allowed access. Bind UDP sockets to the cslistener port. Domain allowed access. Make a TCP connection to the cslistener port. Domain allowed access. Send cslistener_client packets. Domain allowed access. Do not audit attempts to send cslistener_client packets. Domain to not audit. Receive cslistener_client packets. Domain allowed access. Do not audit attempts to receive cslistener_client packets. Domain allowed access. Send and receive cslistener_client packets. Domain allowed access. Do not audit attempts to send and receive cslistener_client packets. Domain to not audit. Relabel packets to cslistener_client the packet type. Domain allowed access. Send cslistener_server packets. Domain allowed access. Do not audit attempts to send cslistener_server packets. Domain to not audit. Receive cslistener_server packets. Domain allowed access. Do not audit attempts to receive cslistener_server packets. Domain allowed access. Send and receive cslistener_server packets. Domain allowed access. Do not audit attempts to send and receive cslistener_server packets. Domain to not audit. Relabel packets to cslistener_server the packet type. Domain allowed access. Send and receive TCP traffic on the ctdb port. Domain allowed access. Send UDP traffic on the ctdb port. Domain allowed access. Do not audit attempts to send UDP traffic on the ctdb port. Domain to not audit. Receive UDP traffic on the ctdb port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ctdb port. Domain to not audit. Send and receive UDP traffic on the ctdb port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ctdb port. Domain to not audit. Bind TCP sockets to the ctdb port. Domain allowed access. Bind UDP sockets to the ctdb port. Domain allowed access. Make a TCP connection to the ctdb port. Domain allowed access. Send ctdb_client packets. Domain allowed access. Do not audit attempts to send ctdb_client packets. Domain to not audit. Receive ctdb_client packets. Domain allowed access. Do not audit attempts to receive ctdb_client packets. Domain allowed access. Send and receive ctdb_client packets. Domain allowed access. Do not audit attempts to send and receive ctdb_client packets. Domain to not audit. Relabel packets to ctdb_client the packet type. Domain allowed access. Send ctdb_server packets. Domain allowed access. Do not audit attempts to send ctdb_server packets. Domain to not audit. Receive ctdb_server packets. Domain allowed access. Do not audit attempts to receive ctdb_server packets. Domain allowed access. Send and receive ctdb_server packets. Domain allowed access. Do not audit attempts to send and receive ctdb_server packets. Domain to not audit. Relabel packets to ctdb_server the packet type. Domain allowed access. Send and receive TCP traffic on the cvs port. Domain allowed access. Send UDP traffic on the cvs port. Domain allowed access. Do not audit attempts to send UDP traffic on the cvs port. Domain to not audit. Receive UDP traffic on the cvs port. Domain allowed access. Do not audit attempts to receive UDP traffic on the cvs port. Domain to not audit. Send and receive UDP traffic on the cvs port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the cvs port. Domain to not audit. Bind TCP sockets to the cvs port. Domain allowed access. Bind UDP sockets to the cvs port. Domain allowed access. Make a TCP connection to the cvs port. Domain allowed access. Send cvs_client packets. Domain allowed access. Do not audit attempts to send cvs_client packets. Domain to not audit. Receive cvs_client packets. Domain allowed access. Do not audit attempts to receive cvs_client packets. Domain allowed access. Send and receive cvs_client packets. Domain allowed access. Do not audit attempts to send and receive cvs_client packets. Domain to not audit. Relabel packets to cvs_client the packet type. Domain allowed access. Send cvs_server packets. Domain allowed access. Do not audit attempts to send cvs_server packets. Domain to not audit. Receive cvs_server packets. Domain allowed access. Do not audit attempts to receive cvs_server packets. Domain allowed access. Send and receive cvs_server packets. Domain allowed access. Do not audit attempts to send and receive cvs_server packets. Domain to not audit. Relabel packets to cvs_server the packet type. Domain allowed access. Send and receive TCP traffic on the cyphesis port. Domain allowed access. Send UDP traffic on the cyphesis port. Domain allowed access. Do not audit attempts to send UDP traffic on the cyphesis port. Domain to not audit. Receive UDP traffic on the cyphesis port. Domain allowed access. Do not audit attempts to receive UDP traffic on the cyphesis port. Domain to not audit. Send and receive UDP traffic on the cyphesis port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the cyphesis port. Domain to not audit. Bind TCP sockets to the cyphesis port. Domain allowed access. Bind UDP sockets to the cyphesis port. Domain allowed access. Make a TCP connection to the cyphesis port. Domain allowed access. Send cyphesis_client packets. Domain allowed access. Do not audit attempts to send cyphesis_client packets. Domain to not audit. Receive cyphesis_client packets. Domain allowed access. Do not audit attempts to receive cyphesis_client packets. Domain allowed access. Send and receive cyphesis_client packets. Domain allowed access. Do not audit attempts to send and receive cyphesis_client packets. Domain to not audit. Relabel packets to cyphesis_client the packet type. Domain allowed access. Send cyphesis_server packets. Domain allowed access. Do not audit attempts to send cyphesis_server packets. Domain to not audit. Receive cyphesis_server packets. Domain allowed access. Do not audit attempts to receive cyphesis_server packets. Domain allowed access. Send and receive cyphesis_server packets. Domain allowed access. Do not audit attempts to send and receive cyphesis_server packets. Domain to not audit. Relabel packets to cyphesis_server the packet type. Domain allowed access. Send and receive TCP traffic on the daap port. Domain allowed access. Send UDP traffic on the daap port. Domain allowed access. Do not audit attempts to send UDP traffic on the daap port. Domain to not audit. Receive UDP traffic on the daap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the daap port. Domain to not audit. Send and receive UDP traffic on the daap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the daap port. Domain to not audit. Bind TCP sockets to the daap port. Domain allowed access. Bind UDP sockets to the daap port. Domain allowed access. Make a TCP connection to the daap port. Domain allowed access. Send daap_client packets. Domain allowed access. Do not audit attempts to send daap_client packets. Domain to not audit. Receive daap_client packets. Domain allowed access. Do not audit attempts to receive daap_client packets. Domain allowed access. Send and receive daap_client packets. Domain allowed access. Do not audit attempts to send and receive daap_client packets. Domain to not audit. Relabel packets to daap_client the packet type. Domain allowed access. Send daap_server packets. Domain allowed access. Do not audit attempts to send daap_server packets. Domain to not audit. Receive daap_server packets. Domain allowed access. Do not audit attempts to receive daap_server packets. Domain allowed access. Send and receive daap_server packets. Domain allowed access. Do not audit attempts to send and receive daap_server packets. Domain to not audit. Relabel packets to daap_server the packet type. Domain allowed access. Send and receive TCP traffic on the dbskkd port. Domain allowed access. Send UDP traffic on the dbskkd port. Domain allowed access. Do not audit attempts to send UDP traffic on the dbskkd port. Domain to not audit. Receive UDP traffic on the dbskkd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dbskkd port. Domain to not audit. Send and receive UDP traffic on the dbskkd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dbskkd port. Domain to not audit. Bind TCP sockets to the dbskkd port. Domain allowed access. Bind UDP sockets to the dbskkd port. Domain allowed access. Make a TCP connection to the dbskkd port. Domain allowed access. Send dbskkd_client packets. Domain allowed access. Do not audit attempts to send dbskkd_client packets. Domain to not audit. Receive dbskkd_client packets. Domain allowed access. Do not audit attempts to receive dbskkd_client packets. Domain allowed access. Send and receive dbskkd_client packets. Domain allowed access. Do not audit attempts to send and receive dbskkd_client packets. Domain to not audit. Relabel packets to dbskkd_client the packet type. Domain allowed access. Send dbskkd_server packets. Domain allowed access. Do not audit attempts to send dbskkd_server packets. Domain to not audit. Receive dbskkd_server packets. Domain allowed access. Do not audit attempts to receive dbskkd_server packets. Domain allowed access. Send and receive dbskkd_server packets. Domain allowed access. Do not audit attempts to send and receive dbskkd_server packets. Domain to not audit. Relabel packets to dbskkd_server the packet type. Domain allowed access. Send and receive TCP traffic on the dcc port. Domain allowed access. Send UDP traffic on the dcc port. Domain allowed access. Do not audit attempts to send UDP traffic on the dcc port. Domain to not audit. Receive UDP traffic on the dcc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dcc port. Domain to not audit. Send and receive UDP traffic on the dcc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dcc port. Domain to not audit. Bind TCP sockets to the dcc port. Domain allowed access. Bind UDP sockets to the dcc port. Domain allowed access. Make a TCP connection to the dcc port. Domain allowed access. Send dcc_client packets. Domain allowed access. Do not audit attempts to send dcc_client packets. Domain to not audit. Receive dcc_client packets. Domain allowed access. Do not audit attempts to receive dcc_client packets. Domain allowed access. Send and receive dcc_client packets. Domain allowed access. Do not audit attempts to send and receive dcc_client packets. Domain to not audit. Relabel packets to dcc_client the packet type. Domain allowed access. Send dcc_server packets. Domain allowed access. Do not audit attempts to send dcc_server packets. Domain to not audit. Receive dcc_server packets. Domain allowed access. Do not audit attempts to receive dcc_server packets. Domain allowed access. Send and receive dcc_server packets. Domain allowed access. Do not audit attempts to send and receive dcc_server packets. Domain to not audit. Relabel packets to dcc_server the packet type. Domain allowed access. Send and receive TCP traffic on the dccm port. Domain allowed access. Send UDP traffic on the dccm port. Domain allowed access. Do not audit attempts to send UDP traffic on the dccm port. Domain to not audit. Receive UDP traffic on the dccm port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dccm port. Domain to not audit. Send and receive UDP traffic on the dccm port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dccm port. Domain to not audit. Bind TCP sockets to the dccm port. Domain allowed access. Bind UDP sockets to the dccm port. Domain allowed access. Make a TCP connection to the dccm port. Domain allowed access. Send dccm_client packets. Domain allowed access. Do not audit attempts to send dccm_client packets. Domain to not audit. Receive dccm_client packets. Domain allowed access. Do not audit attempts to receive dccm_client packets. Domain allowed access. Send and receive dccm_client packets. Domain allowed access. Do not audit attempts to send and receive dccm_client packets. Domain to not audit. Relabel packets to dccm_client the packet type. Domain allowed access. Send dccm_server packets. Domain allowed access. Do not audit attempts to send dccm_server packets. Domain to not audit. Receive dccm_server packets. Domain allowed access. Do not audit attempts to receive dccm_server packets. Domain allowed access. Send and receive dccm_server packets. Domain allowed access. Do not audit attempts to send and receive dccm_server packets. Domain to not audit. Relabel packets to dccm_server the packet type. Domain allowed access. Send and receive TCP traffic on the dhcpc port. Domain allowed access. Send UDP traffic on the dhcpc port. Domain allowed access. Do not audit attempts to send UDP traffic on the dhcpc port. Domain to not audit. Receive UDP traffic on the dhcpc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dhcpc port. Domain to not audit. Send and receive UDP traffic on the dhcpc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dhcpc port. Domain to not audit. Bind TCP sockets to the dhcpc port. Domain allowed access. Bind UDP sockets to the dhcpc port. Domain allowed access. Make a TCP connection to the dhcpc port. Domain allowed access. Send dhcpc_client packets. Domain allowed access. Do not audit attempts to send dhcpc_client packets. Domain to not audit. Receive dhcpc_client packets. Domain allowed access. Do not audit attempts to receive dhcpc_client packets. Domain allowed access. Send and receive dhcpc_client packets. Domain allowed access. Do not audit attempts to send and receive dhcpc_client packets. Domain to not audit. Relabel packets to dhcpc_client the packet type. Domain allowed access. Send dhcpc_server packets. Domain allowed access. Do not audit attempts to send dhcpc_server packets. Domain to not audit. Receive dhcpc_server packets. Domain allowed access. Do not audit attempts to receive dhcpc_server packets. Domain allowed access. Send and receive dhcpc_server packets. Domain allowed access. Do not audit attempts to send and receive dhcpc_server packets. Domain to not audit. Relabel packets to dhcpc_server the packet type. Domain allowed access. Send and receive TCP traffic on the dhcpd port. Domain allowed access. Send UDP traffic on the dhcpd port. Domain allowed access. Do not audit attempts to send UDP traffic on the dhcpd port. Domain to not audit. Receive UDP traffic on the dhcpd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dhcpd port. Domain to not audit. Send and receive UDP traffic on the dhcpd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dhcpd port. Domain to not audit. Bind TCP sockets to the dhcpd port. Domain allowed access. Bind UDP sockets to the dhcpd port. Domain allowed access. Make a TCP connection to the dhcpd port. Domain allowed access. Send dhcpd_client packets. Domain allowed access. Do not audit attempts to send dhcpd_client packets. Domain to not audit. Receive dhcpd_client packets. Domain allowed access. Do not audit attempts to receive dhcpd_client packets. Domain allowed access. Send and receive dhcpd_client packets. Domain allowed access. Do not audit attempts to send and receive dhcpd_client packets. Domain to not audit. Relabel packets to dhcpd_client the packet type. Domain allowed access. Send dhcpd_server packets. Domain allowed access. Do not audit attempts to send dhcpd_server packets. Domain to not audit. Receive dhcpd_server packets. Domain allowed access. Do not audit attempts to receive dhcpd_server packets. Domain allowed access. Send and receive dhcpd_server packets. Domain allowed access. Do not audit attempts to send and receive dhcpd_server packets. Domain to not audit. Relabel packets to dhcpd_server the packet type. Domain allowed access. Send and receive TCP traffic on the dict port. Domain allowed access. Send UDP traffic on the dict port. Domain allowed access. Do not audit attempts to send UDP traffic on the dict port. Domain to not audit. Receive UDP traffic on the dict port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dict port. Domain to not audit. Send and receive UDP traffic on the dict port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dict port. Domain to not audit. Bind TCP sockets to the dict port. Domain allowed access. Bind UDP sockets to the dict port. Domain allowed access. Make a TCP connection to the dict port. Domain allowed access. Send dict_client packets. Domain allowed access. Do not audit attempts to send dict_client packets. Domain to not audit. Receive dict_client packets. Domain allowed access. Do not audit attempts to receive dict_client packets. Domain allowed access. Send and receive dict_client packets. Domain allowed access. Do not audit attempts to send and receive dict_client packets. Domain to not audit. Relabel packets to dict_client the packet type. Domain allowed access. Send dict_server packets. Domain allowed access. Do not audit attempts to send dict_server packets. Domain to not audit. Receive dict_server packets. Domain allowed access. Do not audit attempts to receive dict_server packets. Domain allowed access. Send and receive dict_server packets. Domain allowed access. Do not audit attempts to send and receive dict_server packets. Domain to not audit. Relabel packets to dict_server the packet type. Domain allowed access. Send and receive TCP traffic on the distccd port. Domain allowed access. Send UDP traffic on the distccd port. Domain allowed access. Do not audit attempts to send UDP traffic on the distccd port. Domain to not audit. Receive UDP traffic on the distccd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the distccd port. Domain to not audit. Send and receive UDP traffic on the distccd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the distccd port. Domain to not audit. Bind TCP sockets to the distccd port. Domain allowed access. Bind UDP sockets to the distccd port. Domain allowed access. Make a TCP connection to the distccd port. Domain allowed access. Send distccd_client packets. Domain allowed access. Do not audit attempts to send distccd_client packets. Domain to not audit. Receive distccd_client packets. Domain allowed access. Do not audit attempts to receive distccd_client packets. Domain allowed access. Send and receive distccd_client packets. Domain allowed access. Do not audit attempts to send and receive distccd_client packets. Domain to not audit. Relabel packets to distccd_client the packet type. Domain allowed access. Send distccd_server packets. Domain allowed access. Do not audit attempts to send distccd_server packets. Domain to not audit. Receive distccd_server packets. Domain allowed access. Do not audit attempts to receive distccd_server packets. Domain allowed access. Send and receive distccd_server packets. Domain allowed access. Do not audit attempts to send and receive distccd_server packets. Domain to not audit. Relabel packets to distccd_server the packet type. Domain allowed access. Send and receive TCP traffic on the dns port. Domain allowed access. Send UDP traffic on the dns port. Domain allowed access. Do not audit attempts to send UDP traffic on the dns port. Domain to not audit. Receive UDP traffic on the dns port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dns port. Domain to not audit. Send and receive UDP traffic on the dns port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dns port. Domain to not audit. Bind TCP sockets to the dns port. Domain allowed access. Bind UDP sockets to the dns port. Domain allowed access. Make a TCP connection to the dns port. Domain allowed access. Send dns_client packets. Domain allowed access. Do not audit attempts to send dns_client packets. Domain to not audit. Receive dns_client packets. Domain allowed access. Do not audit attempts to receive dns_client packets. Domain allowed access. Send and receive dns_client packets. Domain allowed access. Do not audit attempts to send and receive dns_client packets. Domain to not audit. Relabel packets to dns_client the packet type. Domain allowed access. Send dns_server packets. Domain allowed access. Do not audit attempts to send dns_server packets. Domain to not audit. Receive dns_server packets. Domain allowed access. Do not audit attempts to receive dns_server packets. Domain allowed access. Send and receive dns_server packets. Domain allowed access. Do not audit attempts to send and receive dns_server packets. Domain to not audit. Relabel packets to dns_server the packet type. Domain allowed access. Send and receive TCP traffic on the dropbox port. Domain allowed access. Send UDP traffic on the dropbox port. Domain allowed access. Do not audit attempts to send UDP traffic on the dropbox port. Domain to not audit. Receive UDP traffic on the dropbox port. Domain allowed access. Do not audit attempts to receive UDP traffic on the dropbox port. Domain to not audit. Send and receive UDP traffic on the dropbox port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the dropbox port. Domain to not audit. Bind TCP sockets to the dropbox port. Domain allowed access. Bind UDP sockets to the dropbox port. Domain allowed access. Make a TCP connection to the dropbox port. Domain allowed access. Send dropbox_client packets. Domain allowed access. Do not audit attempts to send dropbox_client packets. Domain to not audit. Receive dropbox_client packets. Domain allowed access. Do not audit attempts to receive dropbox_client packets. Domain allowed access. Send and receive dropbox_client packets. Domain allowed access. Do not audit attempts to send and receive dropbox_client packets. Domain to not audit. Relabel packets to dropbox_client the packet type. Domain allowed access. Send dropbox_server packets. Domain allowed access. Do not audit attempts to send dropbox_server packets. Domain to not audit. Receive dropbox_server packets. Domain allowed access. Do not audit attempts to receive dropbox_server packets. Domain allowed access. Send and receive dropbox_server packets. Domain allowed access. Do not audit attempts to send and receive dropbox_server packets. Domain to not audit. Relabel packets to dropbox_server the packet type. Domain allowed access. Send and receive TCP traffic on the efs port. Domain allowed access. Send UDP traffic on the efs port. Domain allowed access. Do not audit attempts to send UDP traffic on the efs port. Domain to not audit. Receive UDP traffic on the efs port. Domain allowed access. Do not audit attempts to receive UDP traffic on the efs port. Domain to not audit. Send and receive UDP traffic on the efs port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the efs port. Domain to not audit. Bind TCP sockets to the efs port. Domain allowed access. Bind UDP sockets to the efs port. Domain allowed access. Make a TCP connection to the efs port. Domain allowed access. Send efs_client packets. Domain allowed access. Do not audit attempts to send efs_client packets. Domain to not audit. Receive efs_client packets. Domain allowed access. Do not audit attempts to receive efs_client packets. Domain allowed access. Send and receive efs_client packets. Domain allowed access. Do not audit attempts to send and receive efs_client packets. Domain to not audit. Relabel packets to efs_client the packet type. Domain allowed access. Send efs_server packets. Domain allowed access. Do not audit attempts to send efs_server packets. Domain to not audit. Receive efs_server packets. Domain allowed access. Do not audit attempts to receive efs_server packets. Domain allowed access. Send and receive efs_server packets. Domain allowed access. Do not audit attempts to send and receive efs_server packets. Domain to not audit. Relabel packets to efs_server the packet type. Domain allowed access. Send and receive TCP traffic on the embrace_dp_c port. Domain allowed access. Send UDP traffic on the embrace_dp_c port. Domain allowed access. Do not audit attempts to send UDP traffic on the embrace_dp_c port. Domain to not audit. Receive UDP traffic on the embrace_dp_c port. Domain allowed access. Do not audit attempts to receive UDP traffic on the embrace_dp_c port. Domain to not audit. Send and receive UDP traffic on the embrace_dp_c port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the embrace_dp_c port. Domain to not audit. Bind TCP sockets to the embrace_dp_c port. Domain allowed access. Bind UDP sockets to the embrace_dp_c port. Domain allowed access. Make a TCP connection to the embrace_dp_c port. Domain allowed access. Send embrace_dp_c_client packets. Domain allowed access. Do not audit attempts to send embrace_dp_c_client packets. Domain to not audit. Receive embrace_dp_c_client packets. Domain allowed access. Do not audit attempts to receive embrace_dp_c_client packets. Domain allowed access. Send and receive embrace_dp_c_client packets. Domain allowed access. Do not audit attempts to send and receive embrace_dp_c_client packets. Domain to not audit. Relabel packets to embrace_dp_c_client the packet type. Domain allowed access. Send embrace_dp_c_server packets. Domain allowed access. Do not audit attempts to send embrace_dp_c_server packets. Domain to not audit. Receive embrace_dp_c_server packets. Domain allowed access. Do not audit attempts to receive embrace_dp_c_server packets. Domain allowed access. Send and receive embrace_dp_c_server packets. Domain allowed access. Do not audit attempts to send and receive embrace_dp_c_server packets. Domain to not audit. Relabel packets to embrace_dp_c_server the packet type. Domain allowed access. Send and receive TCP traffic on the epmap port. Domain allowed access. Send UDP traffic on the epmap port. Domain allowed access. Do not audit attempts to send UDP traffic on the epmap port. Domain to not audit. Receive UDP traffic on the epmap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the epmap port. Domain to not audit. Send and receive UDP traffic on the epmap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the epmap port. Domain to not audit. Bind TCP sockets to the epmap port. Domain allowed access. Bind UDP sockets to the epmap port. Domain allowed access. Make a TCP connection to the epmap port. Domain allowed access. Send epmap_client packets. Domain allowed access. Do not audit attempts to send epmap_client packets. Domain to not audit. Receive epmap_client packets. Domain allowed access. Do not audit attempts to receive epmap_client packets. Domain allowed access. Send and receive epmap_client packets. Domain allowed access. Do not audit attempts to send and receive epmap_client packets. Domain to not audit. Relabel packets to epmap_client the packet type. Domain allowed access. Send epmap_server packets. Domain allowed access. Do not audit attempts to send epmap_server packets. Domain to not audit. Receive epmap_server packets. Domain allowed access. Do not audit attempts to receive epmap_server packets. Domain allowed access. Send and receive epmap_server packets. Domain allowed access. Do not audit attempts to send and receive epmap_server packets. Domain to not audit. Relabel packets to epmap_server the packet type. Domain allowed access. Send and receive TCP traffic on the epmd port. Domain allowed access. Send UDP traffic on the epmd port. Domain allowed access. Do not audit attempts to send UDP traffic on the epmd port. Domain to not audit. Receive UDP traffic on the epmd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the epmd port. Domain to not audit. Send and receive UDP traffic on the epmd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the epmd port. Domain to not audit. Bind TCP sockets to the epmd port. Domain allowed access. Bind UDP sockets to the epmd port. Domain allowed access. Make a TCP connection to the epmd port. Domain allowed access. Send epmd_client packets. Domain allowed access. Do not audit attempts to send epmd_client packets. Domain to not audit. Receive epmd_client packets. Domain allowed access. Do not audit attempts to receive epmd_client packets. Domain allowed access. Send and receive epmd_client packets. Domain allowed access. Do not audit attempts to send and receive epmd_client packets. Domain to not audit. Relabel packets to epmd_client the packet type. Domain allowed access. Send epmd_server packets. Domain allowed access. Do not audit attempts to send epmd_server packets. Domain to not audit. Receive epmd_server packets. Domain allowed access. Do not audit attempts to receive epmd_server packets. Domain allowed access. Send and receive epmd_server packets. Domain allowed access. Do not audit attempts to send and receive epmd_server packets. Domain to not audit. Relabel packets to epmd_server the packet type. Domain allowed access. Send and receive TCP traffic on the fingerd port. Domain allowed access. Send UDP traffic on the fingerd port. Domain allowed access. Do not audit attempts to send UDP traffic on the fingerd port. Domain to not audit. Receive UDP traffic on the fingerd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the fingerd port. Domain to not audit. Send and receive UDP traffic on the fingerd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the fingerd port. Domain to not audit. Bind TCP sockets to the fingerd port. Domain allowed access. Bind UDP sockets to the fingerd port. Domain allowed access. Make a TCP connection to the fingerd port. Domain allowed access. Send fingerd_client packets. Domain allowed access. Do not audit attempts to send fingerd_client packets. Domain to not audit. Receive fingerd_client packets. Domain allowed access. Do not audit attempts to receive fingerd_client packets. Domain allowed access. Send and receive fingerd_client packets. Domain allowed access. Do not audit attempts to send and receive fingerd_client packets. Domain to not audit. Relabel packets to fingerd_client the packet type. Domain allowed access. Send fingerd_server packets. Domain allowed access. Do not audit attempts to send fingerd_server packets. Domain to not audit. Receive fingerd_server packets. Domain allowed access. Do not audit attempts to receive fingerd_server packets. Domain allowed access. Send and receive fingerd_server packets. Domain allowed access. Do not audit attempts to send and receive fingerd_server packets. Domain to not audit. Relabel packets to fingerd_server the packet type. Domain allowed access. Send and receive TCP traffic on the ftp port. Domain allowed access. Send UDP traffic on the ftp port. Domain allowed access. Do not audit attempts to send UDP traffic on the ftp port. Domain to not audit. Receive UDP traffic on the ftp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ftp port. Domain to not audit. Send and receive UDP traffic on the ftp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ftp port. Domain to not audit. Bind TCP sockets to the ftp port. Domain allowed access. Bind UDP sockets to the ftp port. Domain allowed access. Make a TCP connection to the ftp port. Domain allowed access. Send ftp_client packets. Domain allowed access. Do not audit attempts to send ftp_client packets. Domain to not audit. Receive ftp_client packets. Domain allowed access. Do not audit attempts to receive ftp_client packets. Domain allowed access. Send and receive ftp_client packets. Domain allowed access. Do not audit attempts to send and receive ftp_client packets. Domain to not audit. Relabel packets to ftp_client the packet type. Domain allowed access. Send ftp_server packets. Domain allowed access. Do not audit attempts to send ftp_server packets. Domain to not audit. Receive ftp_server packets. Domain allowed access. Do not audit attempts to receive ftp_server packets. Domain allowed access. Send and receive ftp_server packets. Domain allowed access. Do not audit attempts to send and receive ftp_server packets. Domain to not audit. Relabel packets to ftp_server the packet type. Domain allowed access. Send and receive TCP traffic on the ftp_data port. Domain allowed access. Send UDP traffic on the ftp_data port. Domain allowed access. Do not audit attempts to send UDP traffic on the ftp_data port. Domain to not audit. Receive UDP traffic on the ftp_data port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ftp_data port. Domain to not audit. Send and receive UDP traffic on the ftp_data port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ftp_data port. Domain to not audit. Bind TCP sockets to the ftp_data port. Domain allowed access. Bind UDP sockets to the ftp_data port. Domain allowed access. Make a TCP connection to the ftp_data port. Domain allowed access. Send ftp_data_client packets. Domain allowed access. Do not audit attempts to send ftp_data_client packets. Domain to not audit. Receive ftp_data_client packets. Domain allowed access. Do not audit attempts to receive ftp_data_client packets. Domain allowed access. Send and receive ftp_data_client packets. Domain allowed access. Do not audit attempts to send and receive ftp_data_client packets. Domain to not audit. Relabel packets to ftp_data_client the packet type. Domain allowed access. Send ftp_data_server packets. Domain allowed access. Do not audit attempts to send ftp_data_server packets. Domain to not audit. Receive ftp_data_server packets. Domain allowed access. Do not audit attempts to receive ftp_data_server packets. Domain allowed access. Send and receive ftp_data_server packets. Domain allowed access. Do not audit attempts to send and receive ftp_data_server packets. Domain to not audit. Relabel packets to ftp_data_server the packet type. Domain allowed access. Send and receive TCP traffic on the gatekeeper port. Domain allowed access. Send UDP traffic on the gatekeeper port. Domain allowed access. Do not audit attempts to send UDP traffic on the gatekeeper port. Domain to not audit. Receive UDP traffic on the gatekeeper port. Domain allowed access. Do not audit attempts to receive UDP traffic on the gatekeeper port. Domain to not audit. Send and receive UDP traffic on the gatekeeper port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the gatekeeper port. Domain to not audit. Bind TCP sockets to the gatekeeper port. Domain allowed access. Bind UDP sockets to the gatekeeper port. Domain allowed access. Make a TCP connection to the gatekeeper port. Domain allowed access. Send gatekeeper_client packets. Domain allowed access. Do not audit attempts to send gatekeeper_client packets. Domain to not audit. Receive gatekeeper_client packets. Domain allowed access. Do not audit attempts to receive gatekeeper_client packets. Domain allowed access. Send and receive gatekeeper_client packets. Domain allowed access. Do not audit attempts to send and receive gatekeeper_client packets. Domain to not audit. Relabel packets to gatekeeper_client the packet type. Domain allowed access. Send gatekeeper_server packets. Domain allowed access. Do not audit attempts to send gatekeeper_server packets. Domain to not audit. Receive gatekeeper_server packets. Domain allowed access. Do not audit attempts to receive gatekeeper_server packets. Domain allowed access. Send and receive gatekeeper_server packets. Domain allowed access. Do not audit attempts to send and receive gatekeeper_server packets. Domain to not audit. Relabel packets to gatekeeper_server the packet type. Domain allowed access. Send and receive TCP traffic on the gdomap port. Domain allowed access. Send UDP traffic on the gdomap port. Domain allowed access. Do not audit attempts to send UDP traffic on the gdomap port. Domain to not audit. Receive UDP traffic on the gdomap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the gdomap port. Domain to not audit. Send and receive UDP traffic on the gdomap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the gdomap port. Domain to not audit. Bind TCP sockets to the gdomap port. Domain allowed access. Bind UDP sockets to the gdomap port. Domain allowed access. Make a TCP connection to the gdomap port. Domain allowed access. Send gdomap_client packets. Domain allowed access. Do not audit attempts to send gdomap_client packets. Domain to not audit. Receive gdomap_client packets. Domain allowed access. Do not audit attempts to receive gdomap_client packets. Domain allowed access. Send and receive gdomap_client packets. Domain allowed access. Do not audit attempts to send and receive gdomap_client packets. Domain to not audit. Relabel packets to gdomap_client the packet type. Domain allowed access. Send gdomap_server packets. Domain allowed access. Do not audit attempts to send gdomap_server packets. Domain to not audit. Receive gdomap_server packets. Domain allowed access. Do not audit attempts to receive gdomap_server packets. Domain allowed access. Send and receive gdomap_server packets. Domain allowed access. Do not audit attempts to send and receive gdomap_server packets. Domain to not audit. Relabel packets to gdomap_server the packet type. Domain allowed access. Send and receive TCP traffic on the gds_db port. Domain allowed access. Send UDP traffic on the gds_db port. Domain allowed access. Do not audit attempts to send UDP traffic on the gds_db port. Domain to not audit. Receive UDP traffic on the gds_db port. Domain allowed access. Do not audit attempts to receive UDP traffic on the gds_db port. Domain to not audit. Send and receive UDP traffic on the gds_db port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the gds_db port. Domain to not audit. Bind TCP sockets to the gds_db port. Domain allowed access. Bind UDP sockets to the gds_db port. Domain allowed access. Make a TCP connection to the gds_db port. Domain allowed access. Send gds_db_client packets. Domain allowed access. Do not audit attempts to send gds_db_client packets. Domain to not audit. Receive gds_db_client packets. Domain allowed access. Do not audit attempts to receive gds_db_client packets. Domain allowed access. Send and receive gds_db_client packets. Domain allowed access. Do not audit attempts to send and receive gds_db_client packets. Domain to not audit. Relabel packets to gds_db_client the packet type. Domain allowed access. Send gds_db_server packets. Domain allowed access. Do not audit attempts to send gds_db_server packets. Domain to not audit. Receive gds_db_server packets. Domain allowed access. Do not audit attempts to receive gds_db_server packets. Domain allowed access. Send and receive gds_db_server packets. Domain allowed access. Do not audit attempts to send and receive gds_db_server packets. Domain to not audit. Relabel packets to gds_db_server the packet type. Domain allowed access. Send and receive TCP traffic on the giftd port. Domain allowed access. Send UDP traffic on the giftd port. Domain allowed access. Do not audit attempts to send UDP traffic on the giftd port. Domain to not audit. Receive UDP traffic on the giftd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the giftd port. Domain to not audit. Send and receive UDP traffic on the giftd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the giftd port. Domain to not audit. Bind TCP sockets to the giftd port. Domain allowed access. Bind UDP sockets to the giftd port. Domain allowed access. Make a TCP connection to the giftd port. Domain allowed access. Send giftd_client packets. Domain allowed access. Do not audit attempts to send giftd_client packets. Domain to not audit. Receive giftd_client packets. Domain allowed access. Do not audit attempts to receive giftd_client packets. Domain allowed access. Send and receive giftd_client packets. Domain allowed access. Do not audit attempts to send and receive giftd_client packets. Domain to not audit. Relabel packets to giftd_client the packet type. Domain allowed access. Send giftd_server packets. Domain allowed access. Do not audit attempts to send giftd_server packets. Domain to not audit. Receive giftd_server packets. Domain allowed access. Do not audit attempts to receive giftd_server packets. Domain allowed access. Send and receive giftd_server packets. Domain allowed access. Do not audit attempts to send and receive giftd_server packets. Domain to not audit. Relabel packets to giftd_server the packet type. Domain allowed access. Send and receive TCP traffic on the git port. Domain allowed access. Send UDP traffic on the git port. Domain allowed access. Do not audit attempts to send UDP traffic on the git port. Domain to not audit. Receive UDP traffic on the git port. Domain allowed access. Do not audit attempts to receive UDP traffic on the git port. Domain to not audit. Send and receive UDP traffic on the git port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the git port. Domain to not audit. Bind TCP sockets to the git port. Domain allowed access. Bind UDP sockets to the git port. Domain allowed access. Make a TCP connection to the git port. Domain allowed access. Send git_client packets. Domain allowed access. Do not audit attempts to send git_client packets. Domain to not audit. Receive git_client packets. Domain allowed access. Do not audit attempts to receive git_client packets. Domain allowed access. Send and receive git_client packets. Domain allowed access. Do not audit attempts to send and receive git_client packets. Domain to not audit. Relabel packets to git_client the packet type. Domain allowed access. Send git_server packets. Domain allowed access. Do not audit attempts to send git_server packets. Domain to not audit. Receive git_server packets. Domain allowed access. Do not audit attempts to receive git_server packets. Domain allowed access. Send and receive git_server packets. Domain allowed access. Do not audit attempts to send and receive git_server packets. Domain to not audit. Relabel packets to git_server the packet type. Domain allowed access. Send and receive TCP traffic on the glance_registry port. Domain allowed access. Send UDP traffic on the glance_registry port. Domain allowed access. Do not audit attempts to send UDP traffic on the glance_registry port. Domain to not audit. Receive UDP traffic on the glance_registry port. Domain allowed access. Do not audit attempts to receive UDP traffic on the glance_registry port. Domain to not audit. Send and receive UDP traffic on the glance_registry port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the glance_registry port. Domain to not audit. Bind TCP sockets to the glance_registry port. Domain allowed access. Bind UDP sockets to the glance_registry port. Domain allowed access. Make a TCP connection to the glance_registry port. Domain allowed access. Send glance_registry_client packets. Domain allowed access. Do not audit attempts to send glance_registry_client packets. Domain to not audit. Receive glance_registry_client packets. Domain allowed access. Do not audit attempts to receive glance_registry_client packets. Domain allowed access. Send and receive glance_registry_client packets. Domain allowed access. Do not audit attempts to send and receive glance_registry_client packets. Domain to not audit. Relabel packets to glance_registry_client the packet type. Domain allowed access. Send glance_registry_server packets. Domain allowed access. Do not audit attempts to send glance_registry_server packets. Domain to not audit. Receive glance_registry_server packets. Domain allowed access. Do not audit attempts to receive glance_registry_server packets. Domain allowed access. Send and receive glance_registry_server packets. Domain allowed access. Do not audit attempts to send and receive glance_registry_server packets. Domain to not audit. Relabel packets to glance_registry_server the packet type. Domain allowed access. Send and receive TCP traffic on the gopher port. Domain allowed access. Send UDP traffic on the gopher port. Domain allowed access. Do not audit attempts to send UDP traffic on the gopher port. Domain to not audit. Receive UDP traffic on the gopher port. Domain allowed access. Do not audit attempts to receive UDP traffic on the gopher port. Domain to not audit. Send and receive UDP traffic on the gopher port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the gopher port. Domain to not audit. Bind TCP sockets to the gopher port. Domain allowed access. Bind UDP sockets to the gopher port. Domain allowed access. Make a TCP connection to the gopher port. Domain allowed access. Send gopher_client packets. Domain allowed access. Do not audit attempts to send gopher_client packets. Domain to not audit. Receive gopher_client packets. Domain allowed access. Do not audit attempts to receive gopher_client packets. Domain allowed access. Send and receive gopher_client packets. Domain allowed access. Do not audit attempts to send and receive gopher_client packets. Domain to not audit. Relabel packets to gopher_client the packet type. Domain allowed access. Send gopher_server packets. Domain allowed access. Do not audit attempts to send gopher_server packets. Domain to not audit. Receive gopher_server packets. Domain allowed access. Do not audit attempts to receive gopher_server packets. Domain allowed access. Send and receive gopher_server packets. Domain allowed access. Do not audit attempts to send and receive gopher_server packets. Domain to not audit. Relabel packets to gopher_server the packet type. Domain allowed access. Send and receive TCP traffic on the gpsd port. Domain allowed access. Send UDP traffic on the gpsd port. Domain allowed access. Do not audit attempts to send UDP traffic on the gpsd port. Domain to not audit. Receive UDP traffic on the gpsd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the gpsd port. Domain to not audit. Send and receive UDP traffic on the gpsd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the gpsd port. Domain to not audit. Bind TCP sockets to the gpsd port. Domain allowed access. Bind UDP sockets to the gpsd port. Domain allowed access. Make a TCP connection to the gpsd port. Domain allowed access. Send gpsd_client packets. Domain allowed access. Do not audit attempts to send gpsd_client packets. Domain to not audit. Receive gpsd_client packets. Domain allowed access. Do not audit attempts to receive gpsd_client packets. Domain allowed access. Send and receive gpsd_client packets. Domain allowed access. Do not audit attempts to send and receive gpsd_client packets. Domain to not audit. Relabel packets to gpsd_client the packet type. Domain allowed access. Send gpsd_server packets. Domain allowed access. Do not audit attempts to send gpsd_server packets. Domain to not audit. Receive gpsd_server packets. Domain allowed access. Do not audit attempts to receive gpsd_server packets. Domain allowed access. Send and receive gpsd_server packets. Domain allowed access. Do not audit attempts to send and receive gpsd_server packets. Domain to not audit. Relabel packets to gpsd_server the packet type. Domain allowed access. Send and receive TCP traffic on the hadoop_datanode port. Domain allowed access. Send UDP traffic on the hadoop_datanode port. Domain allowed access. Do not audit attempts to send UDP traffic on the hadoop_datanode port. Domain to not audit. Receive UDP traffic on the hadoop_datanode port. Domain allowed access. Do not audit attempts to receive UDP traffic on the hadoop_datanode port. Domain to not audit. Send and receive UDP traffic on the hadoop_datanode port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the hadoop_datanode port. Domain to not audit. Bind TCP sockets to the hadoop_datanode port. Domain allowed access. Bind UDP sockets to the hadoop_datanode port. Domain allowed access. Make a TCP connection to the hadoop_datanode port. Domain allowed access. Send hadoop_datanode_client packets. Domain allowed access. Do not audit attempts to send hadoop_datanode_client packets. Domain to not audit. Receive hadoop_datanode_client packets. Domain allowed access. Do not audit attempts to receive hadoop_datanode_client packets. Domain allowed access. Send and receive hadoop_datanode_client packets. Domain allowed access. Do not audit attempts to send and receive hadoop_datanode_client packets. Domain to not audit. Relabel packets to hadoop_datanode_client the packet type. Domain allowed access. Send hadoop_datanode_server packets. Domain allowed access. Do not audit attempts to send hadoop_datanode_server packets. Domain to not audit. Receive hadoop_datanode_server packets. Domain allowed access. Do not audit attempts to receive hadoop_datanode_server packets. Domain allowed access. Send and receive hadoop_datanode_server packets. Domain allowed access. Do not audit attempts to send and receive hadoop_datanode_server packets. Domain to not audit. Relabel packets to hadoop_datanode_server the packet type. Domain allowed access. Send and receive TCP traffic on the hadoop_namenode port. Domain allowed access. Send UDP traffic on the hadoop_namenode port. Domain allowed access. Do not audit attempts to send UDP traffic on the hadoop_namenode port. Domain to not audit. Receive UDP traffic on the hadoop_namenode port. Domain allowed access. Do not audit attempts to receive UDP traffic on the hadoop_namenode port. Domain to not audit. Send and receive UDP traffic on the hadoop_namenode port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the hadoop_namenode port. Domain to not audit. Bind TCP sockets to the hadoop_namenode port. Domain allowed access. Bind UDP sockets to the hadoop_namenode port. Domain allowed access. Make a TCP connection to the hadoop_namenode port. Domain allowed access. Send hadoop_namenode_client packets. Domain allowed access. Do not audit attempts to send hadoop_namenode_client packets. Domain to not audit. Receive hadoop_namenode_client packets. Domain allowed access. Do not audit attempts to receive hadoop_namenode_client packets. Domain allowed access. Send and receive hadoop_namenode_client packets. Domain allowed access. Do not audit attempts to send and receive hadoop_namenode_client packets. Domain to not audit. Relabel packets to hadoop_namenode_client the packet type. Domain allowed access. Send hadoop_namenode_server packets. Domain allowed access. Do not audit attempts to send hadoop_namenode_server packets. Domain to not audit. Receive hadoop_namenode_server packets. Domain allowed access. Do not audit attempts to receive hadoop_namenode_server packets. Domain allowed access. Send and receive hadoop_namenode_server packets. Domain allowed access. Do not audit attempts to send and receive hadoop_namenode_server packets. Domain to not audit. Relabel packets to hadoop_namenode_server the packet type. Domain allowed access. Send and receive TCP traffic on the hddtemp port. Domain allowed access. Send UDP traffic on the hddtemp port. Domain allowed access. Do not audit attempts to send UDP traffic on the hddtemp port. Domain to not audit. Receive UDP traffic on the hddtemp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the hddtemp port. Domain to not audit. Send and receive UDP traffic on the hddtemp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the hddtemp port. Domain to not audit. Bind TCP sockets to the hddtemp port. Domain allowed access. Bind UDP sockets to the hddtemp port. Domain allowed access. Make a TCP connection to the hddtemp port. Domain allowed access. Send hddtemp_client packets. Domain allowed access. Do not audit attempts to send hddtemp_client packets. Domain to not audit. Receive hddtemp_client packets. Domain allowed access. Do not audit attempts to receive hddtemp_client packets. Domain allowed access. Send and receive hddtemp_client packets. Domain allowed access. Do not audit attempts to send and receive hddtemp_client packets. Domain to not audit. Relabel packets to hddtemp_client the packet type. Domain allowed access. Send hddtemp_server packets. Domain allowed access. Do not audit attempts to send hddtemp_server packets. Domain to not audit. Receive hddtemp_server packets. Domain allowed access. Do not audit attempts to receive hddtemp_server packets. Domain allowed access. Send and receive hddtemp_server packets. Domain allowed access. Do not audit attempts to send and receive hddtemp_server packets. Domain to not audit. Relabel packets to hddtemp_server the packet type. Domain allowed access. Send and receive TCP traffic on the howl port. Domain allowed access. Send UDP traffic on the howl port. Domain allowed access. Do not audit attempts to send UDP traffic on the howl port. Domain to not audit. Receive UDP traffic on the howl port. Domain allowed access. Do not audit attempts to receive UDP traffic on the howl port. Domain to not audit. Send and receive UDP traffic on the howl port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the howl port. Domain to not audit. Bind TCP sockets to the howl port. Domain allowed access. Bind UDP sockets to the howl port. Domain allowed access. Make a TCP connection to the howl port. Domain allowed access. Send howl_client packets. Domain allowed access. Do not audit attempts to send howl_client packets. Domain to not audit. Receive howl_client packets. Domain allowed access. Do not audit attempts to receive howl_client packets. Domain allowed access. Send and receive howl_client packets. Domain allowed access. Do not audit attempts to send and receive howl_client packets. Domain to not audit. Relabel packets to howl_client the packet type. Domain allowed access. Send howl_server packets. Domain allowed access. Do not audit attempts to send howl_server packets. Domain to not audit. Receive howl_server packets. Domain allowed access. Do not audit attempts to receive howl_server packets. Domain allowed access. Send and receive howl_server packets. Domain allowed access. Do not audit attempts to send and receive howl_server packets. Domain to not audit. Relabel packets to howl_server the packet type. Domain allowed access. Send and receive TCP traffic on the hplip port. Domain allowed access. Send UDP traffic on the hplip port. Domain allowed access. Do not audit attempts to send UDP traffic on the hplip port. Domain to not audit. Receive UDP traffic on the hplip port. Domain allowed access. Do not audit attempts to receive UDP traffic on the hplip port. Domain to not audit. Send and receive UDP traffic on the hplip port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the hplip port. Domain to not audit. Bind TCP sockets to the hplip port. Domain allowed access. Bind UDP sockets to the hplip port. Domain allowed access. Make a TCP connection to the hplip port. Domain allowed access. Send hplip_client packets. Domain allowed access. Do not audit attempts to send hplip_client packets. Domain to not audit. Receive hplip_client packets. Domain allowed access. Do not audit attempts to receive hplip_client packets. Domain allowed access. Send and receive hplip_client packets. Domain allowed access. Do not audit attempts to send and receive hplip_client packets. Domain to not audit. Relabel packets to hplip_client the packet type. Domain allowed access. Send hplip_server packets. Domain allowed access. Do not audit attempts to send hplip_server packets. Domain to not audit. Receive hplip_server packets. Domain allowed access. Do not audit attempts to receive hplip_server packets. Domain allowed access. Send and receive hplip_server packets. Domain allowed access. Do not audit attempts to send and receive hplip_server packets. Domain to not audit. Relabel packets to hplip_server the packet type. Domain allowed access. Send and receive TCP traffic on the http port. Domain allowed access. Send UDP traffic on the http port. Domain allowed access. Do not audit attempts to send UDP traffic on the http port. Domain to not audit. Receive UDP traffic on the http port. Domain allowed access. Do not audit attempts to receive UDP traffic on the http port. Domain to not audit. Send and receive UDP traffic on the http port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the http port. Domain to not audit. Bind TCP sockets to the http port. Domain allowed access. Bind UDP sockets to the http port. Domain allowed access. Make a TCP connection to the http port. Domain allowed access. Send http_client packets. Domain allowed access. Do not audit attempts to send http_client packets. Domain to not audit. Receive http_client packets. Domain allowed access. Do not audit attempts to receive http_client packets. Domain allowed access. Send and receive http_client packets. Domain allowed access. Do not audit attempts to send and receive http_client packets. Domain to not audit. Relabel packets to http_client the packet type. Domain allowed access. Send http_server packets. Domain allowed access. Do not audit attempts to send http_server packets. Domain to not audit. Receive http_server packets. Domain allowed access. Do not audit attempts to receive http_server packets. Domain allowed access. Send and receive http_server packets. Domain allowed access. Do not audit attempts to send and receive http_server packets. Domain to not audit. Relabel packets to http_server the packet type. Domain allowed access. Send and receive TCP traffic on the http_cache port. Domain allowed access. Send UDP traffic on the http_cache port. Domain allowed access. Do not audit attempts to send UDP traffic on the http_cache port. Domain to not audit. Receive UDP traffic on the http_cache port. Domain allowed access. Do not audit attempts to receive UDP traffic on the http_cache port. Domain to not audit. Send and receive UDP traffic on the http_cache port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the http_cache port. Domain to not audit. Bind TCP sockets to the http_cache port. Domain allowed access. Bind UDP sockets to the http_cache port. Domain allowed access. Make a TCP connection to the http_cache port. Domain allowed access. Send http_cache_client packets. Domain allowed access. Do not audit attempts to send http_cache_client packets. Domain to not audit. Receive http_cache_client packets. Domain allowed access. Do not audit attempts to receive http_cache_client packets. Domain allowed access. Send and receive http_cache_client packets. Domain allowed access. Do not audit attempts to send and receive http_cache_client packets. Domain to not audit. Relabel packets to http_cache_client the packet type. Domain allowed access. Send http_cache_server packets. Domain allowed access. Do not audit attempts to send http_cache_server packets. Domain to not audit. Receive http_cache_server packets. Domain allowed access. Do not audit attempts to receive http_cache_server packets. Domain allowed access. Send and receive http_cache_server packets. Domain allowed access. Do not audit attempts to send and receive http_cache_server packets. Domain to not audit. Relabel packets to http_cache_server the packet type. Domain allowed access. Send and receive TCP traffic on the i18n_input port. Domain allowed access. Send UDP traffic on the i18n_input port. Domain allowed access. Do not audit attempts to send UDP traffic on the i18n_input port. Domain to not audit. Receive UDP traffic on the i18n_input port. Domain allowed access. Do not audit attempts to receive UDP traffic on the i18n_input port. Domain to not audit. Send and receive UDP traffic on the i18n_input port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the i18n_input port. Domain to not audit. Bind TCP sockets to the i18n_input port. Domain allowed access. Bind UDP sockets to the i18n_input port. Domain allowed access. Make a TCP connection to the i18n_input port. Domain allowed access. Send i18n_input_client packets. Domain allowed access. Do not audit attempts to send i18n_input_client packets. Domain to not audit. Receive i18n_input_client packets. Domain allowed access. Do not audit attempts to receive i18n_input_client packets. Domain allowed access. Send and receive i18n_input_client packets. Domain allowed access. Do not audit attempts to send and receive i18n_input_client packets. Domain to not audit. Relabel packets to i18n_input_client the packet type. Domain allowed access. Send i18n_input_server packets. Domain allowed access. Do not audit attempts to send i18n_input_server packets. Domain to not audit. Receive i18n_input_server packets. Domain allowed access. Do not audit attempts to receive i18n_input_server packets. Domain allowed access. Send and receive i18n_input_server packets. Domain allowed access. Do not audit attempts to send and receive i18n_input_server packets. Domain to not audit. Relabel packets to i18n_input_server the packet type. Domain allowed access. Send and receive TCP traffic on the imaze port. Domain allowed access. Send UDP traffic on the imaze port. Domain allowed access. Do not audit attempts to send UDP traffic on the imaze port. Domain to not audit. Receive UDP traffic on the imaze port. Domain allowed access. Do not audit attempts to receive UDP traffic on the imaze port. Domain to not audit. Send and receive UDP traffic on the imaze port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the imaze port. Domain to not audit. Bind TCP sockets to the imaze port. Domain allowed access. Bind UDP sockets to the imaze port. Domain allowed access. Make a TCP connection to the imaze port. Domain allowed access. Send imaze_client packets. Domain allowed access. Do not audit attempts to send imaze_client packets. Domain to not audit. Receive imaze_client packets. Domain allowed access. Do not audit attempts to receive imaze_client packets. Domain allowed access. Send and receive imaze_client packets. Domain allowed access. Do not audit attempts to send and receive imaze_client packets. Domain to not audit. Relabel packets to imaze_client the packet type. Domain allowed access. Send imaze_server packets. Domain allowed access. Do not audit attempts to send imaze_server packets. Domain to not audit. Receive imaze_server packets. Domain allowed access. Do not audit attempts to receive imaze_server packets. Domain allowed access. Send and receive imaze_server packets. Domain allowed access. Do not audit attempts to send and receive imaze_server packets. Domain to not audit. Relabel packets to imaze_server the packet type. Domain allowed access. Send and receive TCP traffic on the inetd_child port. Domain allowed access. Send UDP traffic on the inetd_child port. Domain allowed access. Do not audit attempts to send UDP traffic on the inetd_child port. Domain to not audit. Receive UDP traffic on the inetd_child port. Domain allowed access. Do not audit attempts to receive UDP traffic on the inetd_child port. Domain to not audit. Send and receive UDP traffic on the inetd_child port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the inetd_child port. Domain to not audit. Bind TCP sockets to the inetd_child port. Domain allowed access. Bind UDP sockets to the inetd_child port. Domain allowed access. Make a TCP connection to the inetd_child port. Domain allowed access. Send inetd_child_client packets. Domain allowed access. Do not audit attempts to send inetd_child_client packets. Domain to not audit. Receive inetd_child_client packets. Domain allowed access. Do not audit attempts to receive inetd_child_client packets. Domain allowed access. Send and receive inetd_child_client packets. Domain allowed access. Do not audit attempts to send and receive inetd_child_client packets. Domain to not audit. Relabel packets to inetd_child_client the packet type. Domain allowed access. Send inetd_child_server packets. Domain allowed access. Do not audit attempts to send inetd_child_server packets. Domain to not audit. Receive inetd_child_server packets. Domain allowed access. Do not audit attempts to receive inetd_child_server packets. Domain allowed access. Send and receive inetd_child_server packets. Domain allowed access. Do not audit attempts to send and receive inetd_child_server packets. Domain to not audit. Relabel packets to inetd_child_server the packet type. Domain allowed access. Send and receive TCP traffic on the innd port. Domain allowed access. Send UDP traffic on the innd port. Domain allowed access. Do not audit attempts to send UDP traffic on the innd port. Domain to not audit. Receive UDP traffic on the innd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the innd port. Domain to not audit. Send and receive UDP traffic on the innd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the innd port. Domain to not audit. Bind TCP sockets to the innd port. Domain allowed access. Bind UDP sockets to the innd port. Domain allowed access. Make a TCP connection to the innd port. Domain allowed access. Send innd_client packets. Domain allowed access. Do not audit attempts to send innd_client packets. Domain to not audit. Receive innd_client packets. Domain allowed access. Do not audit attempts to receive innd_client packets. Domain allowed access. Send and receive innd_client packets. Domain allowed access. Do not audit attempts to send and receive innd_client packets. Domain to not audit. Relabel packets to innd_client the packet type. Domain allowed access. Send innd_server packets. Domain allowed access. Do not audit attempts to send innd_server packets. Domain to not audit. Receive innd_server packets. Domain allowed access. Do not audit attempts to receive innd_server packets. Domain allowed access. Send and receive innd_server packets. Domain allowed access. Do not audit attempts to send and receive innd_server packets. Domain to not audit. Relabel packets to innd_server the packet type. Domain allowed access. Send and receive TCP traffic on the interwise port. Domain allowed access. Send UDP traffic on the interwise port. Domain allowed access. Do not audit attempts to send UDP traffic on the interwise port. Domain to not audit. Receive UDP traffic on the interwise port. Domain allowed access. Do not audit attempts to receive UDP traffic on the interwise port. Domain to not audit. Send and receive UDP traffic on the interwise port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the interwise port. Domain to not audit. Bind TCP sockets to the interwise port. Domain allowed access. Bind UDP sockets to the interwise port. Domain allowed access. Make a TCP connection to the interwise port. Domain allowed access. Send interwise_client packets. Domain allowed access. Do not audit attempts to send interwise_client packets. Domain to not audit. Receive interwise_client packets. Domain allowed access. Do not audit attempts to receive interwise_client packets. Domain allowed access. Send and receive interwise_client packets. Domain allowed access. Do not audit attempts to send and receive interwise_client packets. Domain to not audit. Relabel packets to interwise_client the packet type. Domain allowed access. Send interwise_server packets. Domain allowed access. Do not audit attempts to send interwise_server packets. Domain to not audit. Receive interwise_server packets. Domain allowed access. Do not audit attempts to receive interwise_server packets. Domain allowed access. Send and receive interwise_server packets. Domain allowed access. Do not audit attempts to send and receive interwise_server packets. Domain to not audit. Relabel packets to interwise_server the packet type. Domain allowed access. Send and receive TCP traffic on the ionixnetmon port. Domain allowed access. Send UDP traffic on the ionixnetmon port. Domain allowed access. Do not audit attempts to send UDP traffic on the ionixnetmon port. Domain to not audit. Receive UDP traffic on the ionixnetmon port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ionixnetmon port. Domain to not audit. Send and receive UDP traffic on the ionixnetmon port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ionixnetmon port. Domain to not audit. Bind TCP sockets to the ionixnetmon port. Domain allowed access. Bind UDP sockets to the ionixnetmon port. Domain allowed access. Make a TCP connection to the ionixnetmon port. Domain allowed access. Send ionixnetmon_client packets. Domain allowed access. Do not audit attempts to send ionixnetmon_client packets. Domain to not audit. Receive ionixnetmon_client packets. Domain allowed access. Do not audit attempts to receive ionixnetmon_client packets. Domain allowed access. Send and receive ionixnetmon_client packets. Domain allowed access. Do not audit attempts to send and receive ionixnetmon_client packets. Domain to not audit. Relabel packets to ionixnetmon_client the packet type. Domain allowed access. Send ionixnetmon_server packets. Domain allowed access. Do not audit attempts to send ionixnetmon_server packets. Domain to not audit. Receive ionixnetmon_server packets. Domain allowed access. Do not audit attempts to receive ionixnetmon_server packets. Domain allowed access. Send and receive ionixnetmon_server packets. Domain allowed access. Do not audit attempts to send and receive ionixnetmon_server packets. Domain to not audit. Relabel packets to ionixnetmon_server the packet type. Domain allowed access. Send and receive TCP traffic on the ipmi port. Domain allowed access. Send UDP traffic on the ipmi port. Domain allowed access. Do not audit attempts to send UDP traffic on the ipmi port. Domain to not audit. Receive UDP traffic on the ipmi port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ipmi port. Domain to not audit. Send and receive UDP traffic on the ipmi port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ipmi port. Domain to not audit. Bind TCP sockets to the ipmi port. Domain allowed access. Bind UDP sockets to the ipmi port. Domain allowed access. Make a TCP connection to the ipmi port. Domain allowed access. Send ipmi_client packets. Domain allowed access. Do not audit attempts to send ipmi_client packets. Domain to not audit. Receive ipmi_client packets. Domain allowed access. Do not audit attempts to receive ipmi_client packets. Domain allowed access. Send and receive ipmi_client packets. Domain allowed access. Do not audit attempts to send and receive ipmi_client packets. Domain to not audit. Relabel packets to ipmi_client the packet type. Domain allowed access. Send ipmi_server packets. Domain allowed access. Do not audit attempts to send ipmi_server packets. Domain to not audit. Receive ipmi_server packets. Domain allowed access. Do not audit attempts to receive ipmi_server packets. Domain allowed access. Send and receive ipmi_server packets. Domain allowed access. Do not audit attempts to send and receive ipmi_server packets. Domain to not audit. Relabel packets to ipmi_server the packet type. Domain allowed access. Send and receive TCP traffic on the ipp port. Domain allowed access. Send UDP traffic on the ipp port. Domain allowed access. Do not audit attempts to send UDP traffic on the ipp port. Domain to not audit. Receive UDP traffic on the ipp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ipp port. Domain to not audit. Send and receive UDP traffic on the ipp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ipp port. Domain to not audit. Bind TCP sockets to the ipp port. Domain allowed access. Bind UDP sockets to the ipp port. Domain allowed access. Make a TCP connection to the ipp port. Domain allowed access. Send ipp_client packets. Domain allowed access. Do not audit attempts to send ipp_client packets. Domain to not audit. Receive ipp_client packets. Domain allowed access. Do not audit attempts to receive ipp_client packets. Domain allowed access. Send and receive ipp_client packets. Domain allowed access. Do not audit attempts to send and receive ipp_client packets. Domain to not audit. Relabel packets to ipp_client the packet type. Domain allowed access. Send ipp_server packets. Domain allowed access. Do not audit attempts to send ipp_server packets. Domain to not audit. Receive ipp_server packets. Domain allowed access. Do not audit attempts to receive ipp_server packets. Domain allowed access. Send and receive ipp_server packets. Domain allowed access. Do not audit attempts to send and receive ipp_server packets. Domain to not audit. Relabel packets to ipp_server the packet type. Domain allowed access. Send and receive TCP traffic on the ipsecnat port. Domain allowed access. Send UDP traffic on the ipsecnat port. Domain allowed access. Do not audit attempts to send UDP traffic on the ipsecnat port. Domain to not audit. Receive UDP traffic on the ipsecnat port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ipsecnat port. Domain to not audit. Send and receive UDP traffic on the ipsecnat port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ipsecnat port. Domain to not audit. Bind TCP sockets to the ipsecnat port. Domain allowed access. Bind UDP sockets to the ipsecnat port. Domain allowed access. Make a TCP connection to the ipsecnat port. Domain allowed access. Send ipsecnat_client packets. Domain allowed access. Do not audit attempts to send ipsecnat_client packets. Domain to not audit. Receive ipsecnat_client packets. Domain allowed access. Do not audit attempts to receive ipsecnat_client packets. Domain allowed access. Send and receive ipsecnat_client packets. Domain allowed access. Do not audit attempts to send and receive ipsecnat_client packets. Domain to not audit. Relabel packets to ipsecnat_client the packet type. Domain allowed access. Send ipsecnat_server packets. Domain allowed access. Do not audit attempts to send ipsecnat_server packets. Domain to not audit. Receive ipsecnat_server packets. Domain allowed access. Do not audit attempts to receive ipsecnat_server packets. Domain allowed access. Send and receive ipsecnat_server packets. Domain allowed access. Do not audit attempts to send and receive ipsecnat_server packets. Domain to not audit. Relabel packets to ipsecnat_server the packet type. Domain allowed access. Send and receive TCP traffic on the ircd port. Domain allowed access. Send UDP traffic on the ircd port. Domain allowed access. Do not audit attempts to send UDP traffic on the ircd port. Domain to not audit. Receive UDP traffic on the ircd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ircd port. Domain to not audit. Send and receive UDP traffic on the ircd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ircd port. Domain to not audit. Bind TCP sockets to the ircd port. Domain allowed access. Bind UDP sockets to the ircd port. Domain allowed access. Make a TCP connection to the ircd port. Domain allowed access. Send ircd_client packets. Domain allowed access. Do not audit attempts to send ircd_client packets. Domain to not audit. Receive ircd_client packets. Domain allowed access. Do not audit attempts to receive ircd_client packets. Domain allowed access. Send and receive ircd_client packets. Domain allowed access. Do not audit attempts to send and receive ircd_client packets. Domain to not audit. Relabel packets to ircd_client the packet type. Domain allowed access. Send ircd_server packets. Domain allowed access. Do not audit attempts to send ircd_server packets. Domain to not audit. Receive ircd_server packets. Domain allowed access. Do not audit attempts to receive ircd_server packets. Domain allowed access. Send and receive ircd_server packets. Domain allowed access. Do not audit attempts to send and receive ircd_server packets. Domain to not audit. Relabel packets to ircd_server the packet type. Domain allowed access. Send and receive TCP traffic on the isakmp port. Domain allowed access. Send UDP traffic on the isakmp port. Domain allowed access. Do not audit attempts to send UDP traffic on the isakmp port. Domain to not audit. Receive UDP traffic on the isakmp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the isakmp port. Domain to not audit. Send and receive UDP traffic on the isakmp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the isakmp port. Domain to not audit. Bind TCP sockets to the isakmp port. Domain allowed access. Bind UDP sockets to the isakmp port. Domain allowed access. Make a TCP connection to the isakmp port. Domain allowed access. Send isakmp_client packets. Domain allowed access. Do not audit attempts to send isakmp_client packets. Domain to not audit. Receive isakmp_client packets. Domain allowed access. Do not audit attempts to receive isakmp_client packets. Domain allowed access. Send and receive isakmp_client packets. Domain allowed access. Do not audit attempts to send and receive isakmp_client packets. Domain to not audit. Relabel packets to isakmp_client the packet type. Domain allowed access. Send isakmp_server packets. Domain allowed access. Do not audit attempts to send isakmp_server packets. Domain to not audit. Receive isakmp_server packets. Domain allowed access. Do not audit attempts to receive isakmp_server packets. Domain allowed access. Send and receive isakmp_server packets. Domain allowed access. Do not audit attempts to send and receive isakmp_server packets. Domain to not audit. Relabel packets to isakmp_server the packet type. Domain allowed access. Send and receive TCP traffic on the iscsi port. Domain allowed access. Send UDP traffic on the iscsi port. Domain allowed access. Do not audit attempts to send UDP traffic on the iscsi port. Domain to not audit. Receive UDP traffic on the iscsi port. Domain allowed access. Do not audit attempts to receive UDP traffic on the iscsi port. Domain to not audit. Send and receive UDP traffic on the iscsi port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the iscsi port. Domain to not audit. Bind TCP sockets to the iscsi port. Domain allowed access. Bind UDP sockets to the iscsi port. Domain allowed access. Make a TCP connection to the iscsi port. Domain allowed access. Send iscsi_client packets. Domain allowed access. Do not audit attempts to send iscsi_client packets. Domain to not audit. Receive iscsi_client packets. Domain allowed access. Do not audit attempts to receive iscsi_client packets. Domain allowed access. Send and receive iscsi_client packets. Domain allowed access. Do not audit attempts to send and receive iscsi_client packets. Domain to not audit. Relabel packets to iscsi_client the packet type. Domain allowed access. Send iscsi_server packets. Domain allowed access. Do not audit attempts to send iscsi_server packets. Domain to not audit. Receive iscsi_server packets. Domain allowed access. Do not audit attempts to receive iscsi_server packets. Domain allowed access. Send and receive iscsi_server packets. Domain allowed access. Do not audit attempts to send and receive iscsi_server packets. Domain to not audit. Relabel packets to iscsi_server the packet type. Domain allowed access. Send and receive TCP traffic on the isns port. Domain allowed access. Send UDP traffic on the isns port. Domain allowed access. Do not audit attempts to send UDP traffic on the isns port. Domain to not audit. Receive UDP traffic on the isns port. Domain allowed access. Do not audit attempts to receive UDP traffic on the isns port. Domain to not audit. Send and receive UDP traffic on the isns port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the isns port. Domain to not audit. Bind TCP sockets to the isns port. Domain allowed access. Bind UDP sockets to the isns port. Domain allowed access. Make a TCP connection to the isns port. Domain allowed access. Send isns_client packets. Domain allowed access. Do not audit attempts to send isns_client packets. Domain to not audit. Receive isns_client packets. Domain allowed access. Do not audit attempts to receive isns_client packets. Domain allowed access. Send and receive isns_client packets. Domain allowed access. Do not audit attempts to send and receive isns_client packets. Domain to not audit. Relabel packets to isns_client the packet type. Domain allowed access. Send isns_server packets. Domain allowed access. Do not audit attempts to send isns_server packets. Domain to not audit. Receive isns_server packets. Domain allowed access. Do not audit attempts to receive isns_server packets. Domain allowed access. Send and receive isns_server packets. Domain allowed access. Do not audit attempts to send and receive isns_server packets. Domain to not audit. Relabel packets to isns_server the packet type. Domain allowed access. Send and receive TCP traffic on the jabber_client port. Domain allowed access. Send UDP traffic on the jabber_client port. Domain allowed access. Do not audit attempts to send UDP traffic on the jabber_client port. Domain to not audit. Receive UDP traffic on the jabber_client port. Domain allowed access. Do not audit attempts to receive UDP traffic on the jabber_client port. Domain to not audit. Send and receive UDP traffic on the jabber_client port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the jabber_client port. Domain to not audit. Bind TCP sockets to the jabber_client port. Domain allowed access. Bind UDP sockets to the jabber_client port. Domain allowed access. Make a TCP connection to the jabber_client port. Domain allowed access. Send jabber_client_client packets. Domain allowed access. Do not audit attempts to send jabber_client_client packets. Domain to not audit. Receive jabber_client_client packets. Domain allowed access. Do not audit attempts to receive jabber_client_client packets. Domain allowed access. Send and receive jabber_client_client packets. Domain allowed access. Do not audit attempts to send and receive jabber_client_client packets. Domain to not audit. Relabel packets to jabber_client_client the packet type. Domain allowed access. Send jabber_client_server packets. Domain allowed access. Do not audit attempts to send jabber_client_server packets. Domain to not audit. Receive jabber_client_server packets. Domain allowed access. Do not audit attempts to receive jabber_client_server packets. Domain allowed access. Send and receive jabber_client_server packets. Domain allowed access. Do not audit attempts to send and receive jabber_client_server packets. Domain to not audit. Relabel packets to jabber_client_server the packet type. Domain allowed access. Send and receive TCP traffic on the jabber_interserver port. Domain allowed access. Send UDP traffic on the jabber_interserver port. Domain allowed access. Do not audit attempts to send UDP traffic on the jabber_interserver port. Domain to not audit. Receive UDP traffic on the jabber_interserver port. Domain allowed access. Do not audit attempts to receive UDP traffic on the jabber_interserver port. Domain to not audit. Send and receive UDP traffic on the jabber_interserver port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the jabber_interserver port. Domain to not audit. Bind TCP sockets to the jabber_interserver port. Domain allowed access. Bind UDP sockets to the jabber_interserver port. Domain allowed access. Make a TCP connection to the jabber_interserver port. Domain allowed access. Send jabber_interserver_client packets. Domain allowed access. Do not audit attempts to send jabber_interserver_client packets. Domain to not audit. Receive jabber_interserver_client packets. Domain allowed access. Do not audit attempts to receive jabber_interserver_client packets. Domain allowed access. Send and receive jabber_interserver_client packets. Domain allowed access. Do not audit attempts to send and receive jabber_interserver_client packets. Domain to not audit. Relabel packets to jabber_interserver_client the packet type. Domain allowed access. Send jabber_interserver_server packets. Domain allowed access. Do not audit attempts to send jabber_interserver_server packets. Domain to not audit. Receive jabber_interserver_server packets. Domain allowed access. Do not audit attempts to receive jabber_interserver_server packets. Domain allowed access. Send and receive jabber_interserver_server packets. Domain allowed access. Do not audit attempts to send and receive jabber_interserver_server packets. Domain to not audit. Relabel packets to jabber_interserver_server the packet type. Domain allowed access. Send and receive TCP traffic on the jboss_iiop port. Domain allowed access. Send UDP traffic on the jboss_iiop port. Domain allowed access. Do not audit attempts to send UDP traffic on the jboss_iiop port. Domain to not audit. Receive UDP traffic on the jboss_iiop port. Domain allowed access. Do not audit attempts to receive UDP traffic on the jboss_iiop port. Domain to not audit. Send and receive UDP traffic on the jboss_iiop port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the jboss_iiop port. Domain to not audit. Bind TCP sockets to the jboss_iiop port. Domain allowed access. Bind UDP sockets to the jboss_iiop port. Domain allowed access. Make a TCP connection to the jboss_iiop port. Domain allowed access. Send jboss_iiop_client packets. Domain allowed access. Do not audit attempts to send jboss_iiop_client packets. Domain to not audit. Receive jboss_iiop_client packets. Domain allowed access. Do not audit attempts to receive jboss_iiop_client packets. Domain allowed access. Send and receive jboss_iiop_client packets. Domain allowed access. Do not audit attempts to send and receive jboss_iiop_client packets. Domain to not audit. Relabel packets to jboss_iiop_client the packet type. Domain allowed access. Send jboss_iiop_server packets. Domain allowed access. Do not audit attempts to send jboss_iiop_server packets. Domain to not audit. Receive jboss_iiop_server packets. Domain allowed access. Do not audit attempts to receive jboss_iiop_server packets. Domain allowed access. Send and receive jboss_iiop_server packets. Domain allowed access. Do not audit attempts to send and receive jboss_iiop_server packets. Domain to not audit. Relabel packets to jboss_iiop_server the packet type. Domain allowed access. Send and receive TCP traffic on the kerberos port. Domain allowed access. Send UDP traffic on the kerberos port. Domain allowed access. Do not audit attempts to send UDP traffic on the kerberos port. Domain to not audit. Receive UDP traffic on the kerberos port. Domain allowed access. Do not audit attempts to receive UDP traffic on the kerberos port. Domain to not audit. Send and receive UDP traffic on the kerberos port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the kerberos port. Domain to not audit. Bind TCP sockets to the kerberos port. Domain allowed access. Bind UDP sockets to the kerberos port. Domain allowed access. Make a TCP connection to the kerberos port. Domain allowed access. Send kerberos_client packets. Domain allowed access. Do not audit attempts to send kerberos_client packets. Domain to not audit. Receive kerberos_client packets. Domain allowed access. Do not audit attempts to receive kerberos_client packets. Domain allowed access. Send and receive kerberos_client packets. Domain allowed access. Do not audit attempts to send and receive kerberos_client packets. Domain to not audit. Relabel packets to kerberos_client the packet type. Domain allowed access. Send kerberos_server packets. Domain allowed access. Do not audit attempts to send kerberos_server packets. Domain to not audit. Receive kerberos_server packets. Domain allowed access. Do not audit attempts to receive kerberos_server packets. Domain allowed access. Send and receive kerberos_server packets. Domain allowed access. Do not audit attempts to send and receive kerberos_server packets. Domain to not audit. Relabel packets to kerberos_server the packet type. Domain allowed access. Send and receive TCP traffic on the kerberos_admin port. Domain allowed access. Send UDP traffic on the kerberos_admin port. Domain allowed access. Do not audit attempts to send UDP traffic on the kerberos_admin port. Domain to not audit. Receive UDP traffic on the kerberos_admin port. Domain allowed access. Do not audit attempts to receive UDP traffic on the kerberos_admin port. Domain to not audit. Send and receive UDP traffic on the kerberos_admin port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the kerberos_admin port. Domain to not audit. Bind TCP sockets to the kerberos_admin port. Domain allowed access. Bind UDP sockets to the kerberos_admin port. Domain allowed access. Make a TCP connection to the kerberos_admin port. Domain allowed access. Send kerberos_admin_client packets. Domain allowed access. Do not audit attempts to send kerberos_admin_client packets. Domain to not audit. Receive kerberos_admin_client packets. Domain allowed access. Do not audit attempts to receive kerberos_admin_client packets. Domain allowed access. Send and receive kerberos_admin_client packets. Domain allowed access. Do not audit attempts to send and receive kerberos_admin_client packets. Domain to not audit. Relabel packets to kerberos_admin_client the packet type. Domain allowed access. Send kerberos_admin_server packets. Domain allowed access. Do not audit attempts to send kerberos_admin_server packets. Domain to not audit. Receive kerberos_admin_server packets. Domain allowed access. Do not audit attempts to receive kerberos_admin_server packets. Domain allowed access. Send and receive kerberos_admin_server packets. Domain allowed access. Do not audit attempts to send and receive kerberos_admin_server packets. Domain to not audit. Relabel packets to kerberos_admin_server the packet type. Domain allowed access. Send and receive TCP traffic on the kerberos_master port. Domain allowed access. Send UDP traffic on the kerberos_master port. Domain allowed access. Do not audit attempts to send UDP traffic on the kerberos_master port. Domain to not audit. Receive UDP traffic on the kerberos_master port. Domain allowed access. Do not audit attempts to receive UDP traffic on the kerberos_master port. Domain to not audit. Send and receive UDP traffic on the kerberos_master port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the kerberos_master port. Domain to not audit. Bind TCP sockets to the kerberos_master port. Domain allowed access. Bind UDP sockets to the kerberos_master port. Domain allowed access. Make a TCP connection to the kerberos_master port. Domain allowed access. Send kerberos_master_client packets. Domain allowed access. Do not audit attempts to send kerberos_master_client packets. Domain to not audit. Receive kerberos_master_client packets. Domain allowed access. Do not audit attempts to receive kerberos_master_client packets. Domain allowed access. Send and receive kerberos_master_client packets. Domain allowed access. Do not audit attempts to send and receive kerberos_master_client packets. Domain to not audit. Relabel packets to kerberos_master_client the packet type. Domain allowed access. Send kerberos_master_server packets. Domain allowed access. Do not audit attempts to send kerberos_master_server packets. Domain to not audit. Receive kerberos_master_server packets. Domain allowed access. Do not audit attempts to receive kerberos_master_server packets. Domain allowed access. Send and receive kerberos_master_server packets. Domain allowed access. Do not audit attempts to send and receive kerberos_master_server packets. Domain to not audit. Relabel packets to kerberos_master_server the packet type. Domain allowed access. Send and receive TCP traffic on the kismet port. Domain allowed access. Send UDP traffic on the kismet port. Domain allowed access. Do not audit attempts to send UDP traffic on the kismet port. Domain to not audit. Receive UDP traffic on the kismet port. Domain allowed access. Do not audit attempts to receive UDP traffic on the kismet port. Domain to not audit. Send and receive UDP traffic on the kismet port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the kismet port. Domain to not audit. Bind TCP sockets to the kismet port. Domain allowed access. Bind UDP sockets to the kismet port. Domain allowed access. Make a TCP connection to the kismet port. Domain allowed access. Send kismet_client packets. Domain allowed access. Do not audit attempts to send kismet_client packets. Domain to not audit. Receive kismet_client packets. Domain allowed access. Do not audit attempts to receive kismet_client packets. Domain allowed access. Send and receive kismet_client packets. Domain allowed access. Do not audit attempts to send and receive kismet_client packets. Domain to not audit. Relabel packets to kismet_client the packet type. Domain allowed access. Send kismet_server packets. Domain allowed access. Do not audit attempts to send kismet_server packets. Domain to not audit. Receive kismet_server packets. Domain allowed access. Do not audit attempts to receive kismet_server packets. Domain allowed access. Send and receive kismet_server packets. Domain allowed access. Do not audit attempts to send and receive kismet_server packets. Domain to not audit. Relabel packets to kismet_server the packet type. Domain allowed access. Send and receive TCP traffic on the kprop port. Domain allowed access. Send UDP traffic on the kprop port. Domain allowed access. Do not audit attempts to send UDP traffic on the kprop port. Domain to not audit. Receive UDP traffic on the kprop port. Domain allowed access. Do not audit attempts to receive UDP traffic on the kprop port. Domain to not audit. Send and receive UDP traffic on the kprop port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the kprop port. Domain to not audit. Bind TCP sockets to the kprop port. Domain allowed access. Bind UDP sockets to the kprop port. Domain allowed access. Make a TCP connection to the kprop port. Domain allowed access. Send kprop_client packets. Domain allowed access. Do not audit attempts to send kprop_client packets. Domain to not audit. Receive kprop_client packets. Domain allowed access. Do not audit attempts to receive kprop_client packets. Domain allowed access. Send and receive kprop_client packets. Domain allowed access. Do not audit attempts to send and receive kprop_client packets. Domain to not audit. Relabel packets to kprop_client the packet type. Domain allowed access. Send kprop_server packets. Domain allowed access. Do not audit attempts to send kprop_server packets. Domain to not audit. Receive kprop_server packets. Domain allowed access. Do not audit attempts to receive kprop_server packets. Domain allowed access. Send and receive kprop_server packets. Domain allowed access. Do not audit attempts to send and receive kprop_server packets. Domain to not audit. Relabel packets to kprop_server the packet type. Domain allowed access. Send and receive TCP traffic on the ktalkd port. Domain allowed access. Send UDP traffic on the ktalkd port. Domain allowed access. Do not audit attempts to send UDP traffic on the ktalkd port. Domain to not audit. Receive UDP traffic on the ktalkd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ktalkd port. Domain to not audit. Send and receive UDP traffic on the ktalkd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ktalkd port. Domain to not audit. Bind TCP sockets to the ktalkd port. Domain allowed access. Bind UDP sockets to the ktalkd port. Domain allowed access. Make a TCP connection to the ktalkd port. Domain allowed access. Send ktalkd_client packets. Domain allowed access. Do not audit attempts to send ktalkd_client packets. Domain to not audit. Receive ktalkd_client packets. Domain allowed access. Do not audit attempts to receive ktalkd_client packets. Domain allowed access. Send and receive ktalkd_client packets. Domain allowed access. Do not audit attempts to send and receive ktalkd_client packets. Domain to not audit. Relabel packets to ktalkd_client the packet type. Domain allowed access. Send ktalkd_server packets. Domain allowed access. Do not audit attempts to send ktalkd_server packets. Domain to not audit. Receive ktalkd_server packets. Domain allowed access. Do not audit attempts to receive ktalkd_server packets. Domain allowed access. Send and receive ktalkd_server packets. Domain allowed access. Do not audit attempts to send and receive ktalkd_server packets. Domain to not audit. Relabel packets to ktalkd_server the packet type. Domain allowed access. Send and receive TCP traffic on the l2tp port. Domain allowed access. Send UDP traffic on the l2tp port. Domain allowed access. Do not audit attempts to send UDP traffic on the l2tp port. Domain to not audit. Receive UDP traffic on the l2tp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the l2tp port. Domain to not audit. Send and receive UDP traffic on the l2tp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the l2tp port. Domain to not audit. Bind TCP sockets to the l2tp port. Domain allowed access. Bind UDP sockets to the l2tp port. Domain allowed access. Make a TCP connection to the l2tp port. Domain allowed access. Send l2tp_client packets. Domain allowed access. Do not audit attempts to send l2tp_client packets. Domain to not audit. Receive l2tp_client packets. Domain allowed access. Do not audit attempts to receive l2tp_client packets. Domain allowed access. Send and receive l2tp_client packets. Domain allowed access. Do not audit attempts to send and receive l2tp_client packets. Domain to not audit. Relabel packets to l2tp_client the packet type. Domain allowed access. Send l2tp_server packets. Domain allowed access. Do not audit attempts to send l2tp_server packets. Domain to not audit. Receive l2tp_server packets. Domain allowed access. Do not audit attempts to receive l2tp_server packets. Domain allowed access. Send and receive l2tp_server packets. Domain allowed access. Do not audit attempts to send and receive l2tp_server packets. Domain to not audit. Relabel packets to l2tp_server the packet type. Domain allowed access. Send and receive TCP traffic on the ldap port. Domain allowed access. Send UDP traffic on the ldap port. Domain allowed access. Do not audit attempts to send UDP traffic on the ldap port. Domain to not audit. Receive UDP traffic on the ldap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ldap port. Domain to not audit. Send and receive UDP traffic on the ldap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ldap port. Domain to not audit. Bind TCP sockets to the ldap port. Domain allowed access. Bind UDP sockets to the ldap port. Domain allowed access. Make a TCP connection to the ldap port. Domain allowed access. Send ldap_client packets. Domain allowed access. Do not audit attempts to send ldap_client packets. Domain to not audit. Receive ldap_client packets. Domain allowed access. Do not audit attempts to receive ldap_client packets. Domain allowed access. Send and receive ldap_client packets. Domain allowed access. Do not audit attempts to send and receive ldap_client packets. Domain to not audit. Relabel packets to ldap_client the packet type. Domain allowed access. Send ldap_server packets. Domain allowed access. Do not audit attempts to send ldap_server packets. Domain to not audit. Receive ldap_server packets. Domain allowed access. Do not audit attempts to receive ldap_server packets. Domain allowed access. Send and receive ldap_server packets. Domain allowed access. Do not audit attempts to send and receive ldap_server packets. Domain to not audit. Relabel packets to ldap_server the packet type. Domain allowed access. Send and receive TCP traffic on the lirc port. Domain allowed access. Send UDP traffic on the lirc port. Domain allowed access. Do not audit attempts to send UDP traffic on the lirc port. Domain to not audit. Receive UDP traffic on the lirc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the lirc port. Domain to not audit. Send and receive UDP traffic on the lirc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the lirc port. Domain to not audit. Bind TCP sockets to the lirc port. Domain allowed access. Bind UDP sockets to the lirc port. Domain allowed access. Make a TCP connection to the lirc port. Domain allowed access. Send lirc_client packets. Domain allowed access. Do not audit attempts to send lirc_client packets. Domain to not audit. Receive lirc_client packets. Domain allowed access. Do not audit attempts to receive lirc_client packets. Domain allowed access. Send and receive lirc_client packets. Domain allowed access. Do not audit attempts to send and receive lirc_client packets. Domain to not audit. Relabel packets to lirc_client the packet type. Domain allowed access. Send lirc_server packets. Domain allowed access. Do not audit attempts to send lirc_server packets. Domain to not audit. Receive lirc_server packets. Domain allowed access. Do not audit attempts to receive lirc_server packets. Domain allowed access. Send and receive lirc_server packets. Domain allowed access. Do not audit attempts to send and receive lirc_server packets. Domain to not audit. Relabel packets to lirc_server the packet type. Domain allowed access. Send and receive TCP traffic on the llmnr port. Domain allowed access. Send UDP traffic on the llmnr port. Domain allowed access. Do not audit attempts to send UDP traffic on the llmnr port. Domain to not audit. Receive UDP traffic on the llmnr port. Domain allowed access. Do not audit attempts to receive UDP traffic on the llmnr port. Domain to not audit. Send and receive UDP traffic on the llmnr port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the llmnr port. Domain to not audit. Bind TCP sockets to the llmnr port. Domain allowed access. Bind UDP sockets to the llmnr port. Domain allowed access. Make a TCP connection to the llmnr port. Domain allowed access. Send llmnr_client packets. Domain allowed access. Do not audit attempts to send llmnr_client packets. Domain to not audit. Receive llmnr_client packets. Domain allowed access. Do not audit attempts to receive llmnr_client packets. Domain allowed access. Send and receive llmnr_client packets. Domain allowed access. Do not audit attempts to send and receive llmnr_client packets. Domain to not audit. Relabel packets to llmnr_client the packet type. Domain allowed access. Send llmnr_server packets. Domain allowed access. Do not audit attempts to send llmnr_server packets. Domain to not audit. Receive llmnr_server packets. Domain allowed access. Do not audit attempts to receive llmnr_server packets. Domain allowed access. Send and receive llmnr_server packets. Domain allowed access. Do not audit attempts to send and receive llmnr_server packets. Domain to not audit. Relabel packets to llmnr_server the packet type. Domain allowed access. Send and receive TCP traffic on the lmtp port. Domain allowed access. Send UDP traffic on the lmtp port. Domain allowed access. Do not audit attempts to send UDP traffic on the lmtp port. Domain to not audit. Receive UDP traffic on the lmtp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the lmtp port. Domain to not audit. Send and receive UDP traffic on the lmtp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the lmtp port. Domain to not audit. Bind TCP sockets to the lmtp port. Domain allowed access. Bind UDP sockets to the lmtp port. Domain allowed access. Make a TCP connection to the lmtp port. Domain allowed access. Send lmtp_client packets. Domain allowed access. Do not audit attempts to send lmtp_client packets. Domain to not audit. Receive lmtp_client packets. Domain allowed access. Do not audit attempts to receive lmtp_client packets. Domain allowed access. Send and receive lmtp_client packets. Domain allowed access. Do not audit attempts to send and receive lmtp_client packets. Domain to not audit. Relabel packets to lmtp_client the packet type. Domain allowed access. Send lmtp_server packets. Domain allowed access. Do not audit attempts to send lmtp_server packets. Domain to not audit. Receive lmtp_server packets. Domain allowed access. Do not audit attempts to receive lmtp_server packets. Domain allowed access. Send and receive lmtp_server packets. Domain allowed access. Do not audit attempts to send and receive lmtp_server packets. Domain to not audit. Relabel packets to lmtp_server the packet type. Domain allowed access. Send and receive TCP traffic on the lrrd port. Domain allowed access. Send UDP traffic on the lrrd port. Domain allowed access. Do not audit attempts to send UDP traffic on the lrrd port. Domain to not audit. Receive UDP traffic on the lrrd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the lrrd port. Domain to not audit. Send and receive UDP traffic on the lrrd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the lrrd port. Domain to not audit. Bind TCP sockets to the lrrd port. Domain allowed access. Bind UDP sockets to the lrrd port. Domain allowed access. Make a TCP connection to the lrrd port. Domain allowed access. Send lrrd_client packets. Domain allowed access. Do not audit attempts to send lrrd_client packets. Domain to not audit. Receive lrrd_client packets. Domain allowed access. Do not audit attempts to receive lrrd_client packets. Domain allowed access. Send and receive lrrd_client packets. Domain allowed access. Do not audit attempts to send and receive lrrd_client packets. Domain to not audit. Relabel packets to lrrd_client the packet type. Domain allowed access. Send lrrd_server packets. Domain allowed access. Do not audit attempts to send lrrd_server packets. Domain to not audit. Receive lrrd_server packets. Domain allowed access. Do not audit attempts to receive lrrd_server packets. Domain allowed access. Send and receive lrrd_server packets. Domain allowed access. Do not audit attempts to send and receive lrrd_server packets. Domain to not audit. Relabel packets to lrrd_server the packet type. Domain allowed access. Send and receive TCP traffic on the mail port. Domain allowed access. Send UDP traffic on the mail port. Domain allowed access. Do not audit attempts to send UDP traffic on the mail port. Domain to not audit. Receive UDP traffic on the mail port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mail port. Domain to not audit. Send and receive UDP traffic on the mail port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mail port. Domain to not audit. Bind TCP sockets to the mail port. Domain allowed access. Bind UDP sockets to the mail port. Domain allowed access. Make a TCP connection to the mail port. Domain allowed access. Send mail_client packets. Domain allowed access. Do not audit attempts to send mail_client packets. Domain to not audit. Receive mail_client packets. Domain allowed access. Do not audit attempts to receive mail_client packets. Domain allowed access. Send and receive mail_client packets. Domain allowed access. Do not audit attempts to send and receive mail_client packets. Domain to not audit. Relabel packets to mail_client the packet type. Domain allowed access. Send mail_server packets. Domain allowed access. Do not audit attempts to send mail_server packets. Domain to not audit. Receive mail_server packets. Domain allowed access. Do not audit attempts to receive mail_server packets. Domain allowed access. Send and receive mail_server packets. Domain allowed access. Do not audit attempts to send and receive mail_server packets. Domain to not audit. Relabel packets to mail_server the packet type. Domain allowed access. Send and receive TCP traffic on the matahari port. Domain allowed access. Send UDP traffic on the matahari port. Domain allowed access. Do not audit attempts to send UDP traffic on the matahari port. Domain to not audit. Receive UDP traffic on the matahari port. Domain allowed access. Do not audit attempts to receive UDP traffic on the matahari port. Domain to not audit. Send and receive UDP traffic on the matahari port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the matahari port. Domain to not audit. Bind TCP sockets to the matahari port. Domain allowed access. Bind UDP sockets to the matahari port. Domain allowed access. Make a TCP connection to the matahari port. Domain allowed access. Send matahari_client packets. Domain allowed access. Do not audit attempts to send matahari_client packets. Domain to not audit. Receive matahari_client packets. Domain allowed access. Do not audit attempts to receive matahari_client packets. Domain allowed access. Send and receive matahari_client packets. Domain allowed access. Do not audit attempts to send and receive matahari_client packets. Domain to not audit. Relabel packets to matahari_client the packet type. Domain allowed access. Send matahari_server packets. Domain allowed access. Do not audit attempts to send matahari_server packets. Domain to not audit. Receive matahari_server packets. Domain allowed access. Do not audit attempts to receive matahari_server packets. Domain allowed access. Send and receive matahari_server packets. Domain allowed access. Do not audit attempts to send and receive matahari_server packets. Domain to not audit. Relabel packets to matahari_server the packet type. Domain allowed access. Send and receive TCP traffic on the memcache port. Domain allowed access. Send UDP traffic on the memcache port. Domain allowed access. Do not audit attempts to send UDP traffic on the memcache port. Domain to not audit. Receive UDP traffic on the memcache port. Domain allowed access. Do not audit attempts to receive UDP traffic on the memcache port. Domain to not audit. Send and receive UDP traffic on the memcache port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the memcache port. Domain to not audit. Bind TCP sockets to the memcache port. Domain allowed access. Bind UDP sockets to the memcache port. Domain allowed access. Make a TCP connection to the memcache port. Domain allowed access. Send memcache_client packets. Domain allowed access. Do not audit attempts to send memcache_client packets. Domain to not audit. Receive memcache_client packets. Domain allowed access. Do not audit attempts to receive memcache_client packets. Domain allowed access. Send and receive memcache_client packets. Domain allowed access. Do not audit attempts to send and receive memcache_client packets. Domain to not audit. Relabel packets to memcache_client the packet type. Domain allowed access. Send memcache_server packets. Domain allowed access. Do not audit attempts to send memcache_server packets. Domain to not audit. Receive memcache_server packets. Domain allowed access. Do not audit attempts to receive memcache_server packets. Domain allowed access. Send and receive memcache_server packets. Domain allowed access. Do not audit attempts to send and receive memcache_server packets. Domain to not audit. Relabel packets to memcache_server the packet type. Domain allowed access. Send and receive TCP traffic on the milter port. Domain allowed access. Send UDP traffic on the milter port. Domain allowed access. Do not audit attempts to send UDP traffic on the milter port. Domain to not audit. Receive UDP traffic on the milter port. Domain allowed access. Do not audit attempts to receive UDP traffic on the milter port. Domain to not audit. Send and receive UDP traffic on the milter port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the milter port. Domain to not audit. Bind TCP sockets to the milter port. Domain allowed access. Bind UDP sockets to the milter port. Domain allowed access. Make a TCP connection to the milter port. Domain allowed access. Send milter_client packets. Domain allowed access. Do not audit attempts to send milter_client packets. Domain to not audit. Receive milter_client packets. Domain allowed access. Do not audit attempts to receive milter_client packets. Domain allowed access. Send and receive milter_client packets. Domain allowed access. Do not audit attempts to send and receive milter_client packets. Domain to not audit. Relabel packets to milter_client the packet type. Domain allowed access. Send milter_server packets. Domain allowed access. Do not audit attempts to send milter_server packets. Domain to not audit. Receive milter_server packets. Domain allowed access. Do not audit attempts to receive milter_server packets. Domain allowed access. Send and receive milter_server packets. Domain allowed access. Do not audit attempts to send and receive milter_server packets. Domain to not audit. Relabel packets to milter_server the packet type. Domain allowed access. Send and receive TCP traffic on the mmcc port. Domain allowed access. Send UDP traffic on the mmcc port. Domain allowed access. Do not audit attempts to send UDP traffic on the mmcc port. Domain to not audit. Receive UDP traffic on the mmcc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mmcc port. Domain to not audit. Send and receive UDP traffic on the mmcc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mmcc port. Domain to not audit. Bind TCP sockets to the mmcc port. Domain allowed access. Bind UDP sockets to the mmcc port. Domain allowed access. Make a TCP connection to the mmcc port. Domain allowed access. Send mmcc_client packets. Domain allowed access. Do not audit attempts to send mmcc_client packets. Domain to not audit. Receive mmcc_client packets. Domain allowed access. Do not audit attempts to receive mmcc_client packets. Domain allowed access. Send and receive mmcc_client packets. Domain allowed access. Do not audit attempts to send and receive mmcc_client packets. Domain to not audit. Relabel packets to mmcc_client the packet type. Domain allowed access. Send mmcc_server packets. Domain allowed access. Do not audit attempts to send mmcc_server packets. Domain to not audit. Receive mmcc_server packets. Domain allowed access. Do not audit attempts to receive mmcc_server packets. Domain allowed access. Send and receive mmcc_server packets. Domain allowed access. Do not audit attempts to send and receive mmcc_server packets. Domain to not audit. Relabel packets to mmcc_server the packet type. Domain allowed access. Send and receive TCP traffic on the monopd port. Domain allowed access. Send UDP traffic on the monopd port. Domain allowed access. Do not audit attempts to send UDP traffic on the monopd port. Domain to not audit. Receive UDP traffic on the monopd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the monopd port. Domain to not audit. Send and receive UDP traffic on the monopd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the monopd port. Domain to not audit. Bind TCP sockets to the monopd port. Domain allowed access. Bind UDP sockets to the monopd port. Domain allowed access. Make a TCP connection to the monopd port. Domain allowed access. Send monopd_client packets. Domain allowed access. Do not audit attempts to send monopd_client packets. Domain to not audit. Receive monopd_client packets. Domain allowed access. Do not audit attempts to receive monopd_client packets. Domain allowed access. Send and receive monopd_client packets. Domain allowed access. Do not audit attempts to send and receive monopd_client packets. Domain to not audit. Relabel packets to monopd_client the packet type. Domain allowed access. Send monopd_server packets. Domain allowed access. Do not audit attempts to send monopd_server packets. Domain to not audit. Receive monopd_server packets. Domain allowed access. Do not audit attempts to receive monopd_server packets. Domain allowed access. Send and receive monopd_server packets. Domain allowed access. Do not audit attempts to send and receive monopd_server packets. Domain to not audit. Relabel packets to monopd_server the packet type. Domain allowed access. Send and receive TCP traffic on the mountd port. Domain allowed access. Send UDP traffic on the mountd port. Domain allowed access. Do not audit attempts to send UDP traffic on the mountd port. Domain to not audit. Receive UDP traffic on the mountd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mountd port. Domain to not audit. Send and receive UDP traffic on the mountd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mountd port. Domain to not audit. Bind TCP sockets to the mountd port. Domain allowed access. Bind UDP sockets to the mountd port. Domain allowed access. Make a TCP connection to the mountd port. Domain allowed access. Send mountd_client packets. Domain allowed access. Do not audit attempts to send mountd_client packets. Domain to not audit. Receive mountd_client packets. Domain allowed access. Do not audit attempts to receive mountd_client packets. Domain allowed access. Send and receive mountd_client packets. Domain allowed access. Do not audit attempts to send and receive mountd_client packets. Domain to not audit. Relabel packets to mountd_client the packet type. Domain allowed access. Send mountd_server packets. Domain allowed access. Do not audit attempts to send mountd_server packets. Domain to not audit. Receive mountd_server packets. Domain allowed access. Do not audit attempts to receive mountd_server packets. Domain allowed access. Send and receive mountd_server packets. Domain allowed access. Do not audit attempts to send and receive mountd_server packets. Domain to not audit. Relabel packets to mountd_server the packet type. Domain allowed access. Send and receive TCP traffic on the movaz_ssc port. Domain allowed access. Send UDP traffic on the movaz_ssc port. Domain allowed access. Do not audit attempts to send UDP traffic on the movaz_ssc port. Domain to not audit. Receive UDP traffic on the movaz_ssc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the movaz_ssc port. Domain to not audit. Send and receive UDP traffic on the movaz_ssc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the movaz_ssc port. Domain to not audit. Bind TCP sockets to the movaz_ssc port. Domain allowed access. Bind UDP sockets to the movaz_ssc port. Domain allowed access. Make a TCP connection to the movaz_ssc port. Domain allowed access. Send movaz_ssc_client packets. Domain allowed access. Do not audit attempts to send movaz_ssc_client packets. Domain to not audit. Receive movaz_ssc_client packets. Domain allowed access. Do not audit attempts to receive movaz_ssc_client packets. Domain allowed access. Send and receive movaz_ssc_client packets. Domain allowed access. Do not audit attempts to send and receive movaz_ssc_client packets. Domain to not audit. Relabel packets to movaz_ssc_client the packet type. Domain allowed access. Send movaz_ssc_server packets. Domain allowed access. Do not audit attempts to send movaz_ssc_server packets. Domain to not audit. Receive movaz_ssc_server packets. Domain allowed access. Do not audit attempts to receive movaz_ssc_server packets. Domain allowed access. Send and receive movaz_ssc_server packets. Domain allowed access. Do not audit attempts to send and receive movaz_ssc_server packets. Domain to not audit. Relabel packets to movaz_ssc_server the packet type. Domain allowed access. Send and receive TCP traffic on the mpd port. Domain allowed access. Send UDP traffic on the mpd port. Domain allowed access. Do not audit attempts to send UDP traffic on the mpd port. Domain to not audit. Receive UDP traffic on the mpd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mpd port. Domain to not audit. Send and receive UDP traffic on the mpd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mpd port. Domain to not audit. Bind TCP sockets to the mpd port. Domain allowed access. Bind UDP sockets to the mpd port. Domain allowed access. Make a TCP connection to the mpd port. Domain allowed access. Send mpd_client packets. Domain allowed access. Do not audit attempts to send mpd_client packets. Domain to not audit. Receive mpd_client packets. Domain allowed access. Do not audit attempts to receive mpd_client packets. Domain allowed access. Send and receive mpd_client packets. Domain allowed access. Do not audit attempts to send and receive mpd_client packets. Domain to not audit. Relabel packets to mpd_client the packet type. Domain allowed access. Send mpd_server packets. Domain allowed access. Do not audit attempts to send mpd_server packets. Domain to not audit. Receive mpd_server packets. Domain allowed access. Do not audit attempts to receive mpd_server packets. Domain allowed access. Send and receive mpd_server packets. Domain allowed access. Do not audit attempts to send and receive mpd_server packets. Domain to not audit. Relabel packets to mpd_server the packet type. Domain allowed access. Send and receive TCP traffic on the msgsrvr port. Domain allowed access. Send UDP traffic on the msgsrvr port. Domain allowed access. Do not audit attempts to send UDP traffic on the msgsrvr port. Domain to not audit. Receive UDP traffic on the msgsrvr port. Domain allowed access. Do not audit attempts to receive UDP traffic on the msgsrvr port. Domain to not audit. Send and receive UDP traffic on the msgsrvr port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the msgsrvr port. Domain to not audit. Bind TCP sockets to the msgsrvr port. Domain allowed access. Bind UDP sockets to the msgsrvr port. Domain allowed access. Make a TCP connection to the msgsrvr port. Domain allowed access. Send msgsrvr_client packets. Domain allowed access. Do not audit attempts to send msgsrvr_client packets. Domain to not audit. Receive msgsrvr_client packets. Domain allowed access. Do not audit attempts to receive msgsrvr_client packets. Domain allowed access. Send and receive msgsrvr_client packets. Domain allowed access. Do not audit attempts to send and receive msgsrvr_client packets. Domain to not audit. Relabel packets to msgsrvr_client the packet type. Domain allowed access. Send msgsrvr_server packets. Domain allowed access. Do not audit attempts to send msgsrvr_server packets. Domain to not audit. Receive msgsrvr_server packets. Domain allowed access. Do not audit attempts to receive msgsrvr_server packets. Domain allowed access. Send and receive msgsrvr_server packets. Domain allowed access. Do not audit attempts to send and receive msgsrvr_server packets. Domain to not audit. Relabel packets to msgsrvr_server the packet type. Domain allowed access. Send and receive TCP traffic on the msnp port. Domain allowed access. Send UDP traffic on the msnp port. Domain allowed access. Do not audit attempts to send UDP traffic on the msnp port. Domain to not audit. Receive UDP traffic on the msnp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the msnp port. Domain to not audit. Send and receive UDP traffic on the msnp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the msnp port. Domain to not audit. Bind TCP sockets to the msnp port. Domain allowed access. Bind UDP sockets to the msnp port. Domain allowed access. Make a TCP connection to the msnp port. Domain allowed access. Send msnp_client packets. Domain allowed access. Do not audit attempts to send msnp_client packets. Domain to not audit. Receive msnp_client packets. Domain allowed access. Do not audit attempts to receive msnp_client packets. Domain allowed access. Send and receive msnp_client packets. Domain allowed access. Do not audit attempts to send and receive msnp_client packets. Domain to not audit. Relabel packets to msnp_client the packet type. Domain allowed access. Send msnp_server packets. Domain allowed access. Do not audit attempts to send msnp_server packets. Domain to not audit. Receive msnp_server packets. Domain allowed access. Do not audit attempts to receive msnp_server packets. Domain allowed access. Send and receive msnp_server packets. Domain allowed access. Do not audit attempts to send and receive msnp_server packets. Domain to not audit. Relabel packets to msnp_server the packet type. Domain allowed access. Send and receive TCP traffic on the mssql port. Domain allowed access. Send UDP traffic on the mssql port. Domain allowed access. Do not audit attempts to send UDP traffic on the mssql port. Domain to not audit. Receive UDP traffic on the mssql port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mssql port. Domain to not audit. Send and receive UDP traffic on the mssql port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mssql port. Domain to not audit. Bind TCP sockets to the mssql port. Domain allowed access. Bind UDP sockets to the mssql port. Domain allowed access. Make a TCP connection to the mssql port. Domain allowed access. Send mssql_client packets. Domain allowed access. Do not audit attempts to send mssql_client packets. Domain to not audit. Receive mssql_client packets. Domain allowed access. Do not audit attempts to receive mssql_client packets. Domain allowed access. Send and receive mssql_client packets. Domain allowed access. Do not audit attempts to send and receive mssql_client packets. Domain to not audit. Relabel packets to mssql_client the packet type. Domain allowed access. Send mssql_server packets. Domain allowed access. Do not audit attempts to send mssql_server packets. Domain to not audit. Receive mssql_server packets. Domain allowed access. Do not audit attempts to receive mssql_server packets. Domain allowed access. Send and receive mssql_server packets. Domain allowed access. Do not audit attempts to send and receive mssql_server packets. Domain to not audit. Relabel packets to mssql_server the packet type. Domain allowed access. Send and receive TCP traffic on the ms_streaming port. Domain allowed access. Send UDP traffic on the ms_streaming port. Domain allowed access. Do not audit attempts to send UDP traffic on the ms_streaming port. Domain to not audit. Receive UDP traffic on the ms_streaming port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ms_streaming port. Domain to not audit. Send and receive UDP traffic on the ms_streaming port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ms_streaming port. Domain to not audit. Bind TCP sockets to the ms_streaming port. Domain allowed access. Bind UDP sockets to the ms_streaming port. Domain allowed access. Make a TCP connection to the ms_streaming port. Domain allowed access. Send ms_streaming_client packets. Domain allowed access. Do not audit attempts to send ms_streaming_client packets. Domain to not audit. Receive ms_streaming_client packets. Domain allowed access. Do not audit attempts to receive ms_streaming_client packets. Domain allowed access. Send and receive ms_streaming_client packets. Domain allowed access. Do not audit attempts to send and receive ms_streaming_client packets. Domain to not audit. Relabel packets to ms_streaming_client the packet type. Domain allowed access. Send ms_streaming_server packets. Domain allowed access. Do not audit attempts to send ms_streaming_server packets. Domain to not audit. Receive ms_streaming_server packets. Domain allowed access. Do not audit attempts to receive ms_streaming_server packets. Domain allowed access. Send and receive ms_streaming_server packets. Domain allowed access. Do not audit attempts to send and receive ms_streaming_server packets. Domain to not audit. Relabel packets to ms_streaming_server the packet type. Domain allowed access. Send and receive TCP traffic on the munin port. Domain allowed access. Send UDP traffic on the munin port. Domain allowed access. Do not audit attempts to send UDP traffic on the munin port. Domain to not audit. Receive UDP traffic on the munin port. Domain allowed access. Do not audit attempts to receive UDP traffic on the munin port. Domain to not audit. Send and receive UDP traffic on the munin port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the munin port. Domain to not audit. Bind TCP sockets to the munin port. Domain allowed access. Bind UDP sockets to the munin port. Domain allowed access. Make a TCP connection to the munin port. Domain allowed access. Send munin_client packets. Domain allowed access. Do not audit attempts to send munin_client packets. Domain to not audit. Receive munin_client packets. Domain allowed access. Do not audit attempts to receive munin_client packets. Domain allowed access. Send and receive munin_client packets. Domain allowed access. Do not audit attempts to send and receive munin_client packets. Domain to not audit. Relabel packets to munin_client the packet type. Domain allowed access. Send munin_server packets. Domain allowed access. Do not audit attempts to send munin_server packets. Domain to not audit. Receive munin_server packets. Domain allowed access. Do not audit attempts to receive munin_server packets. Domain allowed access. Send and receive munin_server packets. Domain allowed access. Do not audit attempts to send and receive munin_server packets. Domain to not audit. Relabel packets to munin_server the packet type. Domain allowed access. Send and receive TCP traffic on the mxi port. Domain allowed access. Send UDP traffic on the mxi port. Domain allowed access. Do not audit attempts to send UDP traffic on the mxi port. Domain to not audit. Receive UDP traffic on the mxi port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mxi port. Domain to not audit. Send and receive UDP traffic on the mxi port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mxi port. Domain to not audit. Bind TCP sockets to the mxi port. Domain allowed access. Bind UDP sockets to the mxi port. Domain allowed access. Make a TCP connection to the mxi port. Domain allowed access. Send mxi_client packets. Domain allowed access. Do not audit attempts to send mxi_client packets. Domain to not audit. Receive mxi_client packets. Domain allowed access. Do not audit attempts to receive mxi_client packets. Domain allowed access. Send and receive mxi_client packets. Domain allowed access. Do not audit attempts to send and receive mxi_client packets. Domain to not audit. Relabel packets to mxi_client the packet type. Domain allowed access. Send mxi_server packets. Domain allowed access. Do not audit attempts to send mxi_server packets. Domain to not audit. Receive mxi_server packets. Domain allowed access. Do not audit attempts to receive mxi_server packets. Domain allowed access. Send and receive mxi_server packets. Domain allowed access. Do not audit attempts to send and receive mxi_server packets. Domain to not audit. Relabel packets to mxi_server the packet type. Domain allowed access. Send and receive TCP traffic on the mysqld port. Domain allowed access. Send UDP traffic on the mysqld port. Domain allowed access. Do not audit attempts to send UDP traffic on the mysqld port. Domain to not audit. Receive UDP traffic on the mysqld port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mysqld port. Domain to not audit. Send and receive UDP traffic on the mysqld port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mysqld port. Domain to not audit. Bind TCP sockets to the mysqld port. Domain allowed access. Bind UDP sockets to the mysqld port. Domain allowed access. Make a TCP connection to the mysqld port. Domain allowed access. Send mysqld_client packets. Domain allowed access. Do not audit attempts to send mysqld_client packets. Domain to not audit. Receive mysqld_client packets. Domain allowed access. Do not audit attempts to receive mysqld_client packets. Domain allowed access. Send and receive mysqld_client packets. Domain allowed access. Do not audit attempts to send and receive mysqld_client packets. Domain to not audit. Relabel packets to mysqld_client the packet type. Domain allowed access. Send mysqld_server packets. Domain allowed access. Do not audit attempts to send mysqld_server packets. Domain to not audit. Receive mysqld_server packets. Domain allowed access. Do not audit attempts to receive mysqld_server packets. Domain allowed access. Send and receive mysqld_server packets. Domain allowed access. Do not audit attempts to send and receive mysqld_server packets. Domain to not audit. Relabel packets to mysqld_server the packet type. Domain allowed access. Send and receive TCP traffic on the mysqlmanagerd port. Domain allowed access. Send UDP traffic on the mysqlmanagerd port. Domain allowed access. Do not audit attempts to send UDP traffic on the mysqlmanagerd port. Domain to not audit. Receive UDP traffic on the mysqlmanagerd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the mysqlmanagerd port. Domain to not audit. Send and receive UDP traffic on the mysqlmanagerd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the mysqlmanagerd port. Domain to not audit. Bind TCP sockets to the mysqlmanagerd port. Domain allowed access. Bind UDP sockets to the mysqlmanagerd port. Domain allowed access. Make a TCP connection to the mysqlmanagerd port. Domain allowed access. Send mysqlmanagerd_client packets. Domain allowed access. Do not audit attempts to send mysqlmanagerd_client packets. Domain to not audit. Receive mysqlmanagerd_client packets. Domain allowed access. Do not audit attempts to receive mysqlmanagerd_client packets. Domain allowed access. Send and receive mysqlmanagerd_client packets. Domain allowed access. Do not audit attempts to send and receive mysqlmanagerd_client packets. Domain to not audit. Relabel packets to mysqlmanagerd_client the packet type. Domain allowed access. Send mysqlmanagerd_server packets. Domain allowed access. Do not audit attempts to send mysqlmanagerd_server packets. Domain to not audit. Receive mysqlmanagerd_server packets. Domain allowed access. Do not audit attempts to receive mysqlmanagerd_server packets. Domain allowed access. Send and receive mysqlmanagerd_server packets. Domain allowed access. Do not audit attempts to send and receive mysqlmanagerd_server packets. Domain to not audit. Relabel packets to mysqlmanagerd_server the packet type. Domain allowed access. Send and receive TCP traffic on the nessus port. Domain allowed access. Send UDP traffic on the nessus port. Domain allowed access. Do not audit attempts to send UDP traffic on the nessus port. Domain to not audit. Receive UDP traffic on the nessus port. Domain allowed access. Do not audit attempts to receive UDP traffic on the nessus port. Domain to not audit. Send and receive UDP traffic on the nessus port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the nessus port. Domain to not audit. Bind TCP sockets to the nessus port. Domain allowed access. Bind UDP sockets to the nessus port. Domain allowed access. Make a TCP connection to the nessus port. Domain allowed access. Send nessus_client packets. Domain allowed access. Do not audit attempts to send nessus_client packets. Domain to not audit. Receive nessus_client packets. Domain allowed access. Do not audit attempts to receive nessus_client packets. Domain allowed access. Send and receive nessus_client packets. Domain allowed access. Do not audit attempts to send and receive nessus_client packets. Domain to not audit. Relabel packets to nessus_client the packet type. Domain allowed access. Send nessus_server packets. Domain allowed access. Do not audit attempts to send nessus_server packets. Domain to not audit. Receive nessus_server packets. Domain allowed access. Do not audit attempts to receive nessus_server packets. Domain allowed access. Send and receive nessus_server packets. Domain allowed access. Do not audit attempts to send and receive nessus_server packets. Domain to not audit. Relabel packets to nessus_server the packet type. Domain allowed access. Send and receive TCP traffic on the netport port. Domain allowed access. Send UDP traffic on the netport port. Domain allowed access. Do not audit attempts to send UDP traffic on the netport port. Domain to not audit. Receive UDP traffic on the netport port. Domain allowed access. Do not audit attempts to receive UDP traffic on the netport port. Domain to not audit. Send and receive UDP traffic on the netport port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the netport port. Domain to not audit. Bind TCP sockets to the netport port. Domain allowed access. Bind UDP sockets to the netport port. Domain allowed access. Make a TCP connection to the netport port. Domain allowed access. Send netport_client packets. Domain allowed access. Do not audit attempts to send netport_client packets. Domain to not audit. Receive netport_client packets. Domain allowed access. Do not audit attempts to receive netport_client packets. Domain allowed access. Send and receive netport_client packets. Domain allowed access. Do not audit attempts to send and receive netport_client packets. Domain to not audit. Relabel packets to netport_client the packet type. Domain allowed access. Send netport_server packets. Domain allowed access. Do not audit attempts to send netport_server packets. Domain to not audit. Receive netport_server packets. Domain allowed access. Do not audit attempts to receive netport_server packets. Domain allowed access. Send and receive netport_server packets. Domain allowed access. Do not audit attempts to send and receive netport_server packets. Domain to not audit. Relabel packets to netport_server the packet type. Domain allowed access. Send and receive TCP traffic on the netsupport port. Domain allowed access. Send UDP traffic on the netsupport port. Domain allowed access. Do not audit attempts to send UDP traffic on the netsupport port. Domain to not audit. Receive UDP traffic on the netsupport port. Domain allowed access. Do not audit attempts to receive UDP traffic on the netsupport port. Domain to not audit. Send and receive UDP traffic on the netsupport port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the netsupport port. Domain to not audit. Bind TCP sockets to the netsupport port. Domain allowed access. Bind UDP sockets to the netsupport port. Domain allowed access. Make a TCP connection to the netsupport port. Domain allowed access. Send netsupport_client packets. Domain allowed access. Do not audit attempts to send netsupport_client packets. Domain to not audit. Receive netsupport_client packets. Domain allowed access. Do not audit attempts to receive netsupport_client packets. Domain allowed access. Send and receive netsupport_client packets. Domain allowed access. Do not audit attempts to send and receive netsupport_client packets. Domain to not audit. Relabel packets to netsupport_client the packet type. Domain allowed access. Send netsupport_server packets. Domain allowed access. Do not audit attempts to send netsupport_server packets. Domain to not audit. Receive netsupport_server packets. Domain allowed access. Do not audit attempts to receive netsupport_server packets. Domain allowed access. Send and receive netsupport_server packets. Domain allowed access. Do not audit attempts to send and receive netsupport_server packets. Domain to not audit. Relabel packets to netsupport_server the packet type. Domain allowed access. Send and receive TCP traffic on the nfs port. Domain allowed access. Send UDP traffic on the nfs port. Domain allowed access. Do not audit attempts to send UDP traffic on the nfs port. Domain to not audit. Receive UDP traffic on the nfs port. Domain allowed access. Do not audit attempts to receive UDP traffic on the nfs port. Domain to not audit. Send and receive UDP traffic on the nfs port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the nfs port. Domain to not audit. Bind TCP sockets to the nfs port. Domain allowed access. Bind UDP sockets to the nfs port. Domain allowed access. Make a TCP connection to the nfs port. Domain allowed access. Send nfs_client packets. Domain allowed access. Do not audit attempts to send nfs_client packets. Domain to not audit. Receive nfs_client packets. Domain allowed access. Do not audit attempts to receive nfs_client packets. Domain allowed access. Send and receive nfs_client packets. Domain allowed access. Do not audit attempts to send and receive nfs_client packets. Domain to not audit. Relabel packets to nfs_client the packet type. Domain allowed access. Send nfs_server packets. Domain allowed access. Do not audit attempts to send nfs_server packets. Domain to not audit. Receive nfs_server packets. Domain allowed access. Do not audit attempts to receive nfs_server packets. Domain allowed access. Send and receive nfs_server packets. Domain allowed access. Do not audit attempts to send and receive nfs_server packets. Domain to not audit. Relabel packets to nfs_server the packet type. Domain allowed access. Send and receive TCP traffic on the nfsrdma port. Domain allowed access. Send UDP traffic on the nfsrdma port. Domain allowed access. Do not audit attempts to send UDP traffic on the nfsrdma port. Domain to not audit. Receive UDP traffic on the nfsrdma port. Domain allowed access. Do not audit attempts to receive UDP traffic on the nfsrdma port. Domain to not audit. Send and receive UDP traffic on the nfsrdma port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the nfsrdma port. Domain to not audit. Bind TCP sockets to the nfsrdma port. Domain allowed access. Bind UDP sockets to the nfsrdma port. Domain allowed access. Make a TCP connection to the nfsrdma port. Domain allowed access. Send nfsrdma_client packets. Domain allowed access. Do not audit attempts to send nfsrdma_client packets. Domain to not audit. Receive nfsrdma_client packets. Domain allowed access. Do not audit attempts to receive nfsrdma_client packets. Domain allowed access. Send and receive nfsrdma_client packets. Domain allowed access. Do not audit attempts to send and receive nfsrdma_client packets. Domain to not audit. Relabel packets to nfsrdma_client the packet type. Domain allowed access. Send nfsrdma_server packets. Domain allowed access. Do not audit attempts to send nfsrdma_server packets. Domain to not audit. Receive nfsrdma_server packets. Domain allowed access. Do not audit attempts to receive nfsrdma_server packets. Domain allowed access. Send and receive nfsrdma_server packets. Domain allowed access. Do not audit attempts to send and receive nfsrdma_server packets. Domain to not audit. Relabel packets to nfsrdma_server the packet type. Domain allowed access. Send and receive TCP traffic on the nmbd port. Domain allowed access. Send UDP traffic on the nmbd port. Domain allowed access. Do not audit attempts to send UDP traffic on the nmbd port. Domain to not audit. Receive UDP traffic on the nmbd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the nmbd port. Domain to not audit. Send and receive UDP traffic on the nmbd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the nmbd port. Domain to not audit. Bind TCP sockets to the nmbd port. Domain allowed access. Bind UDP sockets to the nmbd port. Domain allowed access. Make a TCP connection to the nmbd port. Domain allowed access. Send nmbd_client packets. Domain allowed access. Do not audit attempts to send nmbd_client packets. Domain to not audit. Receive nmbd_client packets. Domain allowed access. Do not audit attempts to receive nmbd_client packets. Domain allowed access. Send and receive nmbd_client packets. Domain allowed access. Do not audit attempts to send and receive nmbd_client packets. Domain to not audit. Relabel packets to nmbd_client the packet type. Domain allowed access. Send nmbd_server packets. Domain allowed access. Do not audit attempts to send nmbd_server packets. Domain to not audit. Receive nmbd_server packets. Domain allowed access. Do not audit attempts to receive nmbd_server packets. Domain allowed access. Send and receive nmbd_server packets. Domain allowed access. Do not audit attempts to send and receive nmbd_server packets. Domain to not audit. Relabel packets to nmbd_server the packet type. Domain allowed access. Send and receive TCP traffic on the ntop port. Domain allowed access. Send UDP traffic on the ntop port. Domain allowed access. Do not audit attempts to send UDP traffic on the ntop port. Domain to not audit. Receive UDP traffic on the ntop port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ntop port. Domain to not audit. Send and receive UDP traffic on the ntop port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ntop port. Domain to not audit. Bind TCP sockets to the ntop port. Domain allowed access. Bind UDP sockets to the ntop port. Domain allowed access. Make a TCP connection to the ntop port. Domain allowed access. Send ntop_client packets. Domain allowed access. Do not audit attempts to send ntop_client packets. Domain to not audit. Receive ntop_client packets. Domain allowed access. Do not audit attempts to receive ntop_client packets. Domain allowed access. Send and receive ntop_client packets. Domain allowed access. Do not audit attempts to send and receive ntop_client packets. Domain to not audit. Relabel packets to ntop_client the packet type. Domain allowed access. Send ntop_server packets. Domain allowed access. Do not audit attempts to send ntop_server packets. Domain to not audit. Receive ntop_server packets. Domain allowed access. Do not audit attempts to receive ntop_server packets. Domain allowed access. Send and receive ntop_server packets. Domain allowed access. Do not audit attempts to send and receive ntop_server packets. Domain to not audit. Relabel packets to ntop_server the packet type. Domain allowed access. Send and receive TCP traffic on the ntp port. Domain allowed access. Send UDP traffic on the ntp port. Domain allowed access. Do not audit attempts to send UDP traffic on the ntp port. Domain to not audit. Receive UDP traffic on the ntp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ntp port. Domain to not audit. Send and receive UDP traffic on the ntp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ntp port. Domain to not audit. Bind TCP sockets to the ntp port. Domain allowed access. Bind UDP sockets to the ntp port. Domain allowed access. Make a TCP connection to the ntp port. Domain allowed access. Send ntp_client packets. Domain allowed access. Do not audit attempts to send ntp_client packets. Domain to not audit. Receive ntp_client packets. Domain allowed access. Do not audit attempts to receive ntp_client packets. Domain allowed access. Send and receive ntp_client packets. Domain allowed access. Do not audit attempts to send and receive ntp_client packets. Domain to not audit. Relabel packets to ntp_client the packet type. Domain allowed access. Send ntp_server packets. Domain allowed access. Do not audit attempts to send ntp_server packets. Domain to not audit. Receive ntp_server packets. Domain allowed access. Do not audit attempts to receive ntp_server packets. Domain allowed access. Send and receive ntp_server packets. Domain allowed access. Do not audit attempts to send and receive ntp_server packets. Domain to not audit. Relabel packets to ntp_server the packet type. Domain allowed access. Send and receive TCP traffic on the oa_system port. Domain allowed access. Send UDP traffic on the oa_system port. Domain allowed access. Do not audit attempts to send UDP traffic on the oa_system port. Domain to not audit. Receive UDP traffic on the oa_system port. Domain allowed access. Do not audit attempts to receive UDP traffic on the oa_system port. Domain to not audit. Send and receive UDP traffic on the oa_system port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the oa_system port. Domain to not audit. Bind TCP sockets to the oa_system port. Domain allowed access. Bind UDP sockets to the oa_system port. Domain allowed access. Make a TCP connection to the oa_system port. Domain allowed access. Send oa_system_client packets. Domain allowed access. Do not audit attempts to send oa_system_client packets. Domain to not audit. Receive oa_system_client packets. Domain allowed access. Do not audit attempts to receive oa_system_client packets. Domain allowed access. Send and receive oa_system_client packets. Domain allowed access. Do not audit attempts to send and receive oa_system_client packets. Domain to not audit. Relabel packets to oa_system_client the packet type. Domain allowed access. Send oa_system_server packets. Domain allowed access. Do not audit attempts to send oa_system_server packets. Domain to not audit. Receive oa_system_server packets. Domain allowed access. Do not audit attempts to receive oa_system_server packets. Domain allowed access. Send and receive oa_system_server packets. Domain allowed access. Do not audit attempts to send and receive oa_system_server packets. Domain to not audit. Relabel packets to oa_system_server the packet type. Domain allowed access. Send and receive TCP traffic on the oracledb port. Domain allowed access. Send UDP traffic on the oracledb port. Domain allowed access. Do not audit attempts to send UDP traffic on the oracledb port. Domain to not audit. Receive UDP traffic on the oracledb port. Domain allowed access. Do not audit attempts to receive UDP traffic on the oracledb port. Domain to not audit. Send and receive UDP traffic on the oracledb port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the oracledb port. Domain to not audit. Bind TCP sockets to the oracledb port. Domain allowed access. Bind UDP sockets to the oracledb port. Domain allowed access. Make a TCP connection to the oracledb port. Domain allowed access. Send oracledb_client packets. Domain allowed access. Do not audit attempts to send oracledb_client packets. Domain to not audit. Receive oracledb_client packets. Domain allowed access. Do not audit attempts to receive oracledb_client packets. Domain allowed access. Send and receive oracledb_client packets. Domain allowed access. Do not audit attempts to send and receive oracledb_client packets. Domain to not audit. Relabel packets to oracledb_client the packet type. Domain allowed access. Send oracledb_server packets. Domain allowed access. Do not audit attempts to send oracledb_server packets. Domain to not audit. Receive oracledb_server packets. Domain allowed access. Do not audit attempts to receive oracledb_server packets. Domain allowed access. Send and receive oracledb_server packets. Domain allowed access. Do not audit attempts to send and receive oracledb_server packets. Domain to not audit. Relabel packets to oracledb_server the packet type. Domain allowed access. Send and receive TCP traffic on the ocsp port. Domain allowed access. Send UDP traffic on the ocsp port. Domain allowed access. Do not audit attempts to send UDP traffic on the ocsp port. Domain to not audit. Receive UDP traffic on the ocsp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ocsp port. Domain to not audit. Send and receive UDP traffic on the ocsp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ocsp port. Domain to not audit. Bind TCP sockets to the ocsp port. Domain allowed access. Bind UDP sockets to the ocsp port. Domain allowed access. Make a TCP connection to the ocsp port. Domain allowed access. Send ocsp_client packets. Domain allowed access. Do not audit attempts to send ocsp_client packets. Domain to not audit. Receive ocsp_client packets. Domain allowed access. Do not audit attempts to receive ocsp_client packets. Domain allowed access. Send and receive ocsp_client packets. Domain allowed access. Do not audit attempts to send and receive ocsp_client packets. Domain to not audit. Relabel packets to ocsp_client the packet type. Domain allowed access. Send ocsp_server packets. Domain allowed access. Do not audit attempts to send ocsp_server packets. Domain to not audit. Receive ocsp_server packets. Domain allowed access. Do not audit attempts to receive ocsp_server packets. Domain allowed access. Send and receive ocsp_server packets. Domain allowed access. Do not audit attempts to send and receive ocsp_server packets. Domain to not audit. Relabel packets to ocsp_server the packet type. Domain allowed access. Send and receive TCP traffic on the openhpid port. Domain allowed access. Send UDP traffic on the openhpid port. Domain allowed access. Do not audit attempts to send UDP traffic on the openhpid port. Domain to not audit. Receive UDP traffic on the openhpid port. Domain allowed access. Do not audit attempts to receive UDP traffic on the openhpid port. Domain to not audit. Send and receive UDP traffic on the openhpid port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the openhpid port. Domain to not audit. Bind TCP sockets to the openhpid port. Domain allowed access. Bind UDP sockets to the openhpid port. Domain allowed access. Make a TCP connection to the openhpid port. Domain allowed access. Send openhpid_client packets. Domain allowed access. Do not audit attempts to send openhpid_client packets. Domain to not audit. Receive openhpid_client packets. Domain allowed access. Do not audit attempts to receive openhpid_client packets. Domain allowed access. Send and receive openhpid_client packets. Domain allowed access. Do not audit attempts to send and receive openhpid_client packets. Domain to not audit. Relabel packets to openhpid_client the packet type. Domain allowed access. Send openhpid_server packets. Domain allowed access. Do not audit attempts to send openhpid_server packets. Domain to not audit. Receive openhpid_server packets. Domain allowed access. Do not audit attempts to receive openhpid_server packets. Domain allowed access. Send and receive openhpid_server packets. Domain allowed access. Do not audit attempts to send and receive openhpid_server packets. Domain to not audit. Relabel packets to openhpid_server the packet type. Domain allowed access. Send and receive TCP traffic on the openvpn port. Domain allowed access. Send UDP traffic on the openvpn port. Domain allowed access. Do not audit attempts to send UDP traffic on the openvpn port. Domain to not audit. Receive UDP traffic on the openvpn port. Domain allowed access. Do not audit attempts to receive UDP traffic on the openvpn port. Domain to not audit. Send and receive UDP traffic on the openvpn port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the openvpn port. Domain to not audit. Bind TCP sockets to the openvpn port. Domain allowed access. Bind UDP sockets to the openvpn port. Domain allowed access. Make a TCP connection to the openvpn port. Domain allowed access. Send openvpn_client packets. Domain allowed access. Do not audit attempts to send openvpn_client packets. Domain to not audit. Receive openvpn_client packets. Domain allowed access. Do not audit attempts to receive openvpn_client packets. Domain allowed access. Send and receive openvpn_client packets. Domain allowed access. Do not audit attempts to send and receive openvpn_client packets. Domain to not audit. Relabel packets to openvpn_client the packet type. Domain allowed access. Send openvpn_server packets. Domain allowed access. Do not audit attempts to send openvpn_server packets. Domain to not audit. Receive openvpn_server packets. Domain allowed access. Do not audit attempts to receive openvpn_server packets. Domain allowed access. Send and receive openvpn_server packets. Domain allowed access. Do not audit attempts to send and receive openvpn_server packets. Domain to not audit. Relabel packets to openvpn_server the packet type. Domain allowed access. Send and receive TCP traffic on the pdps port. Domain allowed access. Send UDP traffic on the pdps port. Domain allowed access. Do not audit attempts to send UDP traffic on the pdps port. Domain to not audit. Receive UDP traffic on the pdps port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pdps port. Domain to not audit. Send and receive UDP traffic on the pdps port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pdps port. Domain to not audit. Bind TCP sockets to the pdps port. Domain allowed access. Bind UDP sockets to the pdps port. Domain allowed access. Make a TCP connection to the pdps port. Domain allowed access. Send pdps_client packets. Domain allowed access. Do not audit attempts to send pdps_client packets. Domain to not audit. Receive pdps_client packets. Domain allowed access. Do not audit attempts to receive pdps_client packets. Domain allowed access. Send and receive pdps_client packets. Domain allowed access. Do not audit attempts to send and receive pdps_client packets. Domain to not audit. Relabel packets to pdps_client the packet type. Domain allowed access. Send pdps_server packets. Domain allowed access. Do not audit attempts to send pdps_server packets. Domain to not audit. Receive pdps_server packets. Domain allowed access. Do not audit attempts to receive pdps_server packets. Domain allowed access. Send and receive pdps_server packets. Domain allowed access. Do not audit attempts to send and receive pdps_server packets. Domain to not audit. Relabel packets to pdps_server the packet type. Domain allowed access. Send and receive TCP traffic on the pegasus_http port. Domain allowed access. Send UDP traffic on the pegasus_http port. Domain allowed access. Do not audit attempts to send UDP traffic on the pegasus_http port. Domain to not audit. Receive UDP traffic on the pegasus_http port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pegasus_http port. Domain to not audit. Send and receive UDP traffic on the pegasus_http port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pegasus_http port. Domain to not audit. Bind TCP sockets to the pegasus_http port. Domain allowed access. Bind UDP sockets to the pegasus_http port. Domain allowed access. Make a TCP connection to the pegasus_http port. Domain allowed access. Send pegasus_http_client packets. Domain allowed access. Do not audit attempts to send pegasus_http_client packets. Domain to not audit. Receive pegasus_http_client packets. Domain allowed access. Do not audit attempts to receive pegasus_http_client packets. Domain allowed access. Send and receive pegasus_http_client packets. Domain allowed access. Do not audit attempts to send and receive pegasus_http_client packets. Domain to not audit. Relabel packets to pegasus_http_client the packet type. Domain allowed access. Send pegasus_http_server packets. Domain allowed access. Do not audit attempts to send pegasus_http_server packets. Domain to not audit. Receive pegasus_http_server packets. Domain allowed access. Do not audit attempts to receive pegasus_http_server packets. Domain allowed access. Send and receive pegasus_http_server packets. Domain allowed access. Do not audit attempts to send and receive pegasus_http_server packets. Domain to not audit. Relabel packets to pegasus_http_server the packet type. Domain allowed access. Send and receive TCP traffic on the pegasus_https port. Domain allowed access. Send UDP traffic on the pegasus_https port. Domain allowed access. Do not audit attempts to send UDP traffic on the pegasus_https port. Domain to not audit. Receive UDP traffic on the pegasus_https port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pegasus_https port. Domain to not audit. Send and receive UDP traffic on the pegasus_https port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pegasus_https port. Domain to not audit. Bind TCP sockets to the pegasus_https port. Domain allowed access. Bind UDP sockets to the pegasus_https port. Domain allowed access. Make a TCP connection to the pegasus_https port. Domain allowed access. Send pegasus_https_client packets. Domain allowed access. Do not audit attempts to send pegasus_https_client packets. Domain to not audit. Receive pegasus_https_client packets. Domain allowed access. Do not audit attempts to receive pegasus_https_client packets. Domain allowed access. Send and receive pegasus_https_client packets. Domain allowed access. Do not audit attempts to send and receive pegasus_https_client packets. Domain to not audit. Relabel packets to pegasus_https_client the packet type. Domain allowed access. Send pegasus_https_server packets. Domain allowed access. Do not audit attempts to send pegasus_https_server packets. Domain to not audit. Receive pegasus_https_server packets. Domain allowed access. Do not audit attempts to receive pegasus_https_server packets. Domain allowed access. Send and receive pegasus_https_server packets. Domain allowed access. Do not audit attempts to send and receive pegasus_https_server packets. Domain to not audit. Relabel packets to pegasus_https_server the packet type. Domain allowed access. Send and receive TCP traffic on the pgpkeyserver port. Domain allowed access. Send UDP traffic on the pgpkeyserver port. Domain allowed access. Do not audit attempts to send UDP traffic on the pgpkeyserver port. Domain to not audit. Receive UDP traffic on the pgpkeyserver port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pgpkeyserver port. Domain to not audit. Send and receive UDP traffic on the pgpkeyserver port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pgpkeyserver port. Domain to not audit. Bind TCP sockets to the pgpkeyserver port. Domain allowed access. Bind UDP sockets to the pgpkeyserver port. Domain allowed access. Make a TCP connection to the pgpkeyserver port. Domain allowed access. Send pgpkeyserver_client packets. Domain allowed access. Do not audit attempts to send pgpkeyserver_client packets. Domain to not audit. Receive pgpkeyserver_client packets. Domain allowed access. Do not audit attempts to receive pgpkeyserver_client packets. Domain allowed access. Send and receive pgpkeyserver_client packets. Domain allowed access. Do not audit attempts to send and receive pgpkeyserver_client packets. Domain to not audit. Relabel packets to pgpkeyserver_client the packet type. Domain allowed access. Send pgpkeyserver_server packets. Domain allowed access. Do not audit attempts to send pgpkeyserver_server packets. Domain to not audit. Receive pgpkeyserver_server packets. Domain allowed access. Do not audit attempts to receive pgpkeyserver_server packets. Domain allowed access. Send and receive pgpkeyserver_server packets. Domain allowed access. Do not audit attempts to send and receive pgpkeyserver_server packets. Domain to not audit. Relabel packets to pgpkeyserver_server the packet type. Domain allowed access. Send and receive TCP traffic on the pingd port. Domain allowed access. Send UDP traffic on the pingd port. Domain allowed access. Do not audit attempts to send UDP traffic on the pingd port. Domain to not audit. Receive UDP traffic on the pingd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pingd port. Domain to not audit. Send and receive UDP traffic on the pingd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pingd port. Domain to not audit. Bind TCP sockets to the pingd port. Domain allowed access. Bind UDP sockets to the pingd port. Domain allowed access. Make a TCP connection to the pingd port. Domain allowed access. Send pingd_client packets. Domain allowed access. Do not audit attempts to send pingd_client packets. Domain to not audit. Receive pingd_client packets. Domain allowed access. Do not audit attempts to receive pingd_client packets. Domain allowed access. Send and receive pingd_client packets. Domain allowed access. Do not audit attempts to send and receive pingd_client packets. Domain to not audit. Relabel packets to pingd_client the packet type. Domain allowed access. Send pingd_server packets. Domain allowed access. Do not audit attempts to send pingd_server packets. Domain to not audit. Receive pingd_server packets. Domain allowed access. Do not audit attempts to receive pingd_server packets. Domain allowed access. Send and receive pingd_server packets. Domain allowed access. Do not audit attempts to send and receive pingd_server packets. Domain to not audit. Relabel packets to pingd_server the packet type. Domain allowed access. Send and receive TCP traffic on the pktcable_cops port. Domain allowed access. Send UDP traffic on the pktcable_cops port. Domain allowed access. Do not audit attempts to send UDP traffic on the pktcable_cops port. Domain to not audit. Receive UDP traffic on the pktcable_cops port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pktcable_cops port. Domain to not audit. Send and receive UDP traffic on the pktcable_cops port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pktcable_cops port. Domain to not audit. Bind TCP sockets to the pktcable_cops port. Domain allowed access. Bind UDP sockets to the pktcable_cops port. Domain allowed access. Make a TCP connection to the pktcable_cops port. Domain allowed access. Send pktcable_cops_client packets. Domain allowed access. Do not audit attempts to send pktcable_cops_client packets. Domain to not audit. Receive pktcable_cops_client packets. Domain allowed access. Do not audit attempts to receive pktcable_cops_client packets. Domain allowed access. Send and receive pktcable_cops_client packets. Domain allowed access. Do not audit attempts to send and receive pktcable_cops_client packets. Domain to not audit. Relabel packets to pktcable_cops_client the packet type. Domain allowed access. Send pktcable_cops_server packets. Domain allowed access. Do not audit attempts to send pktcable_cops_server packets. Domain to not audit. Receive pktcable_cops_server packets. Domain allowed access. Do not audit attempts to receive pktcable_cops_server packets. Domain allowed access. Send and receive pktcable_cops_server packets. Domain allowed access. Do not audit attempts to send and receive pktcable_cops_server packets. Domain to not audit. Relabel packets to pktcable_cops_server the packet type. Domain allowed access. Send and receive TCP traffic on the pop port. Domain allowed access. Send UDP traffic on the pop port. Domain allowed access. Do not audit attempts to send UDP traffic on the pop port. Domain to not audit. Receive UDP traffic on the pop port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pop port. Domain to not audit. Send and receive UDP traffic on the pop port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pop port. Domain to not audit. Bind TCP sockets to the pop port. Domain allowed access. Bind UDP sockets to the pop port. Domain allowed access. Make a TCP connection to the pop port. Domain allowed access. Send pop_client packets. Domain allowed access. Do not audit attempts to send pop_client packets. Domain to not audit. Receive pop_client packets. Domain allowed access. Do not audit attempts to receive pop_client packets. Domain allowed access. Send and receive pop_client packets. Domain allowed access. Do not audit attempts to send and receive pop_client packets. Domain to not audit. Relabel packets to pop_client the packet type. Domain allowed access. Send pop_server packets. Domain allowed access. Do not audit attempts to send pop_server packets. Domain to not audit. Receive pop_server packets. Domain allowed access. Do not audit attempts to receive pop_server packets. Domain allowed access. Send and receive pop_server packets. Domain allowed access. Do not audit attempts to send and receive pop_server packets. Domain to not audit. Relabel packets to pop_server the packet type. Domain allowed access. Send and receive TCP traffic on the portmap port. Domain allowed access. Send UDP traffic on the portmap port. Domain allowed access. Do not audit attempts to send UDP traffic on the portmap port. Domain to not audit. Receive UDP traffic on the portmap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the portmap port. Domain to not audit. Send and receive UDP traffic on the portmap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the portmap port. Domain to not audit. Bind TCP sockets to the portmap port. Domain allowed access. Bind UDP sockets to the portmap port. Domain allowed access. Make a TCP connection to the portmap port. Domain allowed access. Send portmap_client packets. Domain allowed access. Do not audit attempts to send portmap_client packets. Domain to not audit. Receive portmap_client packets. Domain allowed access. Do not audit attempts to receive portmap_client packets. Domain allowed access. Send and receive portmap_client packets. Domain allowed access. Do not audit attempts to send and receive portmap_client packets. Domain to not audit. Relabel packets to portmap_client the packet type. Domain allowed access. Send portmap_server packets. Domain allowed access. Do not audit attempts to send portmap_server packets. Domain to not audit. Receive portmap_server packets. Domain allowed access. Do not audit attempts to receive portmap_server packets. Domain allowed access. Send and receive portmap_server packets. Domain allowed access. Do not audit attempts to send and receive portmap_server packets. Domain to not audit. Relabel packets to portmap_server the packet type. Domain allowed access. Send and receive TCP traffic on the postfix_policyd port. Domain allowed access. Send UDP traffic on the postfix_policyd port. Domain allowed access. Do not audit attempts to send UDP traffic on the postfix_policyd port. Domain to not audit. Receive UDP traffic on the postfix_policyd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the postfix_policyd port. Domain to not audit. Send and receive UDP traffic on the postfix_policyd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the postfix_policyd port. Domain to not audit. Bind TCP sockets to the postfix_policyd port. Domain allowed access. Bind UDP sockets to the postfix_policyd port. Domain allowed access. Make a TCP connection to the postfix_policyd port. Domain allowed access. Send postfix_policyd_client packets. Domain allowed access. Do not audit attempts to send postfix_policyd_client packets. Domain to not audit. Receive postfix_policyd_client packets. Domain allowed access. Do not audit attempts to receive postfix_policyd_client packets. Domain allowed access. Send and receive postfix_policyd_client packets. Domain allowed access. Do not audit attempts to send and receive postfix_policyd_client packets. Domain to not audit. Relabel packets to postfix_policyd_client the packet type. Domain allowed access. Send postfix_policyd_server packets. Domain allowed access. Do not audit attempts to send postfix_policyd_server packets. Domain to not audit. Receive postfix_policyd_server packets. Domain allowed access. Do not audit attempts to receive postfix_policyd_server packets. Domain allowed access. Send and receive postfix_policyd_server packets. Domain allowed access. Do not audit attempts to send and receive postfix_policyd_server packets. Domain to not audit. Relabel packets to postfix_policyd_server the packet type. Domain allowed access. Send and receive TCP traffic on the postgresql port. Domain allowed access. Send UDP traffic on the postgresql port. Domain allowed access. Do not audit attempts to send UDP traffic on the postgresql port. Domain to not audit. Receive UDP traffic on the postgresql port. Domain allowed access. Do not audit attempts to receive UDP traffic on the postgresql port. Domain to not audit. Send and receive UDP traffic on the postgresql port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the postgresql port. Domain to not audit. Bind TCP sockets to the postgresql port. Domain allowed access. Bind UDP sockets to the postgresql port. Domain allowed access. Make a TCP connection to the postgresql port. Domain allowed access. Send postgresql_client packets. Domain allowed access. Do not audit attempts to send postgresql_client packets. Domain to not audit. Receive postgresql_client packets. Domain allowed access. Do not audit attempts to receive postgresql_client packets. Domain allowed access. Send and receive postgresql_client packets. Domain allowed access. Do not audit attempts to send and receive postgresql_client packets. Domain to not audit. Relabel packets to postgresql_client the packet type. Domain allowed access. Send postgresql_server packets. Domain allowed access. Do not audit attempts to send postgresql_server packets. Domain to not audit. Receive postgresql_server packets. Domain allowed access. Do not audit attempts to receive postgresql_server packets. Domain allowed access. Send and receive postgresql_server packets. Domain allowed access. Do not audit attempts to send and receive postgresql_server packets. Domain to not audit. Relabel packets to postgresql_server the packet type. Domain allowed access. Send and receive TCP traffic on the postgrey port. Domain allowed access. Send UDP traffic on the postgrey port. Domain allowed access. Do not audit attempts to send UDP traffic on the postgrey port. Domain to not audit. Receive UDP traffic on the postgrey port. Domain allowed access. Do not audit attempts to receive UDP traffic on the postgrey port. Domain to not audit. Send and receive UDP traffic on the postgrey port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the postgrey port. Domain to not audit. Bind TCP sockets to the postgrey port. Domain allowed access. Bind UDP sockets to the postgrey port. Domain allowed access. Make a TCP connection to the postgrey port. Domain allowed access. Send postgrey_client packets. Domain allowed access. Do not audit attempts to send postgrey_client packets. Domain to not audit. Receive postgrey_client packets. Domain allowed access. Do not audit attempts to receive postgrey_client packets. Domain allowed access. Send and receive postgrey_client packets. Domain allowed access. Do not audit attempts to send and receive postgrey_client packets. Domain to not audit. Relabel packets to postgrey_client the packet type. Domain allowed access. Send postgrey_server packets. Domain allowed access. Do not audit attempts to send postgrey_server packets. Domain to not audit. Receive postgrey_server packets. Domain allowed access. Do not audit attempts to receive postgrey_server packets. Domain allowed access. Send and receive postgrey_server packets. Domain allowed access. Do not audit attempts to send and receive postgrey_server packets. Domain to not audit. Relabel packets to postgrey_server the packet type. Domain allowed access. Send and receive TCP traffic on the pptp port. Domain allowed access. Send UDP traffic on the pptp port. Domain allowed access. Do not audit attempts to send UDP traffic on the pptp port. Domain to not audit. Receive UDP traffic on the pptp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pptp port. Domain to not audit. Send and receive UDP traffic on the pptp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pptp port. Domain to not audit. Bind TCP sockets to the pptp port. Domain allowed access. Bind UDP sockets to the pptp port. Domain allowed access. Make a TCP connection to the pptp port. Domain allowed access. Send pptp_client packets. Domain allowed access. Do not audit attempts to send pptp_client packets. Domain to not audit. Receive pptp_client packets. Domain allowed access. Do not audit attempts to receive pptp_client packets. Domain allowed access. Send and receive pptp_client packets. Domain allowed access. Do not audit attempts to send and receive pptp_client packets. Domain to not audit. Relabel packets to pptp_client the packet type. Domain allowed access. Send pptp_server packets. Domain allowed access. Do not audit attempts to send pptp_server packets. Domain to not audit. Receive pptp_server packets. Domain allowed access. Do not audit attempts to receive pptp_server packets. Domain allowed access. Send and receive pptp_server packets. Domain allowed access. Do not audit attempts to send and receive pptp_server packets. Domain to not audit. Relabel packets to pptp_server the packet type. Domain allowed access. Send and receive TCP traffic on the prelude port. Domain allowed access. Send UDP traffic on the prelude port. Domain allowed access. Do not audit attempts to send UDP traffic on the prelude port. Domain to not audit. Receive UDP traffic on the prelude port. Domain allowed access. Do not audit attempts to receive UDP traffic on the prelude port. Domain to not audit. Send and receive UDP traffic on the prelude port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the prelude port. Domain to not audit. Bind TCP sockets to the prelude port. Domain allowed access. Bind UDP sockets to the prelude port. Domain allowed access. Make a TCP connection to the prelude port. Domain allowed access. Send prelude_client packets. Domain allowed access. Do not audit attempts to send prelude_client packets. Domain to not audit. Receive prelude_client packets. Domain allowed access. Do not audit attempts to receive prelude_client packets. Domain allowed access. Send and receive prelude_client packets. Domain allowed access. Do not audit attempts to send and receive prelude_client packets. Domain to not audit. Relabel packets to prelude_client the packet type. Domain allowed access. Send prelude_server packets. Domain allowed access. Do not audit attempts to send prelude_server packets. Domain to not audit. Receive prelude_server packets. Domain allowed access. Do not audit attempts to receive prelude_server packets. Domain allowed access. Send and receive prelude_server packets. Domain allowed access. Do not audit attempts to send and receive prelude_server packets. Domain to not audit. Relabel packets to prelude_server the packet type. Domain allowed access. Send and receive TCP traffic on the presence port. Domain allowed access. Send UDP traffic on the presence port. Domain allowed access. Do not audit attempts to send UDP traffic on the presence port. Domain to not audit. Receive UDP traffic on the presence port. Domain allowed access. Do not audit attempts to receive UDP traffic on the presence port. Domain to not audit. Send and receive UDP traffic on the presence port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the presence port. Domain to not audit. Bind TCP sockets to the presence port. Domain allowed access. Bind UDP sockets to the presence port. Domain allowed access. Make a TCP connection to the presence port. Domain allowed access. Send presence_client packets. Domain allowed access. Do not audit attempts to send presence_client packets. Domain to not audit. Receive presence_client packets. Domain allowed access. Do not audit attempts to receive presence_client packets. Domain allowed access. Send and receive presence_client packets. Domain allowed access. Do not audit attempts to send and receive presence_client packets. Domain to not audit. Relabel packets to presence_client the packet type. Domain allowed access. Send presence_server packets. Domain allowed access. Do not audit attempts to send presence_server packets. Domain to not audit. Receive presence_server packets. Domain allowed access. Do not audit attempts to receive presence_server packets. Domain allowed access. Send and receive presence_server packets. Domain allowed access. Do not audit attempts to send and receive presence_server packets. Domain to not audit. Relabel packets to presence_server the packet type. Domain allowed access. Send and receive TCP traffic on the printer port. Domain allowed access. Send UDP traffic on the printer port. Domain allowed access. Do not audit attempts to send UDP traffic on the printer port. Domain to not audit. Receive UDP traffic on the printer port. Domain allowed access. Do not audit attempts to receive UDP traffic on the printer port. Domain to not audit. Send and receive UDP traffic on the printer port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the printer port. Domain to not audit. Bind TCP sockets to the printer port. Domain allowed access. Bind UDP sockets to the printer port. Domain allowed access. Make a TCP connection to the printer port. Domain allowed access. Send printer_client packets. Domain allowed access. Do not audit attempts to send printer_client packets. Domain to not audit. Receive printer_client packets. Domain allowed access. Do not audit attempts to receive printer_client packets. Domain allowed access. Send and receive printer_client packets. Domain allowed access. Do not audit attempts to send and receive printer_client packets. Domain to not audit. Relabel packets to printer_client the packet type. Domain allowed access. Send printer_server packets. Domain allowed access. Do not audit attempts to send printer_server packets. Domain to not audit. Receive printer_server packets. Domain allowed access. Do not audit attempts to receive printer_server packets. Domain allowed access. Send and receive printer_server packets. Domain allowed access. Do not audit attempts to send and receive printer_server packets. Domain to not audit. Relabel packets to printer_server the packet type. Domain allowed access. Send and receive TCP traffic on the ptal port. Domain allowed access. Send UDP traffic on the ptal port. Domain allowed access. Do not audit attempts to send UDP traffic on the ptal port. Domain to not audit. Receive UDP traffic on the ptal port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ptal port. Domain to not audit. Send and receive UDP traffic on the ptal port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ptal port. Domain to not audit. Bind TCP sockets to the ptal port. Domain allowed access. Bind UDP sockets to the ptal port. Domain allowed access. Make a TCP connection to the ptal port. Domain allowed access. Send ptal_client packets. Domain allowed access. Do not audit attempts to send ptal_client packets. Domain to not audit. Receive ptal_client packets. Domain allowed access. Do not audit attempts to receive ptal_client packets. Domain allowed access. Send and receive ptal_client packets. Domain allowed access. Do not audit attempts to send and receive ptal_client packets. Domain to not audit. Relabel packets to ptal_client the packet type. Domain allowed access. Send ptal_server packets. Domain allowed access. Do not audit attempts to send ptal_server packets. Domain to not audit. Receive ptal_server packets. Domain allowed access. Do not audit attempts to receive ptal_server packets. Domain allowed access. Send and receive ptal_server packets. Domain allowed access. Do not audit attempts to send and receive ptal_server packets. Domain to not audit. Relabel packets to ptal_server the packet type. Domain allowed access. Send and receive TCP traffic on the pulseaudio port. Domain allowed access. Send UDP traffic on the pulseaudio port. Domain allowed access. Do not audit attempts to send UDP traffic on the pulseaudio port. Domain to not audit. Receive UDP traffic on the pulseaudio port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pulseaudio port. Domain to not audit. Send and receive UDP traffic on the pulseaudio port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pulseaudio port. Domain to not audit. Bind TCP sockets to the pulseaudio port. Domain allowed access. Bind UDP sockets to the pulseaudio port. Domain allowed access. Make a TCP connection to the pulseaudio port. Domain allowed access. Send pulseaudio_client packets. Domain allowed access. Do not audit attempts to send pulseaudio_client packets. Domain to not audit. Receive pulseaudio_client packets. Domain allowed access. Do not audit attempts to receive pulseaudio_client packets. Domain allowed access. Send and receive pulseaudio_client packets. Domain allowed access. Do not audit attempts to send and receive pulseaudio_client packets. Domain to not audit. Relabel packets to pulseaudio_client the packet type. Domain allowed access. Send pulseaudio_server packets. Domain allowed access. Do not audit attempts to send pulseaudio_server packets. Domain to not audit. Receive pulseaudio_server packets. Domain allowed access. Do not audit attempts to receive pulseaudio_server packets. Domain allowed access. Send and receive pulseaudio_server packets. Domain allowed access. Do not audit attempts to send and receive pulseaudio_server packets. Domain to not audit. Relabel packets to pulseaudio_server the packet type. Domain allowed access. Send and receive TCP traffic on the puppet port. Domain allowed access. Send UDP traffic on the puppet port. Domain allowed access. Do not audit attempts to send UDP traffic on the puppet port. Domain to not audit. Receive UDP traffic on the puppet port. Domain allowed access. Do not audit attempts to receive UDP traffic on the puppet port. Domain to not audit. Send and receive UDP traffic on the puppet port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the puppet port. Domain to not audit. Bind TCP sockets to the puppet port. Domain allowed access. Bind UDP sockets to the puppet port. Domain allowed access. Make a TCP connection to the puppet port. Domain allowed access. Send puppet_client packets. Domain allowed access. Do not audit attempts to send puppet_client packets. Domain to not audit. Receive puppet_client packets. Domain allowed access. Do not audit attempts to receive puppet_client packets. Domain allowed access. Send and receive puppet_client packets. Domain allowed access. Do not audit attempts to send and receive puppet_client packets. Domain to not audit. Relabel packets to puppet_client the packet type. Domain allowed access. Send puppet_server packets. Domain allowed access. Do not audit attempts to send puppet_server packets. Domain to not audit. Receive puppet_server packets. Domain allowed access. Do not audit attempts to receive puppet_server packets. Domain allowed access. Send and receive puppet_server packets. Domain allowed access. Do not audit attempts to send and receive puppet_server packets. Domain to not audit. Relabel packets to puppet_server the packet type. Domain allowed access. Send and receive TCP traffic on the pxe port. Domain allowed access. Send UDP traffic on the pxe port. Domain allowed access. Do not audit attempts to send UDP traffic on the pxe port. Domain to not audit. Receive UDP traffic on the pxe port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pxe port. Domain to not audit. Send and receive UDP traffic on the pxe port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pxe port. Domain to not audit. Bind TCP sockets to the pxe port. Domain allowed access. Bind UDP sockets to the pxe port. Domain allowed access. Make a TCP connection to the pxe port. Domain allowed access. Send pxe_client packets. Domain allowed access. Do not audit attempts to send pxe_client packets. Domain to not audit. Receive pxe_client packets. Domain allowed access. Do not audit attempts to receive pxe_client packets. Domain allowed access. Send and receive pxe_client packets. Domain allowed access. Do not audit attempts to send and receive pxe_client packets. Domain to not audit. Relabel packets to pxe_client the packet type. Domain allowed access. Send pxe_server packets. Domain allowed access. Do not audit attempts to send pxe_server packets. Domain to not audit. Receive pxe_server packets. Domain allowed access. Do not audit attempts to receive pxe_server packets. Domain allowed access. Send and receive pxe_server packets. Domain allowed access. Do not audit attempts to send and receive pxe_server packets. Domain to not audit. Relabel packets to pxe_server the packet type. Domain allowed access. Send and receive TCP traffic on the pyzor port. Domain allowed access. Send UDP traffic on the pyzor port. Domain allowed access. Do not audit attempts to send UDP traffic on the pyzor port. Domain to not audit. Receive UDP traffic on the pyzor port. Domain allowed access. Do not audit attempts to receive UDP traffic on the pyzor port. Domain to not audit. Send and receive UDP traffic on the pyzor port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the pyzor port. Domain to not audit. Bind TCP sockets to the pyzor port. Domain allowed access. Bind UDP sockets to the pyzor port. Domain allowed access. Make a TCP connection to the pyzor port. Domain allowed access. Send pyzor_client packets. Domain allowed access. Do not audit attempts to send pyzor_client packets. Domain to not audit. Receive pyzor_client packets. Domain allowed access. Do not audit attempts to receive pyzor_client packets. Domain allowed access. Send and receive pyzor_client packets. Domain allowed access. Do not audit attempts to send and receive pyzor_client packets. Domain to not audit. Relabel packets to pyzor_client the packet type. Domain allowed access. Send pyzor_server packets. Domain allowed access. Do not audit attempts to send pyzor_server packets. Domain to not audit. Receive pyzor_server packets. Domain allowed access. Do not audit attempts to receive pyzor_server packets. Domain allowed access. Send and receive pyzor_server packets. Domain allowed access. Do not audit attempts to send and receive pyzor_server packets. Domain to not audit. Relabel packets to pyzor_server the packet type. Domain allowed access. Send and receive TCP traffic on the radacct port. Domain allowed access. Send UDP traffic on the radacct port. Domain allowed access. Do not audit attempts to send UDP traffic on the radacct port. Domain to not audit. Receive UDP traffic on the radacct port. Domain allowed access. Do not audit attempts to receive UDP traffic on the radacct port. Domain to not audit. Send and receive UDP traffic on the radacct port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the radacct port. Domain to not audit. Bind TCP sockets to the radacct port. Domain allowed access. Bind UDP sockets to the radacct port. Domain allowed access. Make a TCP connection to the radacct port. Domain allowed access. Send radacct_client packets. Domain allowed access. Do not audit attempts to send radacct_client packets. Domain to not audit. Receive radacct_client packets. Domain allowed access. Do not audit attempts to receive radacct_client packets. Domain allowed access. Send and receive radacct_client packets. Domain allowed access. Do not audit attempts to send and receive radacct_client packets. Domain to not audit. Relabel packets to radacct_client the packet type. Domain allowed access. Send radacct_server packets. Domain allowed access. Do not audit attempts to send radacct_server packets. Domain to not audit. Receive radacct_server packets. Domain allowed access. Do not audit attempts to receive radacct_server packets. Domain allowed access. Send and receive radacct_server packets. Domain allowed access. Do not audit attempts to send and receive radacct_server packets. Domain to not audit. Relabel packets to radacct_server the packet type. Domain allowed access. Send and receive TCP traffic on the radius port. Domain allowed access. Send UDP traffic on the radius port. Domain allowed access. Do not audit attempts to send UDP traffic on the radius port. Domain to not audit. Receive UDP traffic on the radius port. Domain allowed access. Do not audit attempts to receive UDP traffic on the radius port. Domain to not audit. Send and receive UDP traffic on the radius port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the radius port. Domain to not audit. Bind TCP sockets to the radius port. Domain allowed access. Bind UDP sockets to the radius port. Domain allowed access. Make a TCP connection to the radius port. Domain allowed access. Send radius_client packets. Domain allowed access. Do not audit attempts to send radius_client packets. Domain to not audit. Receive radius_client packets. Domain allowed access. Do not audit attempts to receive radius_client packets. Domain allowed access. Send and receive radius_client packets. Domain allowed access. Do not audit attempts to send and receive radius_client packets. Domain to not audit. Relabel packets to radius_client the packet type. Domain allowed access. Send radius_server packets. Domain allowed access. Do not audit attempts to send radius_server packets. Domain to not audit. Receive radius_server packets. Domain allowed access. Do not audit attempts to receive radius_server packets. Domain allowed access. Send and receive radius_server packets. Domain allowed access. Do not audit attempts to send and receive radius_server packets. Domain to not audit. Relabel packets to radius_server the packet type. Domain allowed access. Send and receive TCP traffic on the radsec port. Domain allowed access. Send UDP traffic on the radsec port. Domain allowed access. Do not audit attempts to send UDP traffic on the radsec port. Domain to not audit. Receive UDP traffic on the radsec port. Domain allowed access. Do not audit attempts to receive UDP traffic on the radsec port. Domain to not audit. Send and receive UDP traffic on the radsec port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the radsec port. Domain to not audit. Bind TCP sockets to the radsec port. Domain allowed access. Bind UDP sockets to the radsec port. Domain allowed access. Make a TCP connection to the radsec port. Domain allowed access. Send radsec_client packets. Domain allowed access. Do not audit attempts to send radsec_client packets. Domain to not audit. Receive radsec_client packets. Domain allowed access. Do not audit attempts to receive radsec_client packets. Domain allowed access. Send and receive radsec_client packets. Domain allowed access. Do not audit attempts to send and receive radsec_client packets. Domain to not audit. Relabel packets to radsec_client the packet type. Domain allowed access. Send radsec_server packets. Domain allowed access. Do not audit attempts to send radsec_server packets. Domain to not audit. Receive radsec_server packets. Domain allowed access. Do not audit attempts to receive radsec_server packets. Domain allowed access. Send and receive radsec_server packets. Domain allowed access. Do not audit attempts to send and receive radsec_server packets. Domain to not audit. Relabel packets to radsec_server the packet type. Domain allowed access. Send and receive TCP traffic on the razor port. Domain allowed access. Send UDP traffic on the razor port. Domain allowed access. Do not audit attempts to send UDP traffic on the razor port. Domain to not audit. Receive UDP traffic on the razor port. Domain allowed access. Do not audit attempts to receive UDP traffic on the razor port. Domain to not audit. Send and receive UDP traffic on the razor port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the razor port. Domain to not audit. Bind TCP sockets to the razor port. Domain allowed access. Bind UDP sockets to the razor port. Domain allowed access. Make a TCP connection to the razor port. Domain allowed access. Send razor_client packets. Domain allowed access. Do not audit attempts to send razor_client packets. Domain to not audit. Receive razor_client packets. Domain allowed access. Do not audit attempts to receive razor_client packets. Domain allowed access. Send and receive razor_client packets. Domain allowed access. Do not audit attempts to send and receive razor_client packets. Domain to not audit. Relabel packets to razor_client the packet type. Domain allowed access. Send razor_server packets. Domain allowed access. Do not audit attempts to send razor_server packets. Domain to not audit. Receive razor_server packets. Domain allowed access. Do not audit attempts to receive razor_server packets. Domain allowed access. Send and receive razor_server packets. Domain allowed access. Do not audit attempts to send and receive razor_server packets. Domain to not audit. Relabel packets to razor_server the packet type. Domain allowed access. Send and receive TCP traffic on the redis port. Domain allowed access. Send UDP traffic on the redis port. Domain allowed access. Do not audit attempts to send UDP traffic on the redis port. Domain to not audit. Receive UDP traffic on the redis port. Domain allowed access. Do not audit attempts to receive UDP traffic on the redis port. Domain to not audit. Send and receive UDP traffic on the redis port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the redis port. Domain to not audit. Bind TCP sockets to the redis port. Domain allowed access. Bind UDP sockets to the redis port. Domain allowed access. Make a TCP connection to the redis port. Domain allowed access. Send redis_client packets. Domain allowed access. Do not audit attempts to send redis_client packets. Domain to not audit. Receive redis_client packets. Domain allowed access. Do not audit attempts to receive redis_client packets. Domain allowed access. Send and receive redis_client packets. Domain allowed access. Do not audit attempts to send and receive redis_client packets. Domain to not audit. Relabel packets to redis_client the packet type. Domain allowed access. Send redis_server packets. Domain allowed access. Do not audit attempts to send redis_server packets. Domain to not audit. Receive redis_server packets. Domain allowed access. Do not audit attempts to receive redis_server packets. Domain allowed access. Send and receive redis_server packets. Domain allowed access. Do not audit attempts to send and receive redis_server packets. Domain to not audit. Relabel packets to redis_server the packet type. Domain allowed access. Send and receive TCP traffic on the repository port. Domain allowed access. Send UDP traffic on the repository port. Domain allowed access. Do not audit attempts to send UDP traffic on the repository port. Domain to not audit. Receive UDP traffic on the repository port. Domain allowed access. Do not audit attempts to receive UDP traffic on the repository port. Domain to not audit. Send and receive UDP traffic on the repository port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the repository port. Domain to not audit. Bind TCP sockets to the repository port. Domain allowed access. Bind UDP sockets to the repository port. Domain allowed access. Make a TCP connection to the repository port. Domain allowed access. Send repository_client packets. Domain allowed access. Do not audit attempts to send repository_client packets. Domain to not audit. Receive repository_client packets. Domain allowed access. Do not audit attempts to receive repository_client packets. Domain allowed access. Send and receive repository_client packets. Domain allowed access. Do not audit attempts to send and receive repository_client packets. Domain to not audit. Relabel packets to repository_client the packet type. Domain allowed access. Send repository_server packets. Domain allowed access. Do not audit attempts to send repository_server packets. Domain to not audit. Receive repository_server packets. Domain allowed access. Do not audit attempts to receive repository_server packets. Domain allowed access. Send and receive repository_server packets. Domain allowed access. Do not audit attempts to send and receive repository_server packets. Domain to not audit. Relabel packets to repository_server the packet type. Domain allowed access. Send and receive TCP traffic on the ricci port. Domain allowed access. Send UDP traffic on the ricci port. Domain allowed access. Do not audit attempts to send UDP traffic on the ricci port. Domain to not audit. Receive UDP traffic on the ricci port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ricci port. Domain to not audit. Send and receive UDP traffic on the ricci port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ricci port. Domain to not audit. Bind TCP sockets to the ricci port. Domain allowed access. Bind UDP sockets to the ricci port. Domain allowed access. Make a TCP connection to the ricci port. Domain allowed access. Send ricci_client packets. Domain allowed access. Do not audit attempts to send ricci_client packets. Domain to not audit. Receive ricci_client packets. Domain allowed access. Do not audit attempts to receive ricci_client packets. Domain allowed access. Send and receive ricci_client packets. Domain allowed access. Do not audit attempts to send and receive ricci_client packets. Domain to not audit. Relabel packets to ricci_client the packet type. Domain allowed access. Send ricci_server packets. Domain allowed access. Do not audit attempts to send ricci_server packets. Domain to not audit. Receive ricci_server packets. Domain allowed access. Do not audit attempts to receive ricci_server packets. Domain allowed access. Send and receive ricci_server packets. Domain allowed access. Do not audit attempts to send and receive ricci_server packets. Domain to not audit. Relabel packets to ricci_server the packet type. Domain allowed access. Send and receive TCP traffic on the ricci_modcluster port. Domain allowed access. Send UDP traffic on the ricci_modcluster port. Domain allowed access. Do not audit attempts to send UDP traffic on the ricci_modcluster port. Domain to not audit. Receive UDP traffic on the ricci_modcluster port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ricci_modcluster port. Domain to not audit. Send and receive UDP traffic on the ricci_modcluster port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ricci_modcluster port. Domain to not audit. Bind TCP sockets to the ricci_modcluster port. Domain allowed access. Bind UDP sockets to the ricci_modcluster port. Domain allowed access. Make a TCP connection to the ricci_modcluster port. Domain allowed access. Send ricci_modcluster_client packets. Domain allowed access. Do not audit attempts to send ricci_modcluster_client packets. Domain to not audit. Receive ricci_modcluster_client packets. Domain allowed access. Do not audit attempts to receive ricci_modcluster_client packets. Domain allowed access. Send and receive ricci_modcluster_client packets. Domain allowed access. Do not audit attempts to send and receive ricci_modcluster_client packets. Domain to not audit. Relabel packets to ricci_modcluster_client the packet type. Domain allowed access. Send ricci_modcluster_server packets. Domain allowed access. Do not audit attempts to send ricci_modcluster_server packets. Domain to not audit. Receive ricci_modcluster_server packets. Domain allowed access. Do not audit attempts to receive ricci_modcluster_server packets. Domain allowed access. Send and receive ricci_modcluster_server packets. Domain allowed access. Do not audit attempts to send and receive ricci_modcluster_server packets. Domain to not audit. Relabel packets to ricci_modcluster_server the packet type. Domain allowed access. Send and receive TCP traffic on the rlogind port. Domain allowed access. Send UDP traffic on the rlogind port. Domain allowed access. Do not audit attempts to send UDP traffic on the rlogind port. Domain to not audit. Receive UDP traffic on the rlogind port. Domain allowed access. Do not audit attempts to receive UDP traffic on the rlogind port. Domain to not audit. Send and receive UDP traffic on the rlogind port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the rlogind port. Domain to not audit. Bind TCP sockets to the rlogind port. Domain allowed access. Bind UDP sockets to the rlogind port. Domain allowed access. Make a TCP connection to the rlogind port. Domain allowed access. Send rlogind_client packets. Domain allowed access. Do not audit attempts to send rlogind_client packets. Domain to not audit. Receive rlogind_client packets. Domain allowed access. Do not audit attempts to receive rlogind_client packets. Domain allowed access. Send and receive rlogind_client packets. Domain allowed access. Do not audit attempts to send and receive rlogind_client packets. Domain to not audit. Relabel packets to rlogind_client the packet type. Domain allowed access. Send rlogind_server packets. Domain allowed access. Do not audit attempts to send rlogind_server packets. Domain to not audit. Receive rlogind_server packets. Domain allowed access. Do not audit attempts to receive rlogind_server packets. Domain allowed access. Send and receive rlogind_server packets. Domain allowed access. Do not audit attempts to send and receive rlogind_server packets. Domain to not audit. Relabel packets to rlogind_server the packet type. Domain allowed access. Send and receive TCP traffic on the rndc port. Domain allowed access. Send UDP traffic on the rndc port. Domain allowed access. Do not audit attempts to send UDP traffic on the rndc port. Domain to not audit. Receive UDP traffic on the rndc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the rndc port. Domain to not audit. Send and receive UDP traffic on the rndc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the rndc port. Domain to not audit. Bind TCP sockets to the rndc port. Domain allowed access. Bind UDP sockets to the rndc port. Domain allowed access. Make a TCP connection to the rndc port. Domain allowed access. Send rndc_client packets. Domain allowed access. Do not audit attempts to send rndc_client packets. Domain to not audit. Receive rndc_client packets. Domain allowed access. Do not audit attempts to receive rndc_client packets. Domain allowed access. Send and receive rndc_client packets. Domain allowed access. Do not audit attempts to send and receive rndc_client packets. Domain to not audit. Relabel packets to rndc_client the packet type. Domain allowed access. Send rndc_server packets. Domain allowed access. Do not audit attempts to send rndc_server packets. Domain to not audit. Receive rndc_server packets. Domain allowed access. Do not audit attempts to receive rndc_server packets. Domain allowed access. Send and receive rndc_server packets. Domain allowed access. Do not audit attempts to send and receive rndc_server packets. Domain to not audit. Relabel packets to rndc_server the packet type. Domain allowed access. Send and receive TCP traffic on the router port. Domain allowed access. Send UDP traffic on the router port. Domain allowed access. Do not audit attempts to send UDP traffic on the router port. Domain to not audit. Receive UDP traffic on the router port. Domain allowed access. Do not audit attempts to receive UDP traffic on the router port. Domain to not audit. Send and receive UDP traffic on the router port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the router port. Domain to not audit. Bind TCP sockets to the router port. Domain allowed access. Bind UDP sockets to the router port. Domain allowed access. Make a TCP connection to the router port. Domain allowed access. Send router_client packets. Domain allowed access. Do not audit attempts to send router_client packets. Domain to not audit. Receive router_client packets. Domain allowed access. Do not audit attempts to receive router_client packets. Domain allowed access. Send and receive router_client packets. Domain allowed access. Do not audit attempts to send and receive router_client packets. Domain to not audit. Relabel packets to router_client the packet type. Domain allowed access. Send router_server packets. Domain allowed access. Do not audit attempts to send router_server packets. Domain to not audit. Receive router_server packets. Domain allowed access. Do not audit attempts to receive router_server packets. Domain allowed access. Send and receive router_server packets. Domain allowed access. Do not audit attempts to send and receive router_server packets. Domain to not audit. Relabel packets to router_server the packet type. Domain allowed access. Send and receive TCP traffic on the rsh port. Domain allowed access. Send UDP traffic on the rsh port. Domain allowed access. Do not audit attempts to send UDP traffic on the rsh port. Domain to not audit. Receive UDP traffic on the rsh port. Domain allowed access. Do not audit attempts to receive UDP traffic on the rsh port. Domain to not audit. Send and receive UDP traffic on the rsh port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the rsh port. Domain to not audit. Bind TCP sockets to the rsh port. Domain allowed access. Bind UDP sockets to the rsh port. Domain allowed access. Make a TCP connection to the rsh port. Domain allowed access. Send rsh_client packets. Domain allowed access. Do not audit attempts to send rsh_client packets. Domain to not audit. Receive rsh_client packets. Domain allowed access. Do not audit attempts to receive rsh_client packets. Domain allowed access. Send and receive rsh_client packets. Domain allowed access. Do not audit attempts to send and receive rsh_client packets. Domain to not audit. Relabel packets to rsh_client the packet type. Domain allowed access. Send rsh_server packets. Domain allowed access. Do not audit attempts to send rsh_server packets. Domain to not audit. Receive rsh_server packets. Domain allowed access. Do not audit attempts to receive rsh_server packets. Domain allowed access. Send and receive rsh_server packets. Domain allowed access. Do not audit attempts to send and receive rsh_server packets. Domain to not audit. Relabel packets to rsh_server the packet type. Domain allowed access. Send and receive TCP traffic on the rsync port. Domain allowed access. Send UDP traffic on the rsync port. Domain allowed access. Do not audit attempts to send UDP traffic on the rsync port. Domain to not audit. Receive UDP traffic on the rsync port. Domain allowed access. Do not audit attempts to receive UDP traffic on the rsync port. Domain to not audit. Send and receive UDP traffic on the rsync port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the rsync port. Domain to not audit. Bind TCP sockets to the rsync port. Domain allowed access. Bind UDP sockets to the rsync port. Domain allowed access. Make a TCP connection to the rsync port. Domain allowed access. Send rsync_client packets. Domain allowed access. Do not audit attempts to send rsync_client packets. Domain to not audit. Receive rsync_client packets. Domain allowed access. Do not audit attempts to receive rsync_client packets. Domain allowed access. Send and receive rsync_client packets. Domain allowed access. Do not audit attempts to send and receive rsync_client packets. Domain to not audit. Relabel packets to rsync_client the packet type. Domain allowed access. Send rsync_server packets. Domain allowed access. Do not audit attempts to send rsync_server packets. Domain to not audit. Receive rsync_server packets. Domain allowed access. Do not audit attempts to receive rsync_server packets. Domain allowed access. Send and receive rsync_server packets. Domain allowed access. Do not audit attempts to send and receive rsync_server packets. Domain to not audit. Relabel packets to rsync_server the packet type. Domain allowed access. Send and receive TCP traffic on the rtsp port. Domain allowed access. Send UDP traffic on the rtsp port. Domain allowed access. Do not audit attempts to send UDP traffic on the rtsp port. Domain to not audit. Receive UDP traffic on the rtsp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the rtsp port. Domain to not audit. Send and receive UDP traffic on the rtsp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the rtsp port. Domain to not audit. Bind TCP sockets to the rtsp port. Domain allowed access. Bind UDP sockets to the rtsp port. Domain allowed access. Make a TCP connection to the rtsp port. Domain allowed access. Send rtsp_client packets. Domain allowed access. Do not audit attempts to send rtsp_client packets. Domain to not audit. Receive rtsp_client packets. Domain allowed access. Do not audit attempts to receive rtsp_client packets. Domain allowed access. Send and receive rtsp_client packets. Domain allowed access. Do not audit attempts to send and receive rtsp_client packets. Domain to not audit. Relabel packets to rtsp_client the packet type. Domain allowed access. Send rtsp_server packets. Domain allowed access. Do not audit attempts to send rtsp_server packets. Domain to not audit. Receive rtsp_server packets. Domain allowed access. Do not audit attempts to receive rtsp_server packets. Domain allowed access. Send and receive rtsp_server packets. Domain allowed access. Do not audit attempts to send and receive rtsp_server packets. Domain to not audit. Relabel packets to rtsp_server the packet type. Domain allowed access. Send and receive TCP traffic on the rwho port. Domain allowed access. Send UDP traffic on the rwho port. Domain allowed access. Do not audit attempts to send UDP traffic on the rwho port. Domain to not audit. Receive UDP traffic on the rwho port. Domain allowed access. Do not audit attempts to receive UDP traffic on the rwho port. Domain to not audit. Send and receive UDP traffic on the rwho port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the rwho port. Domain to not audit. Bind TCP sockets to the rwho port. Domain allowed access. Bind UDP sockets to the rwho port. Domain allowed access. Make a TCP connection to the rwho port. Domain allowed access. Send rwho_client packets. Domain allowed access. Do not audit attempts to send rwho_client packets. Domain to not audit. Receive rwho_client packets. Domain allowed access. Do not audit attempts to receive rwho_client packets. Domain allowed access. Send and receive rwho_client packets. Domain allowed access. Do not audit attempts to send and receive rwho_client packets. Domain to not audit. Relabel packets to rwho_client the packet type. Domain allowed access. Send rwho_server packets. Domain allowed access. Do not audit attempts to send rwho_server packets. Domain to not audit. Receive rwho_server packets. Domain allowed access. Do not audit attempts to receive rwho_server packets. Domain allowed access. Send and receive rwho_server packets. Domain allowed access. Do not audit attempts to send and receive rwho_server packets. Domain to not audit. Relabel packets to rwho_server the packet type. Domain allowed access. Send and receive TCP traffic on the sap port. Domain allowed access. Send UDP traffic on the sap port. Domain allowed access. Do not audit attempts to send UDP traffic on the sap port. Domain to not audit. Receive UDP traffic on the sap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the sap port. Domain to not audit. Send and receive UDP traffic on the sap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the sap port. Domain to not audit. Bind TCP sockets to the sap port. Domain allowed access. Bind UDP sockets to the sap port. Domain allowed access. Make a TCP connection to the sap port. Domain allowed access. Send sap_client packets. Domain allowed access. Do not audit attempts to send sap_client packets. Domain to not audit. Receive sap_client packets. Domain allowed access. Do not audit attempts to receive sap_client packets. Domain allowed access. Send and receive sap_client packets. Domain allowed access. Do not audit attempts to send and receive sap_client packets. Domain to not audit. Relabel packets to sap_client the packet type. Domain allowed access. Send sap_server packets. Domain allowed access. Do not audit attempts to send sap_server packets. Domain to not audit. Receive sap_server packets. Domain allowed access. Do not audit attempts to receive sap_server packets. Domain allowed access. Send and receive sap_server packets. Domain allowed access. Do not audit attempts to send and receive sap_server packets. Domain to not audit. Relabel packets to sap_server the packet type. Domain allowed access. Send and receive TCP traffic on the servistaitsm port. Domain allowed access. Send UDP traffic on the servistaitsm port. Domain allowed access. Do not audit attempts to send UDP traffic on the servistaitsm port. Domain to not audit. Receive UDP traffic on the servistaitsm port. Domain allowed access. Do not audit attempts to receive UDP traffic on the servistaitsm port. Domain to not audit. Send and receive UDP traffic on the servistaitsm port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the servistaitsm port. Domain to not audit. Bind TCP sockets to the servistaitsm port. Domain allowed access. Bind UDP sockets to the servistaitsm port. Domain allowed access. Make a TCP connection to the servistaitsm port. Domain allowed access. Send servistaitsm_client packets. Domain allowed access. Do not audit attempts to send servistaitsm_client packets. Domain to not audit. Receive servistaitsm_client packets. Domain allowed access. Do not audit attempts to receive servistaitsm_client packets. Domain allowed access. Send and receive servistaitsm_client packets. Domain allowed access. Do not audit attempts to send and receive servistaitsm_client packets. Domain to not audit. Relabel packets to servistaitsm_client the packet type. Domain allowed access. Send servistaitsm_server packets. Domain allowed access. Do not audit attempts to send servistaitsm_server packets. Domain to not audit. Receive servistaitsm_server packets. Domain allowed access. Do not audit attempts to receive servistaitsm_server packets. Domain allowed access. Send and receive servistaitsm_server packets. Domain allowed access. Do not audit attempts to send and receive servistaitsm_server packets. Domain to not audit. Relabel packets to servistaitsm_server the packet type. Domain allowed access. Send and receive TCP traffic on the sieve port. Domain allowed access. Send UDP traffic on the sieve port. Domain allowed access. Do not audit attempts to send UDP traffic on the sieve port. Domain to not audit. Receive UDP traffic on the sieve port. Domain allowed access. Do not audit attempts to receive UDP traffic on the sieve port. Domain to not audit. Send and receive UDP traffic on the sieve port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the sieve port. Domain to not audit. Bind TCP sockets to the sieve port. Domain allowed access. Bind UDP sockets to the sieve port. Domain allowed access. Make a TCP connection to the sieve port. Domain allowed access. Send sieve_client packets. Domain allowed access. Do not audit attempts to send sieve_client packets. Domain to not audit. Receive sieve_client packets. Domain allowed access. Do not audit attempts to receive sieve_client packets. Domain allowed access. Send and receive sieve_client packets. Domain allowed access. Do not audit attempts to send and receive sieve_client packets. Domain to not audit. Relabel packets to sieve_client the packet type. Domain allowed access. Send sieve_server packets. Domain allowed access. Do not audit attempts to send sieve_server packets. Domain to not audit. Receive sieve_server packets. Domain allowed access. Do not audit attempts to receive sieve_server packets. Domain allowed access. Send and receive sieve_server packets. Domain allowed access. Do not audit attempts to send and receive sieve_server packets. Domain to not audit. Relabel packets to sieve_server the packet type. Domain allowed access. Send and receive TCP traffic on the sip port. Domain allowed access. Send UDP traffic on the sip port. Domain allowed access. Do not audit attempts to send UDP traffic on the sip port. Domain to not audit. Receive UDP traffic on the sip port. Domain allowed access. Do not audit attempts to receive UDP traffic on the sip port. Domain to not audit. Send and receive UDP traffic on the sip port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the sip port. Domain to not audit. Bind TCP sockets to the sip port. Domain allowed access. Bind UDP sockets to the sip port. Domain allowed access. Make a TCP connection to the sip port. Domain allowed access. Send sip_client packets. Domain allowed access. Do not audit attempts to send sip_client packets. Domain to not audit. Receive sip_client packets. Domain allowed access. Do not audit attempts to receive sip_client packets. Domain allowed access. Send and receive sip_client packets. Domain allowed access. Do not audit attempts to send and receive sip_client packets. Domain to not audit. Relabel packets to sip_client the packet type. Domain allowed access. Send sip_server packets. Domain allowed access. Do not audit attempts to send sip_server packets. Domain to not audit. Receive sip_server packets. Domain allowed access. Do not audit attempts to receive sip_server packets. Domain allowed access. Send and receive sip_server packets. Domain allowed access. Do not audit attempts to send and receive sip_server packets. Domain to not audit. Relabel packets to sip_server the packet type. Domain allowed access. Send and receive TCP traffic on the sixxsconfig port. Domain allowed access. Send UDP traffic on the sixxsconfig port. Domain allowed access. Do not audit attempts to send UDP traffic on the sixxsconfig port. Domain to not audit. Receive UDP traffic on the sixxsconfig port. Domain allowed access. Do not audit attempts to receive UDP traffic on the sixxsconfig port. Domain to not audit. Send and receive UDP traffic on the sixxsconfig port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the sixxsconfig port. Domain to not audit. Bind TCP sockets to the sixxsconfig port. Domain allowed access. Bind UDP sockets to the sixxsconfig port. Domain allowed access. Make a TCP connection to the sixxsconfig port. Domain allowed access. Send sixxsconfig_client packets. Domain allowed access. Do not audit attempts to send sixxsconfig_client packets. Domain to not audit. Receive sixxsconfig_client packets. Domain allowed access. Do not audit attempts to receive sixxsconfig_client packets. Domain allowed access. Send and receive sixxsconfig_client packets. Domain allowed access. Do not audit attempts to send and receive sixxsconfig_client packets. Domain to not audit. Relabel packets to sixxsconfig_client the packet type. Domain allowed access. Send sixxsconfig_server packets. Domain allowed access. Do not audit attempts to send sixxsconfig_server packets. Domain to not audit. Receive sixxsconfig_server packets. Domain allowed access. Do not audit attempts to receive sixxsconfig_server packets. Domain allowed access. Send and receive sixxsconfig_server packets. Domain allowed access. Do not audit attempts to send and receive sixxsconfig_server packets. Domain to not audit. Relabel packets to sixxsconfig_server the packet type. Domain allowed access. Send and receive TCP traffic on the smbd port. Domain allowed access. Send UDP traffic on the smbd port. Domain allowed access. Do not audit attempts to send UDP traffic on the smbd port. Domain to not audit. Receive UDP traffic on the smbd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the smbd port. Domain to not audit. Send and receive UDP traffic on the smbd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the smbd port. Domain to not audit. Bind TCP sockets to the smbd port. Domain allowed access. Bind UDP sockets to the smbd port. Domain allowed access. Make a TCP connection to the smbd port. Domain allowed access. Send smbd_client packets. Domain allowed access. Do not audit attempts to send smbd_client packets. Domain to not audit. Receive smbd_client packets. Domain allowed access. Do not audit attempts to receive smbd_client packets. Domain allowed access. Send and receive smbd_client packets. Domain allowed access. Do not audit attempts to send and receive smbd_client packets. Domain to not audit. Relabel packets to smbd_client the packet type. Domain allowed access. Send smbd_server packets. Domain allowed access. Do not audit attempts to send smbd_server packets. Domain to not audit. Receive smbd_server packets. Domain allowed access. Do not audit attempts to receive smbd_server packets. Domain allowed access. Send and receive smbd_server packets. Domain allowed access. Do not audit attempts to send and receive smbd_server packets. Domain to not audit. Relabel packets to smbd_server the packet type. Domain allowed access. Send and receive TCP traffic on the smtp port. Domain allowed access. Send UDP traffic on the smtp port. Domain allowed access. Do not audit attempts to send UDP traffic on the smtp port. Domain to not audit. Receive UDP traffic on the smtp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the smtp port. Domain to not audit. Send and receive UDP traffic on the smtp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the smtp port. Domain to not audit. Bind TCP sockets to the smtp port. Domain allowed access. Bind UDP sockets to the smtp port. Domain allowed access. Make a TCP connection to the smtp port. Domain allowed access. Send smtp_client packets. Domain allowed access. Do not audit attempts to send smtp_client packets. Domain to not audit. Receive smtp_client packets. Domain allowed access. Do not audit attempts to receive smtp_client packets. Domain allowed access. Send and receive smtp_client packets. Domain allowed access. Do not audit attempts to send and receive smtp_client packets. Domain to not audit. Relabel packets to smtp_client the packet type. Domain allowed access. Send smtp_server packets. Domain allowed access. Do not audit attempts to send smtp_server packets. Domain to not audit. Receive smtp_server packets. Domain allowed access. Do not audit attempts to receive smtp_server packets. Domain allowed access. Send and receive smtp_server packets. Domain allowed access. Do not audit attempts to send and receive smtp_server packets. Domain to not audit. Relabel packets to smtp_server the packet type. Domain allowed access. Send and receive TCP traffic on the snmp port. Domain allowed access. Send UDP traffic on the snmp port. Domain allowed access. Do not audit attempts to send UDP traffic on the snmp port. Domain to not audit. Receive UDP traffic on the snmp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the snmp port. Domain to not audit. Send and receive UDP traffic on the snmp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the snmp port. Domain to not audit. Bind TCP sockets to the snmp port. Domain allowed access. Bind UDP sockets to the snmp port. Domain allowed access. Make a TCP connection to the snmp port. Domain allowed access. Send snmp_client packets. Domain allowed access. Do not audit attempts to send snmp_client packets. Domain to not audit. Receive snmp_client packets. Domain allowed access. Do not audit attempts to receive snmp_client packets. Domain allowed access. Send and receive snmp_client packets. Domain allowed access. Do not audit attempts to send and receive snmp_client packets. Domain to not audit. Relabel packets to snmp_client the packet type. Domain allowed access. Send snmp_server packets. Domain allowed access. Do not audit attempts to send snmp_server packets. Domain to not audit. Receive snmp_server packets. Domain allowed access. Do not audit attempts to receive snmp_server packets. Domain allowed access. Send and receive snmp_server packets. Domain allowed access. Do not audit attempts to send and receive snmp_server packets. Domain to not audit. Relabel packets to snmp_server the packet type. Domain allowed access. Send and receive TCP traffic on the socks port. Domain allowed access. Send UDP traffic on the socks port. Domain allowed access. Do not audit attempts to send UDP traffic on the socks port. Domain to not audit. Receive UDP traffic on the socks port. Domain allowed access. Do not audit attempts to receive UDP traffic on the socks port. Domain to not audit. Send and receive UDP traffic on the socks port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the socks port. Domain to not audit. Bind TCP sockets to the socks port. Domain allowed access. Bind UDP sockets to the socks port. Domain allowed access. Make a TCP connection to the socks port. Domain allowed access. Send socks_client packets. Domain allowed access. Do not audit attempts to send socks_client packets. Domain to not audit. Receive socks_client packets. Domain allowed access. Do not audit attempts to receive socks_client packets. Domain allowed access. Send and receive socks_client packets. Domain allowed access. Do not audit attempts to send and receive socks_client packets. Domain to not audit. Relabel packets to socks_client the packet type. Domain allowed access. Send socks_server packets. Domain allowed access. Do not audit attempts to send socks_server packets. Domain to not audit. Receive socks_server packets. Domain allowed access. Do not audit attempts to receive socks_server packets. Domain allowed access. Send and receive socks_server packets. Domain allowed access. Do not audit attempts to send and receive socks_server packets. Domain to not audit. Relabel packets to socks_server the packet type. Domain allowed access. Send and receive TCP traffic on the soundd port. Domain allowed access. Send UDP traffic on the soundd port. Domain allowed access. Do not audit attempts to send UDP traffic on the soundd port. Domain to not audit. Receive UDP traffic on the soundd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the soundd port. Domain to not audit. Send and receive UDP traffic on the soundd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the soundd port. Domain to not audit. Bind TCP sockets to the soundd port. Domain allowed access. Bind UDP sockets to the soundd port. Domain allowed access. Make a TCP connection to the soundd port. Domain allowed access. Send soundd_client packets. Domain allowed access. Do not audit attempts to send soundd_client packets. Domain to not audit. Receive soundd_client packets. Domain allowed access. Do not audit attempts to receive soundd_client packets. Domain allowed access. Send and receive soundd_client packets. Domain allowed access. Do not audit attempts to send and receive soundd_client packets. Domain to not audit. Relabel packets to soundd_client the packet type. Domain allowed access. Send soundd_server packets. Domain allowed access. Do not audit attempts to send soundd_server packets. Domain to not audit. Receive soundd_server packets. Domain allowed access. Do not audit attempts to receive soundd_server packets. Domain allowed access. Send and receive soundd_server packets. Domain allowed access. Do not audit attempts to send and receive soundd_server packets. Domain to not audit. Relabel packets to soundd_server the packet type. Domain allowed access. Send and receive TCP traffic on the spamd port. Domain allowed access. Send UDP traffic on the spamd port. Domain allowed access. Do not audit attempts to send UDP traffic on the spamd port. Domain to not audit. Receive UDP traffic on the spamd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the spamd port. Domain to not audit. Send and receive UDP traffic on the spamd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the spamd port. Domain to not audit. Bind TCP sockets to the spamd port. Domain allowed access. Bind UDP sockets to the spamd port. Domain allowed access. Make a TCP connection to the spamd port. Domain allowed access. Send spamd_client packets. Domain allowed access. Do not audit attempts to send spamd_client packets. Domain to not audit. Receive spamd_client packets. Domain allowed access. Do not audit attempts to receive spamd_client packets. Domain allowed access. Send and receive spamd_client packets. Domain allowed access. Do not audit attempts to send and receive spamd_client packets. Domain to not audit. Relabel packets to spamd_client the packet type. Domain allowed access. Send spamd_server packets. Domain allowed access. Do not audit attempts to send spamd_server packets. Domain to not audit. Receive spamd_server packets. Domain allowed access. Do not audit attempts to receive spamd_server packets. Domain allowed access. Send and receive spamd_server packets. Domain allowed access. Do not audit attempts to send and receive spamd_server packets. Domain to not audit. Relabel packets to spamd_server the packet type. Domain allowed access. Send and receive TCP traffic on the speech port. Domain allowed access. Send UDP traffic on the speech port. Domain allowed access. Do not audit attempts to send UDP traffic on the speech port. Domain to not audit. Receive UDP traffic on the speech port. Domain allowed access. Do not audit attempts to receive UDP traffic on the speech port. Domain to not audit. Send and receive UDP traffic on the speech port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the speech port. Domain to not audit. Bind TCP sockets to the speech port. Domain allowed access. Bind UDP sockets to the speech port. Domain allowed access. Make a TCP connection to the speech port. Domain allowed access. Send speech_client packets. Domain allowed access. Do not audit attempts to send speech_client packets. Domain to not audit. Receive speech_client packets. Domain allowed access. Do not audit attempts to receive speech_client packets. Domain allowed access. Send and receive speech_client packets. Domain allowed access. Do not audit attempts to send and receive speech_client packets. Domain to not audit. Relabel packets to speech_client the packet type. Domain allowed access. Send speech_server packets. Domain allowed access. Do not audit attempts to send speech_server packets. Domain to not audit. Receive speech_server packets. Domain allowed access. Do not audit attempts to receive speech_server packets. Domain allowed access. Send and receive speech_server packets. Domain allowed access. Do not audit attempts to send and receive speech_server packets. Domain to not audit. Relabel packets to speech_server the packet type. Domain allowed access. Send and receive TCP traffic on the squid port. Domain allowed access. Send UDP traffic on the squid port. Domain allowed access. Do not audit attempts to send UDP traffic on the squid port. Domain to not audit. Receive UDP traffic on the squid port. Domain allowed access. Do not audit attempts to receive UDP traffic on the squid port. Domain to not audit. Send and receive UDP traffic on the squid port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the squid port. Domain to not audit. Bind TCP sockets to the squid port. Domain allowed access. Bind UDP sockets to the squid port. Domain allowed access. Make a TCP connection to the squid port. Domain allowed access. Send squid_client packets. Domain allowed access. Do not audit attempts to send squid_client packets. Domain to not audit. Receive squid_client packets. Domain allowed access. Do not audit attempts to receive squid_client packets. Domain allowed access. Send and receive squid_client packets. Domain allowed access. Do not audit attempts to send and receive squid_client packets. Domain to not audit. Relabel packets to squid_client the packet type. Domain allowed access. Send squid_server packets. Domain allowed access. Do not audit attempts to send squid_server packets. Domain to not audit. Receive squid_server packets. Domain allowed access. Do not audit attempts to receive squid_server packets. Domain allowed access. Send and receive squid_server packets. Domain allowed access. Do not audit attempts to send and receive squid_server packets. Domain to not audit. Relabel packets to squid_server the packet type. Domain allowed access. Send and receive TCP traffic on the ssdp port. Domain allowed access. Send UDP traffic on the ssdp port. Domain allowed access. Do not audit attempts to send UDP traffic on the ssdp port. Domain to not audit. Receive UDP traffic on the ssdp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ssdp port. Domain to not audit. Send and receive UDP traffic on the ssdp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ssdp port. Domain to not audit. Bind TCP sockets to the ssdp port. Domain allowed access. Bind UDP sockets to the ssdp port. Domain allowed access. Make a TCP connection to the ssdp port. Domain allowed access. Send ssdp_client packets. Domain allowed access. Do not audit attempts to send ssdp_client packets. Domain to not audit. Receive ssdp_client packets. Domain allowed access. Do not audit attempts to receive ssdp_client packets. Domain allowed access. Send and receive ssdp_client packets. Domain allowed access. Do not audit attempts to send and receive ssdp_client packets. Domain to not audit. Relabel packets to ssdp_client the packet type. Domain allowed access. Send ssdp_server packets. Domain allowed access. Do not audit attempts to send ssdp_server packets. Domain to not audit. Receive ssdp_server packets. Domain allowed access. Do not audit attempts to receive ssdp_server packets. Domain allowed access. Send and receive ssdp_server packets. Domain allowed access. Do not audit attempts to send and receive ssdp_server packets. Domain to not audit. Relabel packets to ssdp_server the packet type. Domain allowed access. Send and receive TCP traffic on the ssh port. Domain allowed access. Send UDP traffic on the ssh port. Domain allowed access. Do not audit attempts to send UDP traffic on the ssh port. Domain to not audit. Receive UDP traffic on the ssh port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ssh port. Domain to not audit. Send and receive UDP traffic on the ssh port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ssh port. Domain to not audit. Bind TCP sockets to the ssh port. Domain allowed access. Bind UDP sockets to the ssh port. Domain allowed access. Make a TCP connection to the ssh port. Domain allowed access. Send ssh_client packets. Domain allowed access. Do not audit attempts to send ssh_client packets. Domain to not audit. Receive ssh_client packets. Domain allowed access. Do not audit attempts to receive ssh_client packets. Domain allowed access. Send and receive ssh_client packets. Domain allowed access. Do not audit attempts to send and receive ssh_client packets. Domain to not audit. Relabel packets to ssh_client the packet type. Domain allowed access. Send ssh_server packets. Domain allowed access. Do not audit attempts to send ssh_server packets. Domain to not audit. Receive ssh_server packets. Domain allowed access. Do not audit attempts to receive ssh_server packets. Domain allowed access. Send and receive ssh_server packets. Domain allowed access. Do not audit attempts to send and receive ssh_server packets. Domain to not audit. Relabel packets to ssh_server the packet type. Domain allowed access. Send and receive TCP traffic on the stunnel port. Domain allowed access. Send UDP traffic on the stunnel port. Domain allowed access. Do not audit attempts to send UDP traffic on the stunnel port. Domain to not audit. Receive UDP traffic on the stunnel port. Domain allowed access. Do not audit attempts to receive UDP traffic on the stunnel port. Domain to not audit. Send and receive UDP traffic on the stunnel port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the stunnel port. Domain to not audit. Bind TCP sockets to the stunnel port. Domain allowed access. Bind UDP sockets to the stunnel port. Domain allowed access. Make a TCP connection to the stunnel port. Domain allowed access. Send stunnel_client packets. Domain allowed access. Do not audit attempts to send stunnel_client packets. Domain to not audit. Receive stunnel_client packets. Domain allowed access. Do not audit attempts to receive stunnel_client packets. Domain allowed access. Send and receive stunnel_client packets. Domain allowed access. Do not audit attempts to send and receive stunnel_client packets. Domain to not audit. Relabel packets to stunnel_client the packet type. Domain allowed access. Send stunnel_server packets. Domain allowed access. Do not audit attempts to send stunnel_server packets. Domain to not audit. Receive stunnel_server packets. Domain allowed access. Do not audit attempts to receive stunnel_server packets. Domain allowed access. Send and receive stunnel_server packets. Domain allowed access. Do not audit attempts to send and receive stunnel_server packets. Domain to not audit. Relabel packets to stunnel_server the packet type. Domain allowed access. Send and receive TCP traffic on the svn port. Domain allowed access. Send UDP traffic on the svn port. Domain allowed access. Do not audit attempts to send UDP traffic on the svn port. Domain to not audit. Receive UDP traffic on the svn port. Domain allowed access. Do not audit attempts to receive UDP traffic on the svn port. Domain to not audit. Send and receive UDP traffic on the svn port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the svn port. Domain to not audit. Bind TCP sockets to the svn port. Domain allowed access. Bind UDP sockets to the svn port. Domain allowed access. Make a TCP connection to the svn port. Domain allowed access. Send svn_client packets. Domain allowed access. Do not audit attempts to send svn_client packets. Domain to not audit. Receive svn_client packets. Domain allowed access. Do not audit attempts to receive svn_client packets. Domain allowed access. Send and receive svn_client packets. Domain allowed access. Do not audit attempts to send and receive svn_client packets. Domain to not audit. Relabel packets to svn_client the packet type. Domain allowed access. Send svn_server packets. Domain allowed access. Do not audit attempts to send svn_server packets. Domain to not audit. Receive svn_server packets. Domain allowed access. Do not audit attempts to receive svn_server packets. Domain allowed access. Send and receive svn_server packets. Domain allowed access. Do not audit attempts to send and receive svn_server packets. Domain to not audit. Relabel packets to svn_server the packet type. Domain allowed access. Send and receive TCP traffic on the svrloc port. Domain allowed access. Send UDP traffic on the svrloc port. Domain allowed access. Do not audit attempts to send UDP traffic on the svrloc port. Domain to not audit. Receive UDP traffic on the svrloc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the svrloc port. Domain to not audit. Send and receive UDP traffic on the svrloc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the svrloc port. Domain to not audit. Bind TCP sockets to the svrloc port. Domain allowed access. Bind UDP sockets to the svrloc port. Domain allowed access. Make a TCP connection to the svrloc port. Domain allowed access. Send svrloc_client packets. Domain allowed access. Do not audit attempts to send svrloc_client packets. Domain to not audit. Receive svrloc_client packets. Domain allowed access. Do not audit attempts to receive svrloc_client packets. Domain allowed access. Send and receive svrloc_client packets. Domain allowed access. Do not audit attempts to send and receive svrloc_client packets. Domain to not audit. Relabel packets to svrloc_client the packet type. Domain allowed access. Send svrloc_server packets. Domain allowed access. Do not audit attempts to send svrloc_server packets. Domain to not audit. Receive svrloc_server packets. Domain allowed access. Do not audit attempts to receive svrloc_server packets. Domain allowed access. Send and receive svrloc_server packets. Domain allowed access. Do not audit attempts to send and receive svrloc_server packets. Domain to not audit. Relabel packets to svrloc_server the packet type. Domain allowed access. Send and receive TCP traffic on the swat port. Domain allowed access. Send UDP traffic on the swat port. Domain allowed access. Do not audit attempts to send UDP traffic on the swat port. Domain to not audit. Receive UDP traffic on the swat port. Domain allowed access. Do not audit attempts to receive UDP traffic on the swat port. Domain to not audit. Send and receive UDP traffic on the swat port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the swat port. Domain to not audit. Bind TCP sockets to the swat port. Domain allowed access. Bind UDP sockets to the swat port. Domain allowed access. Make a TCP connection to the swat port. Domain allowed access. Send swat_client packets. Domain allowed access. Do not audit attempts to send swat_client packets. Domain to not audit. Receive swat_client packets. Domain allowed access. Do not audit attempts to receive swat_client packets. Domain allowed access. Send and receive swat_client packets. Domain allowed access. Do not audit attempts to send and receive swat_client packets. Domain to not audit. Relabel packets to swat_client the packet type. Domain allowed access. Send swat_server packets. Domain allowed access. Do not audit attempts to send swat_server packets. Domain to not audit. Receive swat_server packets. Domain allowed access. Do not audit attempts to receive swat_server packets. Domain allowed access. Send and receive swat_server packets. Domain allowed access. Do not audit attempts to send and receive swat_server packets. Domain to not audit. Relabel packets to swat_server the packet type. Domain allowed access. Send and receive TCP traffic on the syncthing port. Domain allowed access. Send UDP traffic on the syncthing port. Domain allowed access. Do not audit attempts to send UDP traffic on the syncthing port. Domain to not audit. Receive UDP traffic on the syncthing port. Domain allowed access. Do not audit attempts to receive UDP traffic on the syncthing port. Domain to not audit. Send and receive UDP traffic on the syncthing port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the syncthing port. Domain to not audit. Bind TCP sockets to the syncthing port. Domain allowed access. Bind UDP sockets to the syncthing port. Domain allowed access. Make a TCP connection to the syncthing port. Domain allowed access. Send syncthing_client packets. Domain allowed access. Do not audit attempts to send syncthing_client packets. Domain to not audit. Receive syncthing_client packets. Domain allowed access. Do not audit attempts to receive syncthing_client packets. Domain allowed access. Send and receive syncthing_client packets. Domain allowed access. Do not audit attempts to send and receive syncthing_client packets. Domain to not audit. Relabel packets to syncthing_client the packet type. Domain allowed access. Send syncthing_server packets. Domain allowed access. Do not audit attempts to send syncthing_server packets. Domain to not audit. Receive syncthing_server packets. Domain allowed access. Do not audit attempts to receive syncthing_server packets. Domain allowed access. Send and receive syncthing_server packets. Domain allowed access. Do not audit attempts to send and receive syncthing_server packets. Domain to not audit. Relabel packets to syncthing_server the packet type. Domain allowed access. Send and receive TCP traffic on the syncthing_admin port. Domain allowed access. Send UDP traffic on the syncthing_admin port. Domain allowed access. Do not audit attempts to send UDP traffic on the syncthing_admin port. Domain to not audit. Receive UDP traffic on the syncthing_admin port. Domain allowed access. Do not audit attempts to receive UDP traffic on the syncthing_admin port. Domain to not audit. Send and receive UDP traffic on the syncthing_admin port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the syncthing_admin port. Domain to not audit. Bind TCP sockets to the syncthing_admin port. Domain allowed access. Bind UDP sockets to the syncthing_admin port. Domain allowed access. Make a TCP connection to the syncthing_admin port. Domain allowed access. Send syncthing_admin_client packets. Domain allowed access. Do not audit attempts to send syncthing_admin_client packets. Domain to not audit. Receive syncthing_admin_client packets. Domain allowed access. Do not audit attempts to receive syncthing_admin_client packets. Domain allowed access. Send and receive syncthing_admin_client packets. Domain allowed access. Do not audit attempts to send and receive syncthing_admin_client packets. Domain to not audit. Relabel packets to syncthing_admin_client the packet type. Domain allowed access. Send syncthing_admin_server packets. Domain allowed access. Do not audit attempts to send syncthing_admin_server packets. Domain to not audit. Receive syncthing_admin_server packets. Domain allowed access. Do not audit attempts to receive syncthing_admin_server packets. Domain allowed access. Send and receive syncthing_admin_server packets. Domain allowed access. Do not audit attempts to send and receive syncthing_admin_server packets. Domain to not audit. Relabel packets to syncthing_admin_server the packet type. Domain allowed access. Send and receive TCP traffic on the syncthing_discovery port. Domain allowed access. Send UDP traffic on the syncthing_discovery port. Domain allowed access. Do not audit attempts to send UDP traffic on the syncthing_discovery port. Domain to not audit. Receive UDP traffic on the syncthing_discovery port. Domain allowed access. Do not audit attempts to receive UDP traffic on the syncthing_discovery port. Domain to not audit. Send and receive UDP traffic on the syncthing_discovery port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the syncthing_discovery port. Domain to not audit. Bind TCP sockets to the syncthing_discovery port. Domain allowed access. Bind UDP sockets to the syncthing_discovery port. Domain allowed access. Make a TCP connection to the syncthing_discovery port. Domain allowed access. Send syncthing_discovery_client packets. Domain allowed access. Do not audit attempts to send syncthing_discovery_client packets. Domain to not audit. Receive syncthing_discovery_client packets. Domain allowed access. Do not audit attempts to receive syncthing_discovery_client packets. Domain allowed access. Send and receive syncthing_discovery_client packets. Domain allowed access. Do not audit attempts to send and receive syncthing_discovery_client packets. Domain to not audit. Relabel packets to syncthing_discovery_client the packet type. Domain allowed access. Send syncthing_discovery_server packets. Domain allowed access. Do not audit attempts to send syncthing_discovery_server packets. Domain to not audit. Receive syncthing_discovery_server packets. Domain allowed access. Do not audit attempts to receive syncthing_discovery_server packets. Domain allowed access. Send and receive syncthing_discovery_server packets. Domain allowed access. Do not audit attempts to send and receive syncthing_discovery_server packets. Domain to not audit. Relabel packets to syncthing_discovery_server the packet type. Domain allowed access. Send and receive TCP traffic on the sype_transport port. Domain allowed access. Send UDP traffic on the sype_transport port. Domain allowed access. Do not audit attempts to send UDP traffic on the sype_transport port. Domain to not audit. Receive UDP traffic on the sype_transport port. Domain allowed access. Do not audit attempts to receive UDP traffic on the sype_transport port. Domain to not audit. Send and receive UDP traffic on the sype_transport port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the sype_transport port. Domain to not audit. Bind TCP sockets to the sype_transport port. Domain allowed access. Bind UDP sockets to the sype_transport port. Domain allowed access. Make a TCP connection to the sype_transport port. Domain allowed access. Send sype_transport_client packets. Domain allowed access. Do not audit attempts to send sype_transport_client packets. Domain to not audit. Receive sype_transport_client packets. Domain allowed access. Do not audit attempts to receive sype_transport_client packets. Domain allowed access. Send and receive sype_transport_client packets. Domain allowed access. Do not audit attempts to send and receive sype_transport_client packets. Domain to not audit. Relabel packets to sype_transport_client the packet type. Domain allowed access. Send sype_transport_server packets. Domain allowed access. Do not audit attempts to send sype_transport_server packets. Domain to not audit. Receive sype_transport_server packets. Domain allowed access. Do not audit attempts to receive sype_transport_server packets. Domain allowed access. Send and receive sype_transport_server packets. Domain allowed access. Do not audit attempts to send and receive sype_transport_server packets. Domain to not audit. Relabel packets to sype_transport_server the packet type. Domain allowed access. Send and receive TCP traffic on the syslogd port. Domain allowed access. Send UDP traffic on the syslogd port. Domain allowed access. Do not audit attempts to send UDP traffic on the syslogd port. Domain to not audit. Receive UDP traffic on the syslogd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the syslogd port. Domain to not audit. Send and receive UDP traffic on the syslogd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the syslogd port. Domain to not audit. Bind TCP sockets to the syslogd port. Domain allowed access. Bind UDP sockets to the syslogd port. Domain allowed access. Make a TCP connection to the syslogd port. Domain allowed access. Send syslogd_client packets. Domain allowed access. Do not audit attempts to send syslogd_client packets. Domain to not audit. Receive syslogd_client packets. Domain allowed access. Do not audit attempts to receive syslogd_client packets. Domain allowed access. Send and receive syslogd_client packets. Domain allowed access. Do not audit attempts to send and receive syslogd_client packets. Domain to not audit. Relabel packets to syslogd_client the packet type. Domain allowed access. Send syslogd_server packets. Domain allowed access. Do not audit attempts to send syslogd_server packets. Domain to not audit. Receive syslogd_server packets. Domain allowed access. Do not audit attempts to receive syslogd_server packets. Domain allowed access. Send and receive syslogd_server packets. Domain allowed access. Do not audit attempts to send and receive syslogd_server packets. Domain to not audit. Relabel packets to syslogd_server the packet type. Domain allowed access. Send and receive TCP traffic on the syslog_tls port. Domain allowed access. Send UDP traffic on the syslog_tls port. Domain allowed access. Do not audit attempts to send UDP traffic on the syslog_tls port. Domain to not audit. Receive UDP traffic on the syslog_tls port. Domain allowed access. Do not audit attempts to receive UDP traffic on the syslog_tls port. Domain to not audit. Send and receive UDP traffic on the syslog_tls port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the syslog_tls port. Domain to not audit. Bind TCP sockets to the syslog_tls port. Domain allowed access. Bind UDP sockets to the syslog_tls port. Domain allowed access. Make a TCP connection to the syslog_tls port. Domain allowed access. Send syslog_tls_client packets. Domain allowed access. Do not audit attempts to send syslog_tls_client packets. Domain to not audit. Receive syslog_tls_client packets. Domain allowed access. Do not audit attempts to receive syslog_tls_client packets. Domain allowed access. Send and receive syslog_tls_client packets. Domain allowed access. Do not audit attempts to send and receive syslog_tls_client packets. Domain to not audit. Relabel packets to syslog_tls_client the packet type. Domain allowed access. Send syslog_tls_server packets. Domain allowed access. Do not audit attempts to send syslog_tls_server packets. Domain to not audit. Receive syslog_tls_server packets. Domain allowed access. Do not audit attempts to receive syslog_tls_server packets. Domain allowed access. Send and receive syslog_tls_server packets. Domain allowed access. Do not audit attempts to send and receive syslog_tls_server packets. Domain to not audit. Relabel packets to syslog_tls_server the packet type. Domain allowed access. Send and receive TCP traffic on the tcs port. Domain allowed access. Send UDP traffic on the tcs port. Domain allowed access. Do not audit attempts to send UDP traffic on the tcs port. Domain to not audit. Receive UDP traffic on the tcs port. Domain allowed access. Do not audit attempts to receive UDP traffic on the tcs port. Domain to not audit. Send and receive UDP traffic on the tcs port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the tcs port. Domain to not audit. Bind TCP sockets to the tcs port. Domain allowed access. Bind UDP sockets to the tcs port. Domain allowed access. Make a TCP connection to the tcs port. Domain allowed access. Send tcs_client packets. Domain allowed access. Do not audit attempts to send tcs_client packets. Domain to not audit. Receive tcs_client packets. Domain allowed access. Do not audit attempts to receive tcs_client packets. Domain allowed access. Send and receive tcs_client packets. Domain allowed access. Do not audit attempts to send and receive tcs_client packets. Domain to not audit. Relabel packets to tcs_client the packet type. Domain allowed access. Send tcs_server packets. Domain allowed access. Do not audit attempts to send tcs_server packets. Domain to not audit. Receive tcs_server packets. Domain allowed access. Do not audit attempts to receive tcs_server packets. Domain allowed access. Send and receive tcs_server packets. Domain allowed access. Do not audit attempts to send and receive tcs_server packets. Domain to not audit. Relabel packets to tcs_server the packet type. Domain allowed access. Send and receive TCP traffic on the telnetd port. Domain allowed access. Send UDP traffic on the telnetd port. Domain allowed access. Do not audit attempts to send UDP traffic on the telnetd port. Domain to not audit. Receive UDP traffic on the telnetd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the telnetd port. Domain to not audit. Send and receive UDP traffic on the telnetd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the telnetd port. Domain to not audit. Bind TCP sockets to the telnetd port. Domain allowed access. Bind UDP sockets to the telnetd port. Domain allowed access. Make a TCP connection to the telnetd port. Domain allowed access. Send telnetd_client packets. Domain allowed access. Do not audit attempts to send telnetd_client packets. Domain to not audit. Receive telnetd_client packets. Domain allowed access. Do not audit attempts to receive telnetd_client packets. Domain allowed access. Send and receive telnetd_client packets. Domain allowed access. Do not audit attempts to send and receive telnetd_client packets. Domain to not audit. Relabel packets to telnetd_client the packet type. Domain allowed access. Send telnetd_server packets. Domain allowed access. Do not audit attempts to send telnetd_server packets. Domain to not audit. Receive telnetd_server packets. Domain allowed access. Do not audit attempts to receive telnetd_server packets. Domain allowed access. Send and receive telnetd_server packets. Domain allowed access. Do not audit attempts to send and receive telnetd_server packets. Domain to not audit. Relabel packets to telnetd_server the packet type. Domain allowed access. Send and receive TCP traffic on the tftp port. Domain allowed access. Send UDP traffic on the tftp port. Domain allowed access. Do not audit attempts to send UDP traffic on the tftp port. Domain to not audit. Receive UDP traffic on the tftp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the tftp port. Domain to not audit. Send and receive UDP traffic on the tftp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the tftp port. Domain to not audit. Bind TCP sockets to the tftp port. Domain allowed access. Bind UDP sockets to the tftp port. Domain allowed access. Make a TCP connection to the tftp port. Domain allowed access. Send tftp_client packets. Domain allowed access. Do not audit attempts to send tftp_client packets. Domain to not audit. Receive tftp_client packets. Domain allowed access. Do not audit attempts to receive tftp_client packets. Domain allowed access. Send and receive tftp_client packets. Domain allowed access. Do not audit attempts to send and receive tftp_client packets. Domain to not audit. Relabel packets to tftp_client the packet type. Domain allowed access. Send tftp_server packets. Domain allowed access. Do not audit attempts to send tftp_server packets. Domain to not audit. Receive tftp_server packets. Domain allowed access. Do not audit attempts to receive tftp_server packets. Domain allowed access. Send and receive tftp_server packets. Domain allowed access. Do not audit attempts to send and receive tftp_server packets. Domain to not audit. Relabel packets to tftp_server the packet type. Domain allowed access. Send and receive TCP traffic on the tor port. Domain allowed access. Send UDP traffic on the tor port. Domain allowed access. Do not audit attempts to send UDP traffic on the tor port. Domain to not audit. Receive UDP traffic on the tor port. Domain allowed access. Do not audit attempts to receive UDP traffic on the tor port. Domain to not audit. Send and receive UDP traffic on the tor port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the tor port. Domain to not audit. Bind TCP sockets to the tor port. Domain allowed access. Bind UDP sockets to the tor port. Domain allowed access. Make a TCP connection to the tor port. Domain allowed access. Send tor_client packets. Domain allowed access. Do not audit attempts to send tor_client packets. Domain to not audit. Receive tor_client packets. Domain allowed access. Do not audit attempts to receive tor_client packets. Domain allowed access. Send and receive tor_client packets. Domain allowed access. Do not audit attempts to send and receive tor_client packets. Domain to not audit. Relabel packets to tor_client the packet type. Domain allowed access. Send tor_server packets. Domain allowed access. Do not audit attempts to send tor_server packets. Domain to not audit. Receive tor_server packets. Domain allowed access. Do not audit attempts to receive tor_server packets. Domain allowed access. Send and receive tor_server packets. Domain allowed access. Do not audit attempts to send and receive tor_server packets. Domain to not audit. Relabel packets to tor_server the packet type. Domain allowed access. Send and receive TCP traffic on the traceroute port. Domain allowed access. Send UDP traffic on the traceroute port. Domain allowed access. Do not audit attempts to send UDP traffic on the traceroute port. Domain to not audit. Receive UDP traffic on the traceroute port. Domain allowed access. Do not audit attempts to receive UDP traffic on the traceroute port. Domain to not audit. Send and receive UDP traffic on the traceroute port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the traceroute port. Domain to not audit. Bind TCP sockets to the traceroute port. Domain allowed access. Bind UDP sockets to the traceroute port. Domain allowed access. Make a TCP connection to the traceroute port. Domain allowed access. Send traceroute_client packets. Domain allowed access. Do not audit attempts to send traceroute_client packets. Domain to not audit. Receive traceroute_client packets. Domain allowed access. Do not audit attempts to receive traceroute_client packets. Domain allowed access. Send and receive traceroute_client packets. Domain allowed access. Do not audit attempts to send and receive traceroute_client packets. Domain to not audit. Relabel packets to traceroute_client the packet type. Domain allowed access. Send traceroute_server packets. Domain allowed access. Do not audit attempts to send traceroute_server packets. Domain to not audit. Receive traceroute_server packets. Domain allowed access. Do not audit attempts to receive traceroute_server packets. Domain allowed access. Send and receive traceroute_server packets. Domain allowed access. Do not audit attempts to send and receive traceroute_server packets. Domain to not audit. Relabel packets to traceroute_server the packet type. Domain allowed access. Send and receive TCP traffic on the transproxy port. Domain allowed access. Send UDP traffic on the transproxy port. Domain allowed access. Do not audit attempts to send UDP traffic on the transproxy port. Domain to not audit. Receive UDP traffic on the transproxy port. Domain allowed access. Do not audit attempts to receive UDP traffic on the transproxy port. Domain to not audit. Send and receive UDP traffic on the transproxy port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the transproxy port. Domain to not audit. Bind TCP sockets to the transproxy port. Domain allowed access. Bind UDP sockets to the transproxy port. Domain allowed access. Make a TCP connection to the transproxy port. Domain allowed access. Send transproxy_client packets. Domain allowed access. Do not audit attempts to send transproxy_client packets. Domain to not audit. Receive transproxy_client packets. Domain allowed access. Do not audit attempts to receive transproxy_client packets. Domain allowed access. Send and receive transproxy_client packets. Domain allowed access. Do not audit attempts to send and receive transproxy_client packets. Domain to not audit. Relabel packets to transproxy_client the packet type. Domain allowed access. Send transproxy_server packets. Domain allowed access. Do not audit attempts to send transproxy_server packets. Domain to not audit. Receive transproxy_server packets. Domain allowed access. Do not audit attempts to receive transproxy_server packets. Domain allowed access. Send and receive transproxy_server packets. Domain allowed access. Do not audit attempts to send and receive transproxy_server packets. Domain to not audit. Relabel packets to transproxy_server the packet type. Domain allowed access. Send and receive TCP traffic on the trisoap port. Domain allowed access. Send UDP traffic on the trisoap port. Domain allowed access. Do not audit attempts to send UDP traffic on the trisoap port. Domain to not audit. Receive UDP traffic on the trisoap port. Domain allowed access. Do not audit attempts to receive UDP traffic on the trisoap port. Domain to not audit. Send and receive UDP traffic on the trisoap port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the trisoap port. Domain to not audit. Bind TCP sockets to the trisoap port. Domain allowed access. Bind UDP sockets to the trisoap port. Domain allowed access. Make a TCP connection to the trisoap port. Domain allowed access. Send trisoap_client packets. Domain allowed access. Do not audit attempts to send trisoap_client packets. Domain to not audit. Receive trisoap_client packets. Domain allowed access. Do not audit attempts to receive trisoap_client packets. Domain allowed access. Send and receive trisoap_client packets. Domain allowed access. Do not audit attempts to send and receive trisoap_client packets. Domain to not audit. Relabel packets to trisoap_client the packet type. Domain allowed access. Send trisoap_server packets. Domain allowed access. Do not audit attempts to send trisoap_server packets. Domain to not audit. Receive trisoap_server packets. Domain allowed access. Do not audit attempts to receive trisoap_server packets. Domain allowed access. Send and receive trisoap_server packets. Domain allowed access. Do not audit attempts to send and receive trisoap_server packets. Domain to not audit. Relabel packets to trisoap_server the packet type. Domain allowed access. Send and receive TCP traffic on the trivnet1 port. Domain allowed access. Send UDP traffic on the trivnet1 port. Domain allowed access. Do not audit attempts to send UDP traffic on the trivnet1 port. Domain to not audit. Receive UDP traffic on the trivnet1 port. Domain allowed access. Do not audit attempts to receive UDP traffic on the trivnet1 port. Domain to not audit. Send and receive UDP traffic on the trivnet1 port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the trivnet1 port. Domain to not audit. Bind TCP sockets to the trivnet1 port. Domain allowed access. Bind UDP sockets to the trivnet1 port. Domain allowed access. Make a TCP connection to the trivnet1 port. Domain allowed access. Send trivnet1_client packets. Domain allowed access. Do not audit attempts to send trivnet1_client packets. Domain to not audit. Receive trivnet1_client packets. Domain allowed access. Do not audit attempts to receive trivnet1_client packets. Domain allowed access. Send and receive trivnet1_client packets. Domain allowed access. Do not audit attempts to send and receive trivnet1_client packets. Domain to not audit. Relabel packets to trivnet1_client the packet type. Domain allowed access. Send trivnet1_server packets. Domain allowed access. Do not audit attempts to send trivnet1_server packets. Domain to not audit. Receive trivnet1_server packets. Domain allowed access. Do not audit attempts to receive trivnet1_server packets. Domain allowed access. Send and receive trivnet1_server packets. Domain allowed access. Do not audit attempts to send and receive trivnet1_server packets. Domain to not audit. Relabel packets to trivnet1_server the packet type. Domain allowed access. Send and receive TCP traffic on the ups port. Domain allowed access. Send UDP traffic on the ups port. Domain allowed access. Do not audit attempts to send UDP traffic on the ups port. Domain to not audit. Receive UDP traffic on the ups port. Domain allowed access. Do not audit attempts to receive UDP traffic on the ups port. Domain to not audit. Send and receive UDP traffic on the ups port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the ups port. Domain to not audit. Bind TCP sockets to the ups port. Domain allowed access. Bind UDP sockets to the ups port. Domain allowed access. Make a TCP connection to the ups port. Domain allowed access. Send ups_client packets. Domain allowed access. Do not audit attempts to send ups_client packets. Domain to not audit. Receive ups_client packets. Domain allowed access. Do not audit attempts to receive ups_client packets. Domain allowed access. Send and receive ups_client packets. Domain allowed access. Do not audit attempts to send and receive ups_client packets. Domain to not audit. Relabel packets to ups_client the packet type. Domain allowed access. Send ups_server packets. Domain allowed access. Do not audit attempts to send ups_server packets. Domain to not audit. Receive ups_server packets. Domain allowed access. Do not audit attempts to receive ups_server packets. Domain allowed access. Send and receive ups_server packets. Domain allowed access. Do not audit attempts to send and receive ups_server packets. Domain to not audit. Relabel packets to ups_server the packet type. Domain allowed access. Send and receive TCP traffic on the utcpserver port. Domain allowed access. Send UDP traffic on the utcpserver port. Domain allowed access. Do not audit attempts to send UDP traffic on the utcpserver port. Domain to not audit. Receive UDP traffic on the utcpserver port. Domain allowed access. Do not audit attempts to receive UDP traffic on the utcpserver port. Domain to not audit. Send and receive UDP traffic on the utcpserver port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the utcpserver port. Domain to not audit. Bind TCP sockets to the utcpserver port. Domain allowed access. Bind UDP sockets to the utcpserver port. Domain allowed access. Make a TCP connection to the utcpserver port. Domain allowed access. Send utcpserver_client packets. Domain allowed access. Do not audit attempts to send utcpserver_client packets. Domain to not audit. Receive utcpserver_client packets. Domain allowed access. Do not audit attempts to receive utcpserver_client packets. Domain allowed access. Send and receive utcpserver_client packets. Domain allowed access. Do not audit attempts to send and receive utcpserver_client packets. Domain to not audit. Relabel packets to utcpserver_client the packet type. Domain allowed access. Send utcpserver_server packets. Domain allowed access. Do not audit attempts to send utcpserver_server packets. Domain to not audit. Receive utcpserver_server packets. Domain allowed access. Do not audit attempts to receive utcpserver_server packets. Domain allowed access. Send and receive utcpserver_server packets. Domain allowed access. Do not audit attempts to send and receive utcpserver_server packets. Domain to not audit. Relabel packets to utcpserver_server the packet type. Domain allowed access. Send and receive TCP traffic on the uucpd port. Domain allowed access. Send UDP traffic on the uucpd port. Domain allowed access. Do not audit attempts to send UDP traffic on the uucpd port. Domain to not audit. Receive UDP traffic on the uucpd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the uucpd port. Domain to not audit. Send and receive UDP traffic on the uucpd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the uucpd port. Domain to not audit. Bind TCP sockets to the uucpd port. Domain allowed access. Bind UDP sockets to the uucpd port. Domain allowed access. Make a TCP connection to the uucpd port. Domain allowed access. Send uucpd_client packets. Domain allowed access. Do not audit attempts to send uucpd_client packets. Domain to not audit. Receive uucpd_client packets. Domain allowed access. Do not audit attempts to receive uucpd_client packets. Domain allowed access. Send and receive uucpd_client packets. Domain allowed access. Do not audit attempts to send and receive uucpd_client packets. Domain to not audit. Relabel packets to uucpd_client the packet type. Domain allowed access. Send uucpd_server packets. Domain allowed access. Do not audit attempts to send uucpd_server packets. Domain to not audit. Receive uucpd_server packets. Domain allowed access. Do not audit attempts to receive uucpd_server packets. Domain allowed access. Send and receive uucpd_server packets. Domain allowed access. Do not audit attempts to send and receive uucpd_server packets. Domain to not audit. Relabel packets to uucpd_server the packet type. Domain allowed access. Send and receive TCP traffic on the varnishd port. Domain allowed access. Send UDP traffic on the varnishd port. Domain allowed access. Do not audit attempts to send UDP traffic on the varnishd port. Domain to not audit. Receive UDP traffic on the varnishd port. Domain allowed access. Do not audit attempts to receive UDP traffic on the varnishd port. Domain to not audit. Send and receive UDP traffic on the varnishd port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the varnishd port. Domain to not audit. Bind TCP sockets to the varnishd port. Domain allowed access. Bind UDP sockets to the varnishd port. Domain allowed access. Make a TCP connection to the varnishd port. Domain allowed access. Send varnishd_client packets. Domain allowed access. Do not audit attempts to send varnishd_client packets. Domain to not audit. Receive varnishd_client packets. Domain allowed access. Do not audit attempts to receive varnishd_client packets. Domain allowed access. Send and receive varnishd_client packets. Domain allowed access. Do not audit attempts to send and receive varnishd_client packets. Domain to not audit. Relabel packets to varnishd_client the packet type. Domain allowed access. Send varnishd_server packets. Domain allowed access. Do not audit attempts to send varnishd_server packets. Domain to not audit. Receive varnishd_server packets. Domain allowed access. Do not audit attempts to receive varnishd_server packets. Domain allowed access. Send and receive varnishd_server packets. Domain allowed access. Do not audit attempts to send and receive varnishd_server packets. Domain to not audit. Relabel packets to varnishd_server the packet type. Domain allowed access. Send and receive TCP traffic on the virt port. Domain allowed access. Send UDP traffic on the virt port. Domain allowed access. Do not audit attempts to send UDP traffic on the virt port. Domain to not audit. Receive UDP traffic on the virt port. Domain allowed access. Do not audit attempts to receive UDP traffic on the virt port. Domain to not audit. Send and receive UDP traffic on the virt port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the virt port. Domain to not audit. Bind TCP sockets to the virt port. Domain allowed access. Bind UDP sockets to the virt port. Domain allowed access. Make a TCP connection to the virt port. Domain allowed access. Send virt_client packets. Domain allowed access. Do not audit attempts to send virt_client packets. Domain to not audit. Receive virt_client packets. Domain allowed access. Do not audit attempts to receive virt_client packets. Domain allowed access. Send and receive virt_client packets. Domain allowed access. Do not audit attempts to send and receive virt_client packets. Domain to not audit. Relabel packets to virt_client the packet type. Domain allowed access. Send virt_server packets. Domain allowed access. Do not audit attempts to send virt_server packets. Domain to not audit. Receive virt_server packets. Domain allowed access. Do not audit attempts to receive virt_server packets. Domain allowed access. Send and receive virt_server packets. Domain allowed access. Do not audit attempts to send and receive virt_server packets. Domain to not audit. Relabel packets to virt_server the packet type. Domain allowed access. Send and receive TCP traffic on the virtual_places port. Domain allowed access. Send UDP traffic on the virtual_places port. Domain allowed access. Do not audit attempts to send UDP traffic on the virtual_places port. Domain to not audit. Receive UDP traffic on the virtual_places port. Domain allowed access. Do not audit attempts to receive UDP traffic on the virtual_places port. Domain to not audit. Send and receive UDP traffic on the virtual_places port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the virtual_places port. Domain to not audit. Bind TCP sockets to the virtual_places port. Domain allowed access. Bind UDP sockets to the virtual_places port. Domain allowed access. Make a TCP connection to the virtual_places port. Domain allowed access. Send virtual_places_client packets. Domain allowed access. Do not audit attempts to send virtual_places_client packets. Domain to not audit. Receive virtual_places_client packets. Domain allowed access. Do not audit attempts to receive virtual_places_client packets. Domain allowed access. Send and receive virtual_places_client packets. Domain allowed access. Do not audit attempts to send and receive virtual_places_client packets. Domain to not audit. Relabel packets to virtual_places_client the packet type. Domain allowed access. Send virtual_places_server packets. Domain allowed access. Do not audit attempts to send virtual_places_server packets. Domain to not audit. Receive virtual_places_server packets. Domain allowed access. Do not audit attempts to receive virtual_places_server packets. Domain allowed access. Send and receive virtual_places_server packets. Domain allowed access. Do not audit attempts to send and receive virtual_places_server packets. Domain to not audit. Relabel packets to virtual_places_server the packet type. Domain allowed access. Send and receive TCP traffic on the virt_migration port. Domain allowed access. Send UDP traffic on the virt_migration port. Domain allowed access. Do not audit attempts to send UDP traffic on the virt_migration port. Domain to not audit. Receive UDP traffic on the virt_migration port. Domain allowed access. Do not audit attempts to receive UDP traffic on the virt_migration port. Domain to not audit. Send and receive UDP traffic on the virt_migration port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the virt_migration port. Domain to not audit. Bind TCP sockets to the virt_migration port. Domain allowed access. Bind UDP sockets to the virt_migration port. Domain allowed access. Make a TCP connection to the virt_migration port. Domain allowed access. Send virt_migration_client packets. Domain allowed access. Do not audit attempts to send virt_migration_client packets. Domain to not audit. Receive virt_migration_client packets. Domain allowed access. Do not audit attempts to receive virt_migration_client packets. Domain allowed access. Send and receive virt_migration_client packets. Domain allowed access. Do not audit attempts to send and receive virt_migration_client packets. Domain to not audit. Relabel packets to virt_migration_client the packet type. Domain allowed access. Send virt_migration_server packets. Domain allowed access. Do not audit attempts to send virt_migration_server packets. Domain to not audit. Receive virt_migration_server packets. Domain allowed access. Do not audit attempts to receive virt_migration_server packets. Domain allowed access. Send and receive virt_migration_server packets. Domain allowed access. Do not audit attempts to send and receive virt_migration_server packets. Domain to not audit. Relabel packets to virt_migration_server the packet type. Domain allowed access. Send and receive TCP traffic on the vnc port. Domain allowed access. Send UDP traffic on the vnc port. Domain allowed access. Do not audit attempts to send UDP traffic on the vnc port. Domain to not audit. Receive UDP traffic on the vnc port. Domain allowed access. Do not audit attempts to receive UDP traffic on the vnc port. Domain to not audit. Send and receive UDP traffic on the vnc port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the vnc port. Domain to not audit. Bind TCP sockets to the vnc port. Domain allowed access. Bind UDP sockets to the vnc port. Domain allowed access. Make a TCP connection to the vnc port. Domain allowed access. Send vnc_client packets. Domain allowed access. Do not audit attempts to send vnc_client packets. Domain to not audit. Receive vnc_client packets. Domain allowed access. Do not audit attempts to receive vnc_client packets. Domain allowed access. Send and receive vnc_client packets. Domain allowed access. Do not audit attempts to send and receive vnc_client packets. Domain to not audit. Relabel packets to vnc_client the packet type. Domain allowed access. Send vnc_server packets. Domain allowed access. Do not audit attempts to send vnc_server packets. Domain to not audit. Receive vnc_server packets. Domain allowed access. Do not audit attempts to receive vnc_server packets. Domain allowed access. Send and receive vnc_server packets. Domain allowed access. Do not audit attempts to send and receive vnc_server packets. Domain to not audit. Relabel packets to vnc_server the packet type. Domain allowed access. Send and receive TCP traffic on the wccp port. Domain allowed access. Send UDP traffic on the wccp port. Domain allowed access. Do not audit attempts to send UDP traffic on the wccp port. Domain to not audit. Receive UDP traffic on the wccp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the wccp port. Domain to not audit. Send and receive UDP traffic on the wccp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the wccp port. Domain to not audit. Bind TCP sockets to the wccp port. Domain allowed access. Bind UDP sockets to the wccp port. Domain allowed access. Make a TCP connection to the wccp port. Domain allowed access. Send wccp_client packets. Domain allowed access. Do not audit attempts to send wccp_client packets. Domain to not audit. Receive wccp_client packets. Domain allowed access. Do not audit attempts to receive wccp_client packets. Domain allowed access. Send and receive wccp_client packets. Domain allowed access. Do not audit attempts to send and receive wccp_client packets. Domain to not audit. Relabel packets to wccp_client the packet type. Domain allowed access. Send wccp_server packets. Domain allowed access. Do not audit attempts to send wccp_server packets. Domain to not audit. Receive wccp_server packets. Domain allowed access. Do not audit attempts to receive wccp_server packets. Domain allowed access. Send and receive wccp_server packets. Domain allowed access. Do not audit attempts to send and receive wccp_server packets. Domain to not audit. Relabel packets to wccp_server the packet type. Domain allowed access. Send and receive TCP traffic on the websm port. Domain allowed access. Send UDP traffic on the websm port. Domain allowed access. Do not audit attempts to send UDP traffic on the websm port. Domain to not audit. Receive UDP traffic on the websm port. Domain allowed access. Do not audit attempts to receive UDP traffic on the websm port. Domain to not audit. Send and receive UDP traffic on the websm port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the websm port. Domain to not audit. Bind TCP sockets to the websm port. Domain allowed access. Bind UDP sockets to the websm port. Domain allowed access. Make a TCP connection to the websm port. Domain allowed access. Send websm_client packets. Domain allowed access. Do not audit attempts to send websm_client packets. Domain to not audit. Receive websm_client packets. Domain allowed access. Do not audit attempts to receive websm_client packets. Domain allowed access. Send and receive websm_client packets. Domain allowed access. Do not audit attempts to send and receive websm_client packets. Domain to not audit. Relabel packets to websm_client the packet type. Domain allowed access. Send websm_server packets. Domain allowed access. Do not audit attempts to send websm_server packets. Domain to not audit. Receive websm_server packets. Domain allowed access. Do not audit attempts to receive websm_server packets. Domain allowed access. Send and receive websm_server packets. Domain allowed access. Do not audit attempts to send and receive websm_server packets. Domain to not audit. Relabel packets to websm_server the packet type. Domain allowed access. Send and receive TCP traffic on the whois port. Domain allowed access. Send UDP traffic on the whois port. Domain allowed access. Do not audit attempts to send UDP traffic on the whois port. Domain to not audit. Receive UDP traffic on the whois port. Domain allowed access. Do not audit attempts to receive UDP traffic on the whois port. Domain to not audit. Send and receive UDP traffic on the whois port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the whois port. Domain to not audit. Bind TCP sockets to the whois port. Domain allowed access. Bind UDP sockets to the whois port. Domain allowed access. Make a TCP connection to the whois port. Domain allowed access. Send whois_client packets. Domain allowed access. Do not audit attempts to send whois_client packets. Domain to not audit. Receive whois_client packets. Domain allowed access. Do not audit attempts to receive whois_client packets. Domain allowed access. Send and receive whois_client packets. Domain allowed access. Do not audit attempts to send and receive whois_client packets. Domain to not audit. Relabel packets to whois_client the packet type. Domain allowed access. Send whois_server packets. Domain allowed access. Do not audit attempts to send whois_server packets. Domain to not audit. Receive whois_server packets. Domain allowed access. Do not audit attempts to receive whois_server packets. Domain allowed access. Send and receive whois_server packets. Domain allowed access. Do not audit attempts to send and receive whois_server packets. Domain to not audit. Relabel packets to whois_server the packet type. Domain allowed access. Send and receive TCP traffic on the winshadow port. Domain allowed access. Send UDP traffic on the winshadow port. Domain allowed access. Do not audit attempts to send UDP traffic on the winshadow port. Domain to not audit. Receive UDP traffic on the winshadow port. Domain allowed access. Do not audit attempts to receive UDP traffic on the winshadow port. Domain to not audit. Send and receive UDP traffic on the winshadow port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the winshadow port. Domain to not audit. Bind TCP sockets to the winshadow port. Domain allowed access. Bind UDP sockets to the winshadow port. Domain allowed access. Make a TCP connection to the winshadow port. Domain allowed access. Send winshadow_client packets. Domain allowed access. Do not audit attempts to send winshadow_client packets. Domain to not audit. Receive winshadow_client packets. Domain allowed access. Do not audit attempts to receive winshadow_client packets. Domain allowed access. Send and receive winshadow_client packets. Domain allowed access. Do not audit attempts to send and receive winshadow_client packets. Domain to not audit. Relabel packets to winshadow_client the packet type. Domain allowed access. Send winshadow_server packets. Domain allowed access. Do not audit attempts to send winshadow_server packets. Domain to not audit. Receive winshadow_server packets. Domain allowed access. Do not audit attempts to receive winshadow_server packets. Domain allowed access. Send and receive winshadow_server packets. Domain allowed access. Do not audit attempts to send and receive winshadow_server packets. Domain to not audit. Relabel packets to winshadow_server the packet type. Domain allowed access. Send and receive TCP traffic on the wsdapi port. Domain allowed access. Send UDP traffic on the wsdapi port. Domain allowed access. Do not audit attempts to send UDP traffic on the wsdapi port. Domain to not audit. Receive UDP traffic on the wsdapi port. Domain allowed access. Do not audit attempts to receive UDP traffic on the wsdapi port. Domain to not audit. Send and receive UDP traffic on the wsdapi port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the wsdapi port. Domain to not audit. Bind TCP sockets to the wsdapi port. Domain allowed access. Bind UDP sockets to the wsdapi port. Domain allowed access. Make a TCP connection to the wsdapi port. Domain allowed access. Send wsdapi_client packets. Domain allowed access. Do not audit attempts to send wsdapi_client packets. Domain to not audit. Receive wsdapi_client packets. Domain allowed access. Do not audit attempts to receive wsdapi_client packets. Domain allowed access. Send and receive wsdapi_client packets. Domain allowed access. Do not audit attempts to send and receive wsdapi_client packets. Domain to not audit. Relabel packets to wsdapi_client the packet type. Domain allowed access. Send wsdapi_server packets. Domain allowed access. Do not audit attempts to send wsdapi_server packets. Domain to not audit. Receive wsdapi_server packets. Domain allowed access. Do not audit attempts to receive wsdapi_server packets. Domain allowed access. Send and receive wsdapi_server packets. Domain allowed access. Do not audit attempts to send and receive wsdapi_server packets. Domain to not audit. Relabel packets to wsdapi_server the packet type. Domain allowed access. Send and receive TCP traffic on the wsicopy port. Domain allowed access. Send UDP traffic on the wsicopy port. Domain allowed access. Do not audit attempts to send UDP traffic on the wsicopy port. Domain to not audit. Receive UDP traffic on the wsicopy port. Domain allowed access. Do not audit attempts to receive UDP traffic on the wsicopy port. Domain to not audit. Send and receive UDP traffic on the wsicopy port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the wsicopy port. Domain to not audit. Bind TCP sockets to the wsicopy port. Domain allowed access. Bind UDP sockets to the wsicopy port. Domain allowed access. Make a TCP connection to the wsicopy port. Domain allowed access. Send wsicopy_client packets. Domain allowed access. Do not audit attempts to send wsicopy_client packets. Domain to not audit. Receive wsicopy_client packets. Domain allowed access. Do not audit attempts to receive wsicopy_client packets. Domain allowed access. Send and receive wsicopy_client packets. Domain allowed access. Do not audit attempts to send and receive wsicopy_client packets. Domain to not audit. Relabel packets to wsicopy_client the packet type. Domain allowed access. Send wsicopy_server packets. Domain allowed access. Do not audit attempts to send wsicopy_server packets. Domain to not audit. Receive wsicopy_server packets. Domain allowed access. Do not audit attempts to receive wsicopy_server packets. Domain allowed access. Send and receive wsicopy_server packets. Domain allowed access. Do not audit attempts to send and receive wsicopy_server packets. Domain to not audit. Relabel packets to wsicopy_server the packet type. Domain allowed access. Send and receive TCP traffic on the xdmcp port. Domain allowed access. Send UDP traffic on the xdmcp port. Domain allowed access. Do not audit attempts to send UDP traffic on the xdmcp port. Domain to not audit. Receive UDP traffic on the xdmcp port. Domain allowed access. Do not audit attempts to receive UDP traffic on the xdmcp port. Domain to not audit. Send and receive UDP traffic on the xdmcp port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the xdmcp port. Domain to not audit. Bind TCP sockets to the xdmcp port. Domain allowed access. Bind UDP sockets to the xdmcp port. Domain allowed access. Make a TCP connection to the xdmcp port. Domain allowed access. Send xdmcp_client packets. Domain allowed access. Do not audit attempts to send xdmcp_client packets. Domain to not audit. Receive xdmcp_client packets. Domain allowed access. Do not audit attempts to receive xdmcp_client packets. Domain allowed access. Send and receive xdmcp_client packets. Domain allowed access. Do not audit attempts to send and receive xdmcp_client packets. Domain to not audit. Relabel packets to xdmcp_client the packet type. Domain allowed access. Send xdmcp_server packets. Domain allowed access. Do not audit attempts to send xdmcp_server packets. Domain to not audit. Receive xdmcp_server packets. Domain allowed access. Do not audit attempts to receive xdmcp_server packets. Domain allowed access. Send and receive xdmcp_server packets. Domain allowed access. Do not audit attempts to send and receive xdmcp_server packets. Domain to not audit. Relabel packets to xdmcp_server the packet type. Domain allowed access. Send and receive TCP traffic on the xen port. Domain allowed access. Send UDP traffic on the xen port. Domain allowed access. Do not audit attempts to send UDP traffic on the xen port. Domain to not audit. Receive UDP traffic on the xen port. Domain allowed access. Do not audit attempts to receive UDP traffic on the xen port. Domain to not audit. Send and receive UDP traffic on the xen port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the xen port. Domain to not audit. Bind TCP sockets to the xen port. Domain allowed access. Bind UDP sockets to the xen port. Domain allowed access. Make a TCP connection to the xen port. Domain allowed access. Send xen_client packets. Domain allowed access. Do not audit attempts to send xen_client packets. Domain to not audit. Receive xen_client packets. Domain allowed access. Do not audit attempts to receive xen_client packets. Domain allowed access. Send and receive xen_client packets. Domain allowed access. Do not audit attempts to send and receive xen_client packets. Domain to not audit. Relabel packets to xen_client the packet type. Domain allowed access. Send xen_server packets. Domain allowed access. Do not audit attempts to send xen_server packets. Domain to not audit. Receive xen_server packets. Domain allowed access. Do not audit attempts to receive xen_server packets. Domain allowed access. Send and receive xen_server packets. Domain allowed access. Do not audit attempts to send and receive xen_server packets. Domain to not audit. Relabel packets to xen_server the packet type. Domain allowed access. Send and receive TCP traffic on the xfs port. Domain allowed access. Send UDP traffic on the xfs port. Domain allowed access. Do not audit attempts to send UDP traffic on the xfs port. Domain to not audit. Receive UDP traffic on the xfs port. Domain allowed access. Do not audit attempts to receive UDP traffic on the xfs port. Domain to not audit. Send and receive UDP traffic on the xfs port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the xfs port. Domain to not audit. Bind TCP sockets to the xfs port. Domain allowed access. Bind UDP sockets to the xfs port. Domain allowed access. Make a TCP connection to the xfs port. Domain allowed access. Send xfs_client packets. Domain allowed access. Do not audit attempts to send xfs_client packets. Domain to not audit. Receive xfs_client packets. Domain allowed access. Do not audit attempts to receive xfs_client packets. Domain allowed access. Send and receive xfs_client packets. Domain allowed access. Do not audit attempts to send and receive xfs_client packets. Domain to not audit. Relabel packets to xfs_client the packet type. Domain allowed access. Send xfs_server packets. Domain allowed access. Do not audit attempts to send xfs_server packets. Domain to not audit. Receive xfs_server packets. Domain allowed access. Do not audit attempts to receive xfs_server packets. Domain allowed access. Send and receive xfs_server packets. Domain allowed access. Do not audit attempts to send and receive xfs_server packets. Domain to not audit. Relabel packets to xfs_server the packet type. Domain allowed access. Send and receive TCP traffic on the xserver port. Domain allowed access. Send UDP traffic on the xserver port. Domain allowed access. Do not audit attempts to send UDP traffic on the xserver port. Domain to not audit. Receive UDP traffic on the xserver port. Domain allowed access. Do not audit attempts to receive UDP traffic on the xserver port. Domain to not audit. Send and receive UDP traffic on the xserver port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the xserver port. Domain to not audit. Bind TCP sockets to the xserver port. Domain allowed access. Bind UDP sockets to the xserver port. Domain allowed access. Make a TCP connection to the xserver port. Domain allowed access. Send xserver_client packets. Domain allowed access. Do not audit attempts to send xserver_client packets. Domain to not audit. Receive xserver_client packets. Domain allowed access. Do not audit attempts to receive xserver_client packets. Domain allowed access. Send and receive xserver_client packets. Domain allowed access. Do not audit attempts to send and receive xserver_client packets. Domain to not audit. Relabel packets to xserver_client the packet type. Domain allowed access. Send xserver_server packets. Domain allowed access. Do not audit attempts to send xserver_server packets. Domain to not audit. Receive xserver_server packets. Domain allowed access. Do not audit attempts to receive xserver_server packets. Domain allowed access. Send and receive xserver_server packets. Domain allowed access. Do not audit attempts to send and receive xserver_server packets. Domain to not audit. Relabel packets to xserver_server the packet type. Domain allowed access. Send and receive TCP traffic on the zarafa port. Domain allowed access. Send UDP traffic on the zarafa port. Domain allowed access. Do not audit attempts to send UDP traffic on the zarafa port. Domain to not audit. Receive UDP traffic on the zarafa port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zarafa port. Domain to not audit. Send and receive UDP traffic on the zarafa port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zarafa port. Domain to not audit. Bind TCP sockets to the zarafa port. Domain allowed access. Bind UDP sockets to the zarafa port. Domain allowed access. Make a TCP connection to the zarafa port. Domain allowed access. Send zarafa_client packets. Domain allowed access. Do not audit attempts to send zarafa_client packets. Domain to not audit. Receive zarafa_client packets. Domain allowed access. Do not audit attempts to receive zarafa_client packets. Domain allowed access. Send and receive zarafa_client packets. Domain allowed access. Do not audit attempts to send and receive zarafa_client packets. Domain to not audit. Relabel packets to zarafa_client the packet type. Domain allowed access. Send zarafa_server packets. Domain allowed access. Do not audit attempts to send zarafa_server packets. Domain to not audit. Receive zarafa_server packets. Domain allowed access. Do not audit attempts to receive zarafa_server packets. Domain allowed access. Send and receive zarafa_server packets. Domain allowed access. Do not audit attempts to send and receive zarafa_server packets. Domain to not audit. Relabel packets to zarafa_server the packet type. Domain allowed access. Send and receive TCP traffic on the zabbix port. Domain allowed access. Send UDP traffic on the zabbix port. Domain allowed access. Do not audit attempts to send UDP traffic on the zabbix port. Domain to not audit. Receive UDP traffic on the zabbix port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zabbix port. Domain to not audit. Send and receive UDP traffic on the zabbix port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zabbix port. Domain to not audit. Bind TCP sockets to the zabbix port. Domain allowed access. Bind UDP sockets to the zabbix port. Domain allowed access. Make a TCP connection to the zabbix port. Domain allowed access. Send zabbix_client packets. Domain allowed access. Do not audit attempts to send zabbix_client packets. Domain to not audit. Receive zabbix_client packets. Domain allowed access. Do not audit attempts to receive zabbix_client packets. Domain allowed access. Send and receive zabbix_client packets. Domain allowed access. Do not audit attempts to send and receive zabbix_client packets. Domain to not audit. Relabel packets to zabbix_client the packet type. Domain allowed access. Send zabbix_server packets. Domain allowed access. Do not audit attempts to send zabbix_server packets. Domain to not audit. Receive zabbix_server packets. Domain allowed access. Do not audit attempts to receive zabbix_server packets. Domain allowed access. Send and receive zabbix_server packets. Domain allowed access. Do not audit attempts to send and receive zabbix_server packets. Domain to not audit. Relabel packets to zabbix_server the packet type. Domain allowed access. Send and receive TCP traffic on the zabbix_agent port. Domain allowed access. Send UDP traffic on the zabbix_agent port. Domain allowed access. Do not audit attempts to send UDP traffic on the zabbix_agent port. Domain to not audit. Receive UDP traffic on the zabbix_agent port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zabbix_agent port. Domain to not audit. Send and receive UDP traffic on the zabbix_agent port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zabbix_agent port. Domain to not audit. Bind TCP sockets to the zabbix_agent port. Domain allowed access. Bind UDP sockets to the zabbix_agent port. Domain allowed access. Make a TCP connection to the zabbix_agent port. Domain allowed access. Send zabbix_agent_client packets. Domain allowed access. Do not audit attempts to send zabbix_agent_client packets. Domain to not audit. Receive zabbix_agent_client packets. Domain allowed access. Do not audit attempts to receive zabbix_agent_client packets. Domain allowed access. Send and receive zabbix_agent_client packets. Domain allowed access. Do not audit attempts to send and receive zabbix_agent_client packets. Domain to not audit. Relabel packets to zabbix_agent_client the packet type. Domain allowed access. Send zabbix_agent_server packets. Domain allowed access. Do not audit attempts to send zabbix_agent_server packets. Domain to not audit. Receive zabbix_agent_server packets. Domain allowed access. Do not audit attempts to receive zabbix_agent_server packets. Domain allowed access. Send and receive zabbix_agent_server packets. Domain allowed access. Do not audit attempts to send and receive zabbix_agent_server packets. Domain to not audit. Relabel packets to zabbix_agent_server the packet type. Domain allowed access. Send and receive TCP traffic on the zookeeper_client port. Domain allowed access. Send UDP traffic on the zookeeper_client port. Domain allowed access. Do not audit attempts to send UDP traffic on the zookeeper_client port. Domain to not audit. Receive UDP traffic on the zookeeper_client port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zookeeper_client port. Domain to not audit. Send and receive UDP traffic on the zookeeper_client port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zookeeper_client port. Domain to not audit. Bind TCP sockets to the zookeeper_client port. Domain allowed access. Bind UDP sockets to the zookeeper_client port. Domain allowed access. Make a TCP connection to the zookeeper_client port. Domain allowed access. Send zookeeper_client_client packets. Domain allowed access. Do not audit attempts to send zookeeper_client_client packets. Domain to not audit. Receive zookeeper_client_client packets. Domain allowed access. Do not audit attempts to receive zookeeper_client_client packets. Domain allowed access. Send and receive zookeeper_client_client packets. Domain allowed access. Do not audit attempts to send and receive zookeeper_client_client packets. Domain to not audit. Relabel packets to zookeeper_client_client the packet type. Domain allowed access. Send zookeeper_client_server packets. Domain allowed access. Do not audit attempts to send zookeeper_client_server packets. Domain to not audit. Receive zookeeper_client_server packets. Domain allowed access. Do not audit attempts to receive zookeeper_client_server packets. Domain allowed access. Send and receive zookeeper_client_server packets. Domain allowed access. Do not audit attempts to send and receive zookeeper_client_server packets. Domain to not audit. Relabel packets to zookeeper_client_server the packet type. Domain allowed access. Send and receive TCP traffic on the zookeeper_election port. Domain allowed access. Send UDP traffic on the zookeeper_election port. Domain allowed access. Do not audit attempts to send UDP traffic on the zookeeper_election port. Domain to not audit. Receive UDP traffic on the zookeeper_election port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zookeeper_election port. Domain to not audit. Send and receive UDP traffic on the zookeeper_election port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zookeeper_election port. Domain to not audit. Bind TCP sockets to the zookeeper_election port. Domain allowed access. Bind UDP sockets to the zookeeper_election port. Domain allowed access. Make a TCP connection to the zookeeper_election port. Domain allowed access. Send zookeeper_election_client packets. Domain allowed access. Do not audit attempts to send zookeeper_election_client packets. Domain to not audit. Receive zookeeper_election_client packets. Domain allowed access. Do not audit attempts to receive zookeeper_election_client packets. Domain allowed access. Send and receive zookeeper_election_client packets. Domain allowed access. Do not audit attempts to send and receive zookeeper_election_client packets. Domain to not audit. Relabel packets to zookeeper_election_client the packet type. Domain allowed access. Send zookeeper_election_server packets. Domain allowed access. Do not audit attempts to send zookeeper_election_server packets. Domain to not audit. Receive zookeeper_election_server packets. Domain allowed access. Do not audit attempts to receive zookeeper_election_server packets. Domain allowed access. Send and receive zookeeper_election_server packets. Domain allowed access. Do not audit attempts to send and receive zookeeper_election_server packets. Domain to not audit. Relabel packets to zookeeper_election_server the packet type. Domain allowed access. Send and receive TCP traffic on the zookeeper_leader port. Domain allowed access. Send UDP traffic on the zookeeper_leader port. Domain allowed access. Do not audit attempts to send UDP traffic on the zookeeper_leader port. Domain to not audit. Receive UDP traffic on the zookeeper_leader port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zookeeper_leader port. Domain to not audit. Send and receive UDP traffic on the zookeeper_leader port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zookeeper_leader port. Domain to not audit. Bind TCP sockets to the zookeeper_leader port. Domain allowed access. Bind UDP sockets to the zookeeper_leader port. Domain allowed access. Make a TCP connection to the zookeeper_leader port. Domain allowed access. Send zookeeper_leader_client packets. Domain allowed access. Do not audit attempts to send zookeeper_leader_client packets. Domain to not audit. Receive zookeeper_leader_client packets. Domain allowed access. Do not audit attempts to receive zookeeper_leader_client packets. Domain allowed access. Send and receive zookeeper_leader_client packets. Domain allowed access. Do not audit attempts to send and receive zookeeper_leader_client packets. Domain to not audit. Relabel packets to zookeeper_leader_client the packet type. Domain allowed access. Send zookeeper_leader_server packets. Domain allowed access. Do not audit attempts to send zookeeper_leader_server packets. Domain to not audit. Receive zookeeper_leader_server packets. Domain allowed access. Do not audit attempts to receive zookeeper_leader_server packets. Domain allowed access. Send and receive zookeeper_leader_server packets. Domain allowed access. Do not audit attempts to send and receive zookeeper_leader_server packets. Domain to not audit. Relabel packets to zookeeper_leader_server the packet type. Domain allowed access. Send and receive TCP traffic on the zebra port. Domain allowed access. Send UDP traffic on the zebra port. Domain allowed access. Do not audit attempts to send UDP traffic on the zebra port. Domain to not audit. Receive UDP traffic on the zebra port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zebra port. Domain to not audit. Send and receive UDP traffic on the zebra port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zebra port. Domain to not audit. Bind TCP sockets to the zebra port. Domain allowed access. Bind UDP sockets to the zebra port. Domain allowed access. Make a TCP connection to the zebra port. Domain allowed access. Send zebra_client packets. Domain allowed access. Do not audit attempts to send zebra_client packets. Domain to not audit. Receive zebra_client packets. Domain allowed access. Do not audit attempts to receive zebra_client packets. Domain allowed access. Send and receive zebra_client packets. Domain allowed access. Do not audit attempts to send and receive zebra_client packets. Domain to not audit. Relabel packets to zebra_client the packet type. Domain allowed access. Send zebra_server packets. Domain allowed access. Do not audit attempts to send zebra_server packets. Domain to not audit. Receive zebra_server packets. Domain allowed access. Do not audit attempts to receive zebra_server packets. Domain allowed access. Send and receive zebra_server packets. Domain allowed access. Do not audit attempts to send and receive zebra_server packets. Domain to not audit. Relabel packets to zebra_server the packet type. Domain allowed access. Send and receive TCP traffic on the zented port. Domain allowed access. Send UDP traffic on the zented port. Domain allowed access. Do not audit attempts to send UDP traffic on the zented port. Domain to not audit. Receive UDP traffic on the zented port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zented port. Domain to not audit. Send and receive UDP traffic on the zented port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zented port. Domain to not audit. Bind TCP sockets to the zented port. Domain allowed access. Bind UDP sockets to the zented port. Domain allowed access. Make a TCP connection to the zented port. Domain allowed access. Send zented_client packets. Domain allowed access. Do not audit attempts to send zented_client packets. Domain to not audit. Receive zented_client packets. Domain allowed access. Do not audit attempts to receive zented_client packets. Domain allowed access. Send and receive zented_client packets. Domain allowed access. Do not audit attempts to send and receive zented_client packets. Domain to not audit. Relabel packets to zented_client the packet type. Domain allowed access. Send zented_server packets. Domain allowed access. Do not audit attempts to send zented_server packets. Domain to not audit. Receive zented_server packets. Domain allowed access. Do not audit attempts to receive zented_server packets. Domain allowed access. Send and receive zented_server packets. Domain allowed access. Do not audit attempts to send and receive zented_server packets. Domain to not audit. Relabel packets to zented_server the packet type. Domain allowed access. Send and receive TCP traffic on the zope port. Domain allowed access. Send UDP traffic on the zope port. Domain allowed access. Do not audit attempts to send UDP traffic on the zope port. Domain to not audit. Receive UDP traffic on the zope port. Domain allowed access. Do not audit attempts to receive UDP traffic on the zope port. Domain to not audit. Send and receive UDP traffic on the zope port. Domain allowed access. Do not audit attempts to send and receive UDP traffic on the zope port. Domain to not audit. Bind TCP sockets to the zope port. Domain allowed access. Bind UDP sockets to the zope port. Domain allowed access. Make a TCP connection to the zope port. Domain allowed access. Send zope_client packets. Domain allowed access. Do not audit attempts to send zope_client packets. Domain to not audit. Receive zope_client packets. Domain allowed access. Do not audit attempts to receive zope_client packets. Domain allowed access. Send and receive zope_client packets. Domain allowed access. Do not audit attempts to send and receive zope_client packets. Domain to not audit. Relabel packets to zope_client the packet type. Domain allowed access. Send zope_server packets. Domain allowed access. Do not audit attempts to send zope_server packets. Domain to not audit. Receive zope_server packets. Domain allowed access. Do not audit attempts to receive zope_server packets. Domain allowed access. Send and receive zope_server packets. Domain allowed access. Do not audit attempts to send and receive zope_server packets. Domain to not audit. Relabel packets to zope_server the packet type. Domain allowed access. Send and receive TCP network traffic on the lo interface. Domain allowed access. Send UDP network traffic on the lo interface. Domain allowed access. Receive UDP network traffic on the lo interface. Domain allowed access. Send and receive UDP network traffic on the lo interface. Domain allowed access. Send raw IP packets on the lo interface. Domain allowed access. Receive raw IP packets on the lo interface. Domain allowed access. Send and receive raw IP packets on the lo interface. Domain allowed access.
Device nodes and interfaces for many basic system devices.

This module creates the device node concept and provides the policy for many of the device files. Notable exceptions are the mass storage and terminal devices that are covered by other modules.

This module creates the concept of a device node. That is a char or block device file, usually in /dev. All types that are used to label device nodes should use the dev_node macro.

Additionally, this module controls access to three things:

- the device directories containing device nodes
- device nodes as a group
- individual access to specific device nodes covered by this module.

Depended on by other required modules.
Make the specified type usable for device nodes in a filesystem.

Make the specified type usable for device nodes in a filesystem. Types used for device nodes that do not use this interface, or an interface that calls this one, will have unexpected behaviors while the system is running.

Example:

type mydev_t; dev_node(mydev_t) allow mydomain_t mydev_t:chr_file read_chr_file_perms;

Related interfaces:

- term_tty()
- term_pty()

Type to be used for device nodes. Associate the specified file type with device filesystem. The type of the file to be associated. Get attributes of device filesystems. Domain allowed access. Mount a filesystem on /dev Domain allow access. Allow full relabeling (to and from) of all device nodes. Domain allowed access. List all of the device nodes in a device directory. Domain allowed access. Set the attributes of /dev directories. Domain allowed access. Dontaudit attempts to list all device nodes. Domain to not audit. Add entries to directories in /dev. Domain allowed access. Remove entries from directories in /dev. Domain allowed access. Create a directory in the device directory. Domain allowed access. Delete a directory in the device directory. Domain allowed access. Manage of directories in /dev. Domain allowed access. Allow full relabeling (to and from) of directories in /dev. Domain allowed access. dontaudit getattr generic files in /dev. Domain to not audit. Read generic files in /dev. Domain to not audit. Read and write generic files in /dev. Domain allowed access. Delete generic files in /dev. Domain allowed access. Create a file in the device directory. Domain allowed access. Dontaudit getattr on generic pipes. Domain to not audit. Write generic socket files in /dev. Domain to not audit. Allow getattr on generic block devices. Domain allowed access. Dontaudit getattr on generic block devices. Domain to not audit. Dontaudit setattr on generic block devices. Domain to not audit. Create generic block device files. Domain allowed access. Delete generic block device files. Domain allowed access. Allow getattr for generic character device files. Domain allowed access. Dontaudit getattr for generic character device files. Domain to not audit. Dontaudit setattr for generic character device files. Domain to not audit. Read generic character device files. Domain allowed access. Read and write generic character device files. Domain allowed access. Read and write generic block device files. Domain allowed access. Dontaudit attempts to read/write generic character device files. Domain to dontaudit access. Create generic character device files. Domain allowed access. Delete generic character device files. Domain allowed access. Relabel from generic character device files. Domain allowed access. Do not audit attempts to set the attributes of symbolic links in device directories (/dev). Domain to not audit. Read symbolic links in device directories. Domain allowed access. Create symbolic links in device directories. Domain allowed access. Delete symbolic links in device directories. Domain allowed access. Create, delete, read, and write symbolic links in device directories. Domain allowed access. Relabel symbolic links in device directories. Domain allowed access. Create, delete, read, and write device nodes in device directories. Domain allowed access. Dontaudit getattr for generic device files. Domain to not audit. Create, delete, read, and write block device files. Domain allowed access. Create, delete, read, and write character device files. Domain allowed access. Create, read, and write device nodes. The node will be transitioned to the type provided. Domain allowed access. Type to which the created node will be transitioned. Object class(es) (single or set including {}) for which this the transition will occur. The name of the object being created. Create, read, and write device nodes. The node will be transitioned to the type provided. This is a temporary interface until devtmpfs functionality fixed. Domain allowed access. Object class(es) (single or set including {}) for which this the transition will occur. The name of the object being created. Getattr on all block file device nodes. Domain allowed access. Dontaudit getattr on all block file device nodes. Domain to not audit. Getattr on all character file device nodes. Domain allowed access. Dontaudit getattr on all character file device nodes. Domain to not audit. Setattr on all block file device nodes. Domain allowed access. Setattr on all character file device nodes. Domain allowed access. Dontaudit read on all block file device nodes. Domain to not audit. Dontaudit write on all block file device nodes. Domain to not audit. Dontaudit read on all character file device nodes. Domain to not audit. Dontaudit write on all character file device nodes. Domain to not audit. Create all block device files. Domain allowed access. Create all character device files. Domain allowed access. Delete all block device files. Domain allowed access. Delete all character device files. Domain allowed access. Rename all block device files. Domain allowed access. Rename all character device files. Domain allowed access. Read, write, create, and delete all block device files. Domain allowed access. Read, write, create, and delete all character device files. Domain allowed access. Getattr the agp devices. Domain allowed access. Read and write the agp devices. Domain allowed access. Get the attributes of the apm bios device node. Domain allowed access. Do not audit attempts to get the attributes of the apm bios device node. Domain to not audit. Set the attributes of the apm bios device node. Domain allowed access. Do not audit attempts to set the attributes of the apm bios device node. Domain to not audit. Read and write the apm bios. Domain allowed access. Get the attributes of the autofs device node. Domain allowed access. Do not audit attempts to get the attributes of the autofs device node. Domain to not audit. Set the attributes of the autofs device node. Domain allowed access. Do not audit attempts to set the attributes of the autofs device node. Domain to not audit. Read and write the autofs device. Domain allowed access. Relabel the autofs device node. Domain allowed access. Read and write cachefiles character device nodes. Domain allowed access. Read and write the PCMCIA card manager device. Domain allowed access. Do not audit attempts to read and write the PCMCIA card manager device. Domain to not audit. Create, read, write, and delete the PCMCIA card manager device with the correct type. Domain allowed access. Create, read, write, and delete the PCMCIA card manager device. Domain allowed access. Automatic type transition to the type for PCMCIA card manager device nodes when created in /dev. Domain allowed access. The name of the object being created. Get the attributes of the CPU microcode and id interfaces. Domain allowed access. Set the attributes of the CPU microcode and id interfaces. Domain allowed access. Read the CPU identity. Domain allowed access. Read and write the the CPU microcode device. This is required to load CPU microcode. Domain allowed access. Read the kernel crash device Domain allowed access. Read and write the the hardware SSL accelerator. Domain allowed access. Set the attributes of the dlm control devices. Domain allowed access. Read and write the the dlm control device Domain allowed access. getattr the dri devices. Domain allowed access. Setattr the dri devices. Domain allowed access. Read and write the dri devices. Domain allowed access. Dontaudit read and write on the dri devices. Domain to not audit. Create, read, write, and delete the dri devices. Domain allowed access. Automatic type transition to the type for DRI device nodes when created in /dev. Domain allowed access. The name of the object being created. Automatic type transition to the type for event device nodes when created in /dev. Domain allowed access. The name of the object being created. Get the attributes of the event devices. Domain allowed access. Set the attributes of the event devices. Domain allowed access. Read input event devices (/dev/input). Domain allowed access. Read and write input event devices (/dev/input). Domain allowed access. Create, read, write, and delete input event devices (/dev/input). Domain allowed access. Get the attributes of the framebuffer device node. Domain allowed access. Set the attributes of the framebuffer device node. Domain allowed access. Dot not audit attempts to set the attributes of the framebuffer device node. Domain to not audit. Read the framebuffer. Domain allowed access. Do not audit attempts to read the framebuffer. Domain to not audit. Write the framebuffer. Domain allowed access. Read and write the framebuffer. Domain allowed access. Read the kernel messages Domain allowed access. Do not audit attempts to read the kernel messages Domain to not audit. Write to the kernel messages device Domain allowed access. Read and write to the kernel messages device Domain allowed access. Get the attributes of the ksm devices. Domain allowed access. Set the attributes of the ksm devices. Domain allowed access. Read the ksm devices. Domain allowed access. Read and write to ksm devices. Domain allowed access. Get the attributes of the kvm devices. Domain allowed access. Set the attributes of the kvm devices. Domain allowed access. Read the kvm devices. Domain allowed access. Read and write to kvm devices. Domain allowed access. Read the lirc device. Domain allowed access. Read and write the lirc device. Domain allowed access. Automatic type transition to the type for lirc device nodes when created in /dev. Domain allowed access. The name of the object being created. Read and write the loop-control device. Domain allowed access. Get the attributes of the lvm comtrol device. Domain allowed access. Read the lvm comtrol device. Domain allowed access. Read and write the lvm control device. Domain allowed access. Do not audit attempts to read and write lvm control device. Domain to not audit. Delete the lvm control device. Domain allowed access. dontaudit getattr raw memory devices (e.g. /dev/mem). Domain to not audit. Read raw memory devices (e.g. /dev/mem). Domain allowed access. Do not audit attempts to read raw memory devices (e.g. /dev/mem). Domain to not audit. Write raw memory devices (e.g. /dev/mem). Domain allowed access. Read and execute raw memory devices (e.g. /dev/mem). Domain allowed access. Write and execute raw memory devices (e.g. /dev/mem). Domain allowed access. Get the attributes of miscellaneous devices. Domain allowed access. Do not audit attempts to get the attributes of miscellaneous devices. Domain to not audit. Set the attributes of miscellaneous devices. Domain allowed access. Do not audit attempts to set the attributes of miscellaneous devices. Domain to not audit. Read miscellaneous devices. Domain allowed access. Write miscellaneous devices. Domain allowed access. Do not audit attempts to read and write miscellaneous devices. Domain allowed access. Get the attributes of the modem devices. Domain allowed access. Set the attributes of the modem devices. Domain allowed access. Read the modem devices. Domain allowed access. Read and write to modem devices. Domain allowed access. Get the attributes of the mouse devices. Domain allowed access. Set the attributes of the mouse devices. Domain allowed access. Read the mouse devices. Domain allowed access. Read and write to mouse devices. Domain allowed access. Get the attributes of the memory type range registers (MTRR) device. Domain allowed access. Read the memory type range registers (MTRR). (Deprecated)

Read the memory type range registers (MTRR). This interface has been deprecated, dev_rw_mtrr() should be used instead.

The MTRR device ioctls can be used for reading and writing; thus, read access to the device cannot be separated from write access.

Domain allowed access. Write the memory type range registers (MTRR). (Deprecated)

Write the memory type range registers (MTRR). This interface has been deprecated, dev_rw_mtrr() should be used instead.

The MTRR device ioctls can be used for reading and writing; thus, write access to the device cannot be separated from read access.

Domain allowed access. Do not audit attempts to write the memory type range registers (MTRR). Domain to not audit. Read and write the memory type range registers (MTRR). Domain allowed access. Get the attributes of the network control device Domain allowed access. Read the network control identity. Domain allowed access. Read and write the the network control device. Domain allowed access. Get the attributes of the null device nodes. Domain allowed access. Set the attributes of the null device nodes. Domain allowed access. Delete the null device (/dev/null). Domain allowed access. Read and write to the null device (/dev/null). Domain allowed access. Create the null device (/dev/null). Domain allowed access. Do not audit attempts to get the attributes of the BIOS non-volatile RAM device. Domain to not audit. Read and write BIOS non-volatile RAM. Domain allowed access. Get the attributes of the printer device nodes. Domain allowed access. Set the attributes of the printer device nodes. Domain allowed access. Append the printer device. Domain allowed access. Read and write the printer device. Domain allowed access. Read printk devices (e.g., /dev/kmsg /dev/mcelog) Domain allowed access. Get the attributes of the QEMU microcode and id interfaces. Domain allowed access. Set the attributes of the QEMU microcode and id interfaces. Domain allowed access. Read the QEMU device Domain allowed access. Read and write the the QEMU device. Domain allowed access. Read from random number generator devices (e.g., /dev/random).

Allow the specified domain to read from random number generator devices (e.g., /dev/random). Typically this is used in situations when a cryptographically secure random number is needed.

Related interface:

- dev_read_urand()

Domain allowed access. Do not audit attempts to read from random number generator devices (e.g., /dev/random) Domain to not audit. Do not audit attempts to append to random number generator devices (e.g., /dev/random) Domain to not audit. Write to the random device (e.g., /dev/random). This adds entropy used to generate the random data read from the random device. Domain allowed access. Read the realtime clock (/dev/rtc). Domain allowed access. Set the realtime clock (/dev/rtc). Domain allowed access. Read and set the realtime clock (/dev/rtc). Domain allowed access. Get the attributes of the scanner device. Domain allowed access. Do not audit attempts to get the attributes of the scanner device. Domain to not audit. Set the attributes of the scanner device. Domain allowed access. Do not audit attempts to set the attributes of the scanner device. Domain to not audit. Read and write the scanner device. Domain allowed access. Get the attributes of the sound devices. Domain allowed access. Set the attributes of the sound devices. Domain allowed access. Read the sound devices. Domain allowed access. Write the sound devices. Domain allowed access. Read the sound mixer devices. Domain allowed access. Write the sound mixer devices. Domain allowed access. Get the attributes of the the power management device. Domain allowed access. Set the attributes of the the power management device. Domain allowed access. Read and write the the power management device. Domain allowed access. Getattr on smartcard devices Domain allowed access. dontaudit getattr on smartcard devices Domain to not audit. Read and write smartcard devices. Domain allowed access. Create, read, write, and delete smartcard devices. Domain allowed access. Associate a file to a sysfs filesystem. The type of the file to be associated to sysfs. Get the attributes of sysfs directories. Domain allowed access. Get the attributes of sysfs filesystem Domain allowed access. Do not audit getting the attributes of sysfs filesystem Domain to dontaudit access from Search the sysfs directories. Domain allowed access. Do not audit attempts to search sysfs. Domain to not audit. List the contents of the sysfs directories. Domain allowed access. Write in a sysfs directories. Domain allowed access. Do not audit attempts to write in a sysfs directory. Domain to not audit. Create, read, write, and delete sysfs directories. Domain allowed access. Read hardware state information.

Allow the specified domain to read the contents of the sysfs filesystem. This filesystem contains information, parameters, and other settings on the hardware installed on the system.

Domain allowed access. Allow caller to modify hardware state information. Domain allowed access. Relabel from/to all sysfs types. Domain allowed access. Read and write the TPM device. Domain allowed access. Read from pseudo random number generator devices (e.g., /dev/urandom).

Allow the specified domain to read from pseudo random number generator devices (e.g., /dev/urandom). Typically this is used in situations when a cryptographically secure random number is not necessarily needed. One example is the Stack Smashing Protector (SSP, formerly known as ProPolice) support that may be compiled into programs.

Related interface:

- dev_read_rand()

Related tunable:

- global_ssp

Domain allowed access. Do not audit attempts to read from pseudo random devices (e.g., /dev/urandom) Domain to not audit. Write to the pseudo random device (e.g., /dev/urandom). This sets the random number generator seed. Domain allowed access. Getattr generic the USB devices. Domain allowed access. Setattr generic the USB devices. Domain allowed access. Read generic the USB devices. Domain allowed access. Read and write generic the USB devices. Domain allowed access. Relabel generic the USB devices. Domain allowed access. Read USB monitor devices. Domain allowed access. Write USB monitor devices. Domain allowed access. Mount a usbfs filesystem. Domain allowed access. Associate a file to a usbfs filesystem. The type of the file to be associated to usbfs. Get the attributes of a directory in the usb filesystem. Domain allowed access. Do not audit attempts to get the attributes of a directory in the usb filesystem. Domain to not audit. Search the directory containing USB hardware information. Domain allowed access. Allow caller to get a list of usb hardware. Domain allowed access. Set the attributes of usbfs filesystem. Domain allowed access. Read USB hardware information using the usbfs filesystem interface. Domain allowed access. Allow caller to modify usb hardware configuration files. Domain allowed access. Get the attributes of video4linux devices. Domain allowed access. Read and write userio device. Domain allowed access. Do not audit attempts to get the attributes of video4linux device nodes. Domain to not audit. Set the attributes of video4linux device nodes. Domain allowed access. Do not audit attempts to set the attributes of video4linux device nodes. Domain to not audit. Read the video4linux devices. Domain allowed access. Write the video4linux devices. Domain allowed access. Read and write vfio devices. Domain allowed access. Relabel vfio devices. Domain allowed access. Allow read/write the vhost net device Domain allowed access. Read and write VMWare devices. Domain allowed access. Read, write, and mmap VMWare devices. Domain allowed access. Read from watchdog devices. Domain allowed access. Write to watchdog devices. Domain allowed access. Read and write the the wireless device. Domain allowed access. Read and write Xen devices. Domain allowed access. Create, read, write, and delete Xen devices. Domain allowed access. Automatic type transition to the type for xen device nodes when created in /dev. Domain allowed access. The name of the object being created. Get the attributes of X server miscellaneous devices. Domain allowed access. Set the attributes of X server miscellaneous devices. Domain allowed access. Read and write X server miscellaneous devices. Domain allowed access. Read and write to the zero device (/dev/zero). Domain allowed access. Read, write, and execute the zero device (/dev/zero). Domain allowed access. Execmod the zero device (/dev/zero). Domain allowed access. Create the zero device (/dev/zero). Domain allowed access. Read cpu online hardware state information

Allow the specified domain to read /sys/devices/system/cpu/online

Domain allowed access. Unconfined access to devices. Domain allowed access.
Core policy for domains.
Contains the concept of a domain.
Make the specified type usable as a basic domain.

Make the specified type usable as a basic domain.

This is primarily used for kernel threads; generally the domain_type() interface is more appropriate for userland processes.

Type to be used as a basic domain type. Make the specified type usable as a domain.

Make the specified type usable as a domain. This, or an interface that calls this interface, must be used on all types that are used as domains.

Related interfaces:

- application_domain()
- init_daemon_domain()
- init_domaion()
- init_ranged_daemon_domain()
- init_ranged_domain()
- init_ranged_system_domain()
- init_script_domain()
- init_system_domain()

Example:

type mydomain_t; domain_type(mydomain_t) type myfile_t; files_type(myfile_t) allow mydomain_t myfile_t:file read_file_perms;

Type to be used as a domain type. Make the specified type usable as an entry point for the domain. Domain to be entered. Type of program used for entering the domain. Make the file descriptors of the specified domain for interactive use (widely inheritable) Domain allowed access. Allow the specified domain to perform dynamic transitions.

Allow the specified domain to perform dynamic transitions.

This violates process tranquility, and it is strongly suggested that this not be used.

Domain allowed access. Makes caller and execption to the constraint preventing changing to the system user identity and system role. Domain allowed access. Makes caller an exception to the constraint preventing changing of user identity. The process type to make an exception to the constraint. Makes caller an exception to the constraint preventing changing of role. The process type to make an exception to the constraint. Makes caller an exception to the constraint preventing changing the user identity in object contexts. The process type to make an exception to the constraint. Make the specified domain the target of the user domain exception of the SELinux role and identity change constraints.

Make the specified domain the target of the user domain exception of the SELinux role and identity change constraints.

This interface is needed to decouple the user domains from the base module. It should not be used other than on user domains.

Domain target for user exemption. Make the specified domain the source of the cron domain exception of the SELinux role and identity change constraints.

Make the specified domain the source of the cron domain exception of the SELinux role and identity change constraints.

This interface is needed to decouple the cron domains from the base module. It should not be used other than on cron domains.

Domain target for user exemption. Make the specified domain the target of the cron domain exception of the SELinux role and identity change constraints.

Make the specified domain the target of the cron domain exception of the SELinux role and identity change constraints.

This interface is needed to decouple the cron domains from the base module. It should not be used other than on user cron jobs.

Domain target for user exemption. Inherit and use file descriptors from domains with interactive programs.

Allow the specified domain to inherit and use file descriptors from domains with interactive programs. This does not allow access to the objects being referenced by the file descriptors.

Domain allowed access. Do not audit attempts to inherit file descriptors from domains with interactive programs. Domain to not audit. Send a SIGCHLD signal to domains whose file discriptors are widely inheritable. Domain allowed access. Set the nice level of all domains. Domain allowed access. Send general signals to all domains. Domain allowed access. Do not audit attempts to send general signals to all domains. Domain to not audit. Send a null signal to all domains. Domain allowed access. Send a stop signal to all domains. Domain allowed access. Send a child terminated signal to all domains. Domain allowed access. Send a kill signal to all domains. Domain allowed access. Search the process state directory (/proc/pid) of all domains. Domain allowed access. Do not audit attempts to search the process state directory (/proc/pid) of all domains. Domain to not audit. Read the process state (/proc/pid) of all domains. Domain allowed access. Get the attributes of all domains of all domains. Domain allowed access. Do not audit attempts to get the attributes of all domains. Domain allowed access. Read the process state (/proc/pid) of all confined domains. Domain allowed access. Get the attributes of all confined domains. Domain allowed access. Ptrace all domains. Domain allowed access. Do not audit attempts to ptrace all domains.

Do not audit attempts to ptrace all domains.

Generally this needs to be suppressed because procps tries to access /proc/pid/environ and this now triggers a ptrace check in recent kernels (2.4 and 2.6).

Domain to not audit. Do not audit attempts to ptrace confined domains.

Do not audit attempts to ptrace confined domains.

Generally this needs to be suppressed because procps tries to access /proc/pid/environ and this now triggers a ptrace check in recent kernels (2.4 and 2.6).

Domain to not audit. Do not audit attempts to read the process state (/proc/pid) of all domains. Domain to not audit. Do not audit attempts to read the process state directories of all domains. Domain to not audit. Get the session ID of all domains. Domain allowed access. Do not audit attempts to get the session ID of all domains. Domain to not audit. Get the process group ID of all domains. Domain allowed access. Get the scheduler information of all domains. Domain allowed access. Get the capability information of all domains. Domain allowed access. Get the attributes of all domains sockets, for all socket types.

Get the attributes of all domains sockets, for all socket types.

This is commonly used for domains that can use lsof on all domains.

Domain allowed access. Do not audit attempts to get the attributes of all domains sockets, for all socket types.

Do not audit attempts to get the attributes of all domains sockets, for all socket types.

This interface was added for PCMCIA cardmgr and is probably excessive.

Domain to not audit. Do not audit attempts to get the attributes of all domains TCP sockets. Domain to not audit. Do not audit attempts to get the attributes of all domains UDP sockets. Domain to not audit. Do not audit attempts to read or write all domains UDP sockets. Domain to not audit. Do not audit attempts to get attribues of all domains IPSEC key management sockets. Domain to not audit. Do not audit attempts to get attribues of all domains packet sockets. Domain to not audit. Do not audit attempts to get attribues of all domains raw sockets. Domain to not audit. Do not audit attempts to read or write all domains key sockets. Domain to not audit. Do not audit attempts to get the attributes of all domains unix datagram sockets. Domain to not audit. Get the attributes of all domains unix datagram sockets. Domain allowed access. Do not audit attempts to get the attributes of all domains unix stream sockets. Domain to not audit. Get the attributes of all domains unnamed pipes.

Get the attributes of all domains unnamed pipes.

This is commonly used for domains that can use lsof on all domains.

Domain allowed access. Do not audit attempts to get the attributes of all domains unnamed pipes. Domain to not audit. Allow specified type to set context of all domains IPSEC associations. Domain allowed access. Get the attributes of entry point files for all domains. Domain allowed access. Do not audit attempts to get the attributes of all entry point files. Domain to not audit. Read the entry point files for all domains. Domain allowed access. Execute the entry point files for all domains in the caller domain. Domain allowed access. dontaudit checking for execute on all entry point files Domain to not audit. Create, read, write, and delete all entrypoint files. Domain allowed access. Relabel to and from all entry point file types. Domain allowed access. Mmap all entry point files as executable. Domain allowed access. Execute an entry_type in the specified domain. Domain allowed to transition. The type of the new process. Ability to mmap a low area of the address space conditionally, as configured by /proc/sys/kernel/mmap_min_addr. Preventing such mappings helps protect against exploiting null deref bugs in the kernel. Domain allowed access. Ability to mmap a low area of the address space unconditionally, as configured by /proc/sys/kernel/mmap_min_addr. Preventing such mappings helps protect against exploiting null deref bugs in the kernel. Domain allowed access. Allow specified type to receive labeled networking packets from all domains, over all protocols (TCP, UDP, etc) Domain allowed access. Send generic signals to the unconfined domain. Domain allowed access. Unconfined access to domains. Domain allowed access.

Control the ability to mmap a low area of the address space, as configured by /proc/sys/kernel/mmap_min_addr.

Basic filesystem types and interfaces.

This module contains basic filesystem types and interfaces. This includes:

- The concept of different file types including basic files, mount points, tmp files, etc.
- Access to groups of files and all files.
- Types and interfaces for the basic filesystem layout (/, /etc, /tmp, /usr, etc.).

Contains the concept of a file. Comains the file initial SID.
Make the specified type usable for files in a filesystem.

Make the specified type usable for files in a filesystem. Types used for files that do not use this interface, or an interface that calls this one, will have unexpected behaviors while the system is running. If the type is used for device nodes (character or block files), then the dev_node() interface is more appropriate.

Related interfaces:

- application_domain()
- application_executable_file()
- corecmd_executable_file()
- init_daemon_domain()
- init_domaion()
- init_ranged_daemon_domain()
- init_ranged_domain()
- init_ranged_system_domain()
- init_script_file()
- init_script_domain()
- init_system_domain()
- files_config_files()
- files_lock_file()
- files_mountpoint()
- files_pid_file()
- files_security_file()
- files_security_mountpoint()
- files_tmp_file()
- files_tmpfs_file()
- logging_log_file()
- userdom_user_home_content()

Example:

type myfile_t; files_type(myfile_t) allow mydomain_t myfile_t:file read_file_perms;

Type to be used for files. Mark the specified type as a file that is related to authentication. Type of the authentication-related file. Make the specified type a file that should not be dontaudited from browsing from user domains. Type of the file to be used as a member directory. Make the specified type usable for lock files. Type to be used for lock files. Make the specified type usable for filesystem mount points. Type to be used for mount points. Make the specified type usable for security file filesystem mount points. Type to be used for mount points. Make the specified type usable for runtime process ID files.

Make the specified type usable for runtime process ID files, typically found in /var/run. This will also make the type usable for files, making calls to files_type() redundant. Failure to use this interface for a PID file type may result in problems with starting or stopping services.

Related interfaces:

- files_pid_filetrans()

Example usage with a domain that can create and write its PID file with a private PID file type in the /var/run directory:

type mypidfile_t; files_pid_file(mypidfile_t) allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms }; files_pid_filetrans(mydomain_t, mypidfile_t, file)

Type to be used for PID files. Make the specified type a configuration file.

Make the specified type usable for configuration files. This will also make the type usable for files, making calls to files_type() redundant. Failure to use this interface for a temporary file may result in problems with configuration management tools.

Example usage with a domain that can read its configuration file /etc:

type myconffile_t; files_config_file(myconffile_t) allow mydomain_t myconffile_t:file read_file_perms; files_search_etc(mydomain_t)

Type to be used as a configuration file. Make the specified type a polyinstantiated directory. Type of the file to be used as a polyinstantiated directory. Make the specified type a parent of a polyinstantiated directory. Type of the file to be used as a parent directory. Make the specified type a polyinstantiation member directory. Type of the file to be used as a member directory. Make the domain use the specified type of polyinstantiated directory. Domain using the polyinstantiated directory. Type of the file to be used as a member directory. Make the specified type a file used for temporary files.

Make the specified type usable for temporary files. This will also make the type usable for files, making calls to files_type() redundant. Failure to use this interface for a temporary file may result in problems with purging temporary files.

Related interfaces:

- files_tmp_filetrans()

Example usage with a domain that can create and write its temporary file in the system temporary file directories (/tmp or /var/tmp):

type mytmpfile_t; files_tmp_file(mytmpfile_t) allow mydomain_t mytmpfile_t:file { create_file_perms write_file_perms }; files_tmp_filetrans(mydomain_t, mytmpfile_t, file)

Type of the file to be used as a temporary file. Transform the type into a file, for use on a virtual memory filesystem (tmpfs). The type to be transformed. Get the attributes of all directories. Domain allowed access. Do not audit attempts to get the attributes of all directories. Domain to not audit. List all non-security directories. Domain allowed access. Do not audit attempts to list all non-security directories. Domain to not audit. Mount a filesystem on all non-security directories and files. Domain allowed access. Allow attempts to modify any directory Domain allowed access. Allow attempts to manage non-security directories Domain allowed access. Relabel from/to non-security directories. Domain allowed access. Get the attributes of all files. Domain allowed access. Do not audit attempts to get the attributes of all files. Domain to not audit. Do not audit attempts to get the attributes of non security files. Domain to not audit. Create, read, write, and delete all non-security files. Domain allowed access. Relabel from/to all non-security files. Domain allowed access. Read all files. Domain allowed access. Allow shared library text relocations in all files.

Allow shared library text relocations in all files.

This is added to support WINE policy.

Domain allowed access. Read all non-security files. Domain allowed access. Read all directories on the filesystem, except the listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all files on the filesystem, except the listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all symbolic links on the filesystem, except the listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Get the attributes of all symbolic links. Domain allowed access. Do not audit attempts to get the attributes of all symbolic links. Domain to not audit. Do not audit attempts to read all symbolic links. Domain to not audit. Do not audit attempts to get the attributes of non security symbolic links. Domain to not audit. Do not audit attempts to get the attributes of non security block devices. Domain to not audit. Do not audit attempts to get the attributes of non security character devices. Domain to not audit. Read all symbolic links. Domain allowed access. Get the attributes of all named pipes. Domain allowed access. Do not audit attempts to get the attributes of all named pipes. Domain to not audit. Do not audit attempts to get the attributes of non security named pipes. Domain to not audit. Get the attributes of all named sockets. Domain allowed access. Do not audit attempts to get the attributes of all named sockets. Domain to not audit. Do not audit attempts to get the attributes of non security named sockets. Domain to not audit. Read all block nodes with file types. Domain allowed access. Read all character nodes with file types. Domain allowed access. Relabel all files on the filesystem, except the listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. rw all files on the filesystem, except the listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Manage all files on the filesystem, except the listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Search the contents of all directories on extended attribute filesystems. Domain allowed access. List the contents of all directories on extended attribute filesystems. Domain allowed access. Create all files as is. Domain allowed access. Do not audit attempts to search the contents of any directories on extended attribute filesystems. Domain to not audit. Get the attributes of all filesystems with the type of a file. Domain allowed access. Relabel a filesystem to the type of a file. Domain allowed access. Relabel a filesystem to and from the type of a file. Domain allowed access. Mount all filesystems with the type of a file. Domain allowed access. Unmount all filesystems with the type of a file. Domain allowed access. Read all non-authentication related directories. Domain allowed access. Read all non-authentication related files. Domain allowed access. Read all non-authentication related symbolic links. Domain allowed access. rw non-authentication related files. Domain allowed access. Manage non-authentication related files. Domain allowed access. Relabel all non-authentication related files. Domain allowed access. Manage all configuration directories on filesystem Domain allowed access. Relabel configuration directories Domain allowed access. Read config files in /etc. Domain allowed access. Manage all configuration files on filesystem Domain allowed access. Relabel configuration files Domain allowed access. Mount a filesystem on all mount points. Domain allowed access. Get the attributes of all mount points. Domain allowed access. Set the attributes of all mount points. Domain allowed access. Do not audit attempts to set the attributes on all mount points. Domain to not audit. Search all mount points. Domain allowed access. Do not audit searching of all mount points. Domain to not audit. List all mount points. Domain allowed access. Do not audit listing of all mount points. Domain to not audit. Do not audit attempts to write to mount points. Domain to not audit. List the contents of the root directory. Domain allowed access. Do not audit attempts to write to / dirs. Domain to not audit. Do not audit attempts to write files in the root directory. Domain to not audit. Create an object in the root directory, with a private type using a type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Do not audit attempts to read files in the root directory. Domain to not audit. Do not audit attempts to read or write files in the root directory. Domain to not audit. Do not audit attempts to read or write character device nodes in the root directory. Domain to not audit. Delete files in the root directory. Domain allowed access. Remove entries from the root directory. Domain allowed access. Associate to root file system. Type of the file to associate. Relabel to and from rootfs file system. Domain allowed access. Unmount a rootfs filesystem. Domain allowed access. Mount on the root directory (/) Domain allowed access. Get attributes of the /boot directory. Domain allowed access. Do not audit attempts to get attributes of the /boot directory. Domain to not audit. Search the /boot directory. Domain allowed access. Do not audit attempts to search the /boot directory. Domain to not audit. List the /boot directory. Domain allowed access. Do not audit attempts to list the /boot directory. Domain allowed access. Create directories in /boot Domain allowed access. Create, read, write, and delete directories in /boot. Domain allowed access. Create a private type object in boot with an automatic type transition Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. read files in the /boot directory. Domain allowed access. Create, read, write, and delete files in the /boot directory. Domain allowed access. Relabel from files in the /boot directory. Domain allowed access. Read symbolic links in the /boot directory. Domain allowed access. Read and write symbolic links in the /boot directory. Domain allowed access. Create, read, write, and delete symbolic links in the /boot directory. Domain allowed access. Read kernel files in the /boot directory. Domain allowed access. Install a kernel into the /boot directory. Domain allowed access. Delete a kernel from /boot. Domain allowed access. Getattr of directories with the default file type. Domain allowed access. Do not audit attempts to get the attributes of directories with the default file type. Domain to not audit. Search the contents of directories with the default file type. Domain allowed access. List contents of directories with the default file type. Domain allowed access. Do not audit attempts to list contents of directories with the default file type. Domain to not audit. Create, read, write, and delete directories with the default file type. Domain allowed access. Mount a filesystem on a directory with the default file type. Domain allowed access. Do not audit attempts to get the attributes of files with the default file type. Domain to not audit. Read files with the default file type. Domain allowed access. Do not audit attempts to read files with the default file type. Domain to not audit. Create, read, write, and delete files with the default file type. Domain allowed access. Read symbolic links with the default file type. Domain allowed access. Read sockets with the default file type. Domain allowed access. Read named pipes with the default file type. Domain allowed access. Search the contents of /etc directories. Domain allowed access. Set the attributes of the /etc directories. Domain allowed access. List the contents of /etc directories. Domain allowed access. Do not audit attempts to write to /etc dirs. Domain to not audit. Add and remove entries from /etc directories. Domain allowed access. Manage generic directories in /etc Domain allowed access Read generic files in /etc.

Allow the specified domain to read generic files in /etc. These files are typically general system configuration files that do not have more specific SELinux types. Some examples of these files are:

- /etc/fstab
- /etc/passwd
- /etc/services
- /etc/shells

This interface does not include access to /etc/shadow.

Generally, it is safe for many domains to have this access. However, since this interface provides access to the /etc/passwd file, caution must be exercised, as user account names can be leaked through this access.

Related interfaces:

- auth_read_shadow()
- files_read_etc_runtime_files()
- seutil_read_config()

Domain allowed access. Do not audit attempts to write generic files in /etc. Domain allowed access. Read and write generic files in /etc. Domain allowed access. Create, read, write, and delete generic files in /etc. Domain allowed access. Delete system configuration files in /etc. Domain allowed access. Execute generic files in /etc. Domain allowed access. Get etc_t service status. Domain allowed access. Relabel from and to generic files in /etc. Domain allowed access. Read symbolic links in /etc. Domain allowed access. Create, read, write, and delete symbolic links in /etc. Domain allowed access. Create objects in /etc with a private type using a type_transition. Domain allowed access. Private file type. Object classes to be created. The name of the object being created. Create a boot flag.

Create a boot flag, such as /.autorelabel and /.autofsck.

Domain allowed access. The name of the object being created. Delete a boot flag.

Delete a boot flag, such as /.autorelabel and /.autofsck.

Domain allowed access. Do not audit attempts to set the attributes of the etc_runtime files Domain to not audit. Read files in /etc that are dynamically created on boot, such as mtab.

Allow the specified domain to read dynamically created configuration files in /etc. These files are typically general system configuration files that do not have more specific SELinux types. Some examples of these files are:

- /etc/motd
- /etc/mtab
- /etc/nologin

This interface does not include access to /etc/shadow.

Domain allowed access. Do not audit attempts to read files in /etc that are dynamically created on boot, such as mtab. Domain to not audit. Do not audit attempts to write etc runtime files. Domain to not audit. Read and write files in /etc that are dynamically created on boot, such as mtab. Domain allowed access. Create, read, write, and delete files in /etc that are dynamically created on boot, such as mtab. Domain allowed access. Create, etc runtime objects with an automatic type transition. Domain allowed access. The class of the object being created. The name of the object being created. Getattr of directories on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Do not audit attempts to search directories on new filesystems that have not yet been labeled. (Deprecated) Domain to not audit. List the contents of directories on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Read and write directories on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Delete directories on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Create, read, write, and delete directories on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Mount a filesystem on a directory on new filesystems that has not yet been labeled. (Deprecated) Domain allowed access. Read files on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Delete files on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Delete symbolic links on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Delete named pipes on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Delete named sockets on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Delete block files on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Do not audit attempts to write to character files that have not yet been labeled. (Deprecated) Domain to not audit. Delete chr files on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Create, read, write, and delete files on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Create, read, write, and delete symbolic links on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Read and write block device nodes on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Create, read, write, and delete block device nodes on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Create, read, write, and delete character device nodes on new filesystems that have not yet been labeled. (Deprecated) Domain allowed access. Get the attributes of the home directories root (/home). Domain allowed access. Do not audit attempts to get the attributes of the home directories root (/home). Domain to not audit. Search home directories root (/home). Domain allowed access. Do not audit attempts to search home directories root (/home). Domain to not audit. Do not audit attempts to list home directories root (/home). Domain to not audit. Get listing of home directories. Domain allowed access. Relabel to user home root (/home). Domain allowed access. Create objects in /home. Domain allowed access. The private type. The class of the object being created. The name of the object being created. Get the attributes of lost+found directories. Domain allowed access. Do not audit attempts to get the attributes of lost+found directories. Domain to not audit. List the contents of lost+found directories. Domain allowed access. Create, read, write, and delete objects in lost+found directories. Domain allowed access. Search the contents of /mnt. Domain allowed access. Do not audit attempts to search /mnt. Domain to not audit. List the contents of /mnt. Domain allowed access. Do not audit attempts to list the contents of /mnt. Domain allowed access. Mount a filesystem on /mnt. Domain allowed access. Create, read, write, and delete directories in /mnt. Domain allowed access. Create, read, write, and delete files in /mnt. Domain allowed access. read files in /mnt. Domain allowed access. Read symbolic links in /mnt. Domain allowed access. Create, read, write, and delete symbolic links in /mnt. Domain allowed access. Search the contents of the kernel module directories. Domain allowed access. List the contents of the kernel module directories. Domain allowed access. Get the attributes of kernel module files. Domain allowed access. Read kernel module files. Domain allowed access. Write kernel module files. Domain allowed access. Delete kernel module files. Domain allowed access. Create, read, write, and delete kernel module files. Domain allowed access. Relabel from and to kernel module files. Domain allowed access. Create objects in the kernel module directories with a private type via an automatic type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Load kernel module files. Domain allowed access. List world-readable directories. Domain allowed access. Read world-readable files. Domain allowed access. Read world-readable symbolic links. Domain allowed access. Read world-readable named pipes. Domain allowed access. Read world-readable sockets. Domain allowed access. Allow the specified type to associate to a filesystem with the type of the temporary directory (/tmp). Type of the file to associate. Get the attributes of the tmp directory (/tmp). Domain allowed access. Do not audit attempts to get the attributes of the tmp directory (/tmp). Domain allowed access. Search the tmp directory (/tmp). Domain allowed access. Do not audit attempts to search the tmp directory (/tmp). Domain to not audit. Read the tmp directory (/tmp). Domain allowed access. Do not audit listing of the tmp directory (/tmp). Domain not to audit. Remove entries from the tmp directory. Domain allowed access. Read files in the tmp directory (/tmp). Domain allowed access. Manage temporary directories in /tmp. Domain allowed access. Manage temporary files and directories in /tmp. Domain allowed access. Read symbolic links in the tmp directory (/tmp). Domain allowed access. Read and write generic named sockets in the tmp directory (/tmp). Domain allowed access. Mount filesystems in the tmp directory (/tmp) Domain allowed access. Set the attributes of all tmp directories. Domain allowed access. List all tmp directories. Domain allowed access. Relabel to and from all temporary directory types. Domain allowed access. Do not audit attempts to get the attributes of all tmp files. Domain not to audit. Allow attempts to get the attributes of all tmp files. Domain allowed access. Relabel to and from all temporary file types. Domain allowed access. Do not audit attempts to get the attributes of all tmp sock_file. Domain not to audit. Read all tmp files. Domain allowed access. Create an object in the tmp directories, with a private type using a type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Delete the contents of /tmp. Domain allowed access. Set the attributes of the /usr directory. Domain allowed access. Search the content of /usr. Domain allowed access. List the contents of generic directories in /usr. Domain allowed access. Do not audit write of /usr dirs Domain to not audit. Add and remove entries from /usr directories. Domain allowed access. Do not audit attempts to add and remove entries from /usr directories. Domain to not audit. Delete generic directories in /usr in the caller domain. Domain allowed access. Delete generic files in /usr in the caller domain. Domain allowed access. Get the attributes of files in /usr. Domain allowed access. Read generic files in /usr.

Allow the specified domain to read generic files in /usr. These files are various program files that do not have more specific SELinux types. Some examples of these files are:

- /usr/include/*
- /usr/share/doc/*
- /usr/share/info/*

Generally, it is safe for many domains to have this access.

Domain allowed access. Execute generic programs in /usr in the caller domain. Domain allowed access. dontaudit write of /usr files Domain to not audit. Create, read, write, and delete files in the /usr directory. Domain allowed access. Relabel a file to the type used in /usr. Domain allowed access. Relabel a file from the type used in /usr. Domain allowed access. Read symbolic links in /usr. Domain allowed access. Create objects in the /usr directory Domain allowed access. The type of the object to be created The object class. The name of the object being created. Do not audit attempts to search /usr/src. Domain to not audit. Get the attributes of files in /usr/src. Domain allowed access. Read files in /usr/src. Domain allowed access. Execute programs in /usr/src in the caller domain. Domain allowed access. Install a system.map into the /boot directory. Domain allowed access. Read system.map in the /boot directory. Domain allowed access. Delete a system.map in the /boot directory. Domain allowed access. Search the contents of /var. Domain allowed access. Do not audit attempts to write to /var. Domain to not audit. Allow attempts to write to /var.dirs Domain allowed access. Do not audit attempts to search the contents of /var. Domain to not audit. List the contents of /var. Domain allowed access. Do not audit attempts to list the contents of /var. Domain to not audit. Create, read, write, and delete directories in the /var directory. Domain allowed access. Read files in the /var directory. Domain allowed access. Append files in the /var directory. Domain allowed access. Read and write files in the /var directory. Domain allowed access. Do not audit attempts to read and write files in the /var directory. Domain to not audit. Create, read, write, and delete files in the /var directory. Domain allowed access. Read symbolic links in the /var directory. Domain allowed access. Create, read, write, and delete symbolic links in the /var directory. Domain allowed access. Create objects in the /var directory Domain allowed access. The type of the object to be created The object class. The name of the object being created. Get the attributes of the /var/lib directory. Domain allowed access. Search the /var/lib directory.

Search the /var/lib directory. This is necessary to access files or directories under /var/lib that have a private type. For example, a domain accessing a private library file in the /var/lib directory:

allow mydomain_t mylibfile_t:file read_file_perms; files_search_var_lib(mydomain_t)

Domain allowed access. Do not audit attempts to search the contents of /var/lib. Domain to not audit. List the contents of the /var/lib directory. Domain allowed access. Read-write /var/lib directories Domain allowed access. Create objects in the /var/lib directory Domain allowed access. The type of the object to be created The object class. The name of the object being created. Read generic files in /var/lib. Domain allowed access. Read generic symbolic links in /var/lib Domain allowed access. Create, read, write, and delete the pseudorandom number generator seed. Domain allowed access. Allow domain to manage mount tables necessary for rpcd, nfsd, etc. Domain allowed access. Set the attributes of the generic lock directories. Domain allowed access. Search the locks directory (/var/lock). Domain allowed access. Do not audit attempts to search the locks directory (/var/lock). Domain to not audit. List generic lock directories. Domain allowed access. Add entries in the /var/lock directories. Domain allowed access. Add and remove entries in the /var/lock directories. Domain allowed access. Create lock directories Domain allowed access Relabel to and from all lock directory types. Domain allowed access. Get the attributes of generic lock files. Domain allowed access. Delete generic lock files. Domain allowed access. Create, read, write, and delete generic lock files. Domain allowed access. Delete all lock files. Domain allowed access. Read all lock files. Domain allowed access. manage all lock files. Domain allowed access. Relabel from/to all lock files. Domain allowed access. Create an object in the locks directory, with a private type using a type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Do not audit attempts to get the attributes of the /var/run directory. Domain to not audit. Set the attributes of the /var/run directory. Domain allowed access. Search the contents of runtime process ID directories (/var/run). Domain allowed access. Do not audit attempts to search the /var/run directory. Domain to not audit. List the contents of the runtime process ID directories (/var/run). Domain allowed access. Read generic process ID files. Domain allowed access. Write named generic process ID pipes Domain allowed access. Create an object in the process ID directory, with a private type.

Create an object in the process ID directory (e.g., /var/run) with a private type. Typically this is used for creating private PID files in /var/run with the private type instead of the general PID file type. To accomplish this goal, either the program must be SELinux-aware, or use this interface.

Related interfaces:

- files_pid_file()

Example usage with a domain that can create and write its PID file with a private PID file type in the /var/run directory:

type mypidfile_t; files_pid_file(mypidfile_t) allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms }; files_pid_filetrans(mydomain_t, mypidfile_t, file)

Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Create a generic lock directory within the run directories Domain allowed access The name of the object being created. Read and write generic process ID files. Domain allowed access. Do not audit attempts to get the attributes of daemon runtime data files. Domain to not audit. Do not audit attempts to write to daemon runtime data files. Domain to not audit. Do not audit attempts to ioctl daemon runtime data files. Domain to not audit. Read all process ID files. Domain allowed access. Delete all process IDs. Domain allowed access. Delete all process ID directories. Domain allowed access. Create, read, write and delete all var_run (pid) content Domain alloed access. Relabel to/from all var_run (pid) directories Domain alloed access. Relabel to/from all var_run (pid) files and directories Domain alloed access. Mount filesystems on all polyinstantiation member directories. Domain allowed access. Search the contents of generic spool directories (/var/spool). Domain allowed access. Do not audit attempts to search generic spool directories. Domain to not audit. List the contents of generic spool (/var/spool) directories. Domain allowed access. Create, read, write, and delete generic spool directories (/var/spool). Domain allowed access. Read generic spool files. Domain allowed access. Create, read, write, and delete generic spool files. Domain allowed access. Create objects in the spool directory with a private type with a type transition. Domain allowed access. Type to which the created node will be transitioned. Object class(es) (single or set including {}) for which this the transition will occur. The name of the object being created. Allow access to manage all polyinstantiated directories on the system. Domain allowed access. Unconfined access to files. Domain allowed access.
Policy for filesystems.
Contains the initial SID for the filesystems.
Transform specified type into a filesystem type. Domain allowed access. Transform specified type into a filesystem type which does not have extended attribute support. Domain allowed access. Associate the specified file type to persistent filesystems with extended attributes. This allows a file of this type to be created on a filesystem such as ext3, JFS, and XFS. The type of the to be associated. Associate the specified file type to filesystems which lack extended attributes support. This allows a file of this type to be created on a filesystem such as FAT32, and NFS. The type of the to be associated. Execute files on a filesystem that does not support extended attributes. Domain allowed access. Transform specified type into a filesystem type which has extended attribute support. Domain allowed access. Get the attributes of all the filesystems which have extended attributes. This includes pseudo filesystems.

Allow the specified domain to get the attributes of a filesystems which have extended attributes. Example attributes:

- Type of the file system (e.g., tmpfs)
- Size of the file system
- Available space on the file system

Domain allowed access. Mount a persistent filesystem which has extended attributes, such as ext3, JFS, or XFS. Domain allowed access. Remount a persistent filesystem which has extended attributes, such as ext3, JFS, or XFS. This allows some mount options to be changed. Domain allowed access. Unmount a persistent filesystem which has extended attributes, such as ext3, JFS, or XFS. Domain allowed access. Get the attributes of persistent filesystems which have extended attributes, such as ext3, JFS, or XFS.

Allow the specified domain to get the attributes of a persistent filesystems which have extended attributes, such as ext3, JFS, or XFS. Example attributes:

- Type of the file system (e.g., ext3)
- Size of the file system
- Available space on the file system

Domain allowed access. Do not audit attempts to get the attributes of a persistent filesystem which has extended attributes, such as ext3, JFS, or XFS. Domain to not audit. Allow changing of the label of a filesystem with extended attributes using the context= mount option. Domain allowed access. Get the filesystem quotas of a filesystem with extended attributes. Domain allowed access. Set the filesystem quotas of a filesystem with extended attributes. Domain allowed access. Read files on anon_inodefs file systems. Domain allowed access. Read and write files on anon_inodefs file systems. Domain allowed access. Do not audit attempts to read or write files on anon_inodefs file systems. Domain to not audit. Mount an automount pseudo filesystem. Domain allowed access. Remount an automount pseudo filesystem This allows some mount options to be changed. Domain allowed access. Unmount an automount pseudo filesystem. Domain allowed access. Get the attributes of an automount pseudo filesystem. Domain allowed access. Search automount filesystem to use automatically mounted filesystems. Allow the specified domain to search mount points that have filesystems that are mounted by the automount service. Generally this will be required for any domain that accesses objects on these filesystems. Domain allowed access. Read directories of automatically mounted filesystems. Domain allowed access. Do not audit attempts to list directories of automatically mounted filesystems. Domain to not audit. Create, read, write, and delete symbolic links on an autofs filesystem. Domain allowed access. Get the attributes of directories on binfmt_misc filesystems. Domain allowed access. Register an interpreter for new binary file types, using the kernel binfmt_misc support.

Register an interpreter for new binary file types, using the kernel binfmt_misc support.

A common use for this is to register a JVM as an interpreter for Java byte code. Registered binaries can be directly executed on a command line without specifying the interpreter.

Domain allowed access. Mount cgroup filesystems. Domain allowed access. Remount cgroup filesystems. Domain allowed access. Unmount cgroup filesystems. Domain allowed access. Get attributes of cgroup filesystems. Domain allowed access. Search cgroup directories. Domain allowed access. list cgroup directories. Domain allowed access. Delete cgroup directories. Domain allowed access. Manage cgroup directories. Domain allowed access. Relabel cgroup directories. Domain allowed access. Read cgroup files. Domain allowed access. Write cgroup files. Domain allowed access. Read and write cgroup files. Domain allowed access. Do not audit attempts to open, get attributes, read and write cgroup files. Domain to not audit. Manage cgroup files. Domain allowed access. Mount on cgroup directories. Domain allowed access. Do not audit attempts to read dirs on a CIFS or SMB filesystem. Domain to not audit. Mount a CIFS or SMB network filesystem. Domain allowed access. Remount a CIFS or SMB network filesystem. This allows some mount options to be changed. Domain allowed access. Unmount a CIFS or SMB network filesystem. Domain allowed access. Get the attributes of a CIFS or SMB network filesystem. Domain allowed access. Search directories on a CIFS or SMB filesystem. Domain allowed access. List the contents of directories on a CIFS or SMB filesystem. Domain allowed access. Do not audit attempts to list the contents of directories on a CIFS or SMB filesystem. Domain to not audit. Mounton a CIFS filesystem. Domain allowed access. Read files on a CIFS or SMB filesystem. Domain allowed access. Get the attributes of filesystems that do not have extended attribute support. Domain allowed access. Read all noxattrfs directories. Domain allowed access. Do not audit attempts to list all noxattrfs directories. Domain to not audit. Create, read, write, and delete all noxattrfs directories. Domain allowed access. Read all noxattrfs files. Domain allowed access. Do not audit attempts to read all noxattrfs files. Domain to not audit. Dont audit attempts to write to noxattrfs files. Domain to not audit. Create, read, write, and delete all noxattrfs files. Domain allowed access. Read all noxattrfs symbolic links. Domain allowed access. Relabel all objets from filesystems that do not support extended attributes. Domain allowed access. Do not audit attempts to read files on a CIFS or SMB filesystem. Domain to not audit. Append files on a CIFS filesystem. Domain allowed access. dontaudit Append files on a CIFS filesystem. Domain to not audit. Do not audit attempts to read or write files on a CIFS or SMB filesystem. Domain to not audit. Read symbolic links on a CIFS or SMB filesystem. Domain allowed access. Read named pipes on a CIFS or SMB network filesystem. Domain allowed access. Read named sockets on a CIFS or SMB network filesystem. Domain allowed access. Execute files on a CIFS or SMB network filesystem, in the caller domain. Domain allowed access. Create, read, write, and delete directories on a CIFS or SMB network filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete directories on a CIFS or SMB network filesystem. Domain to not audit. Create, read, write, and delete files on a CIFS or SMB network filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete files on a CIFS or SMB network filesystem. Domain to not audit. Create, read, write, and delete symbolic links on a CIFS or SMB network filesystem. Domain allowed access. Create, read, write, and delete named pipes on a CIFS or SMB network filesystem. Domain allowed access. Create, read, write, and delete named sockets on a CIFS or SMB network filesystem. Domain allowed access. Execute a file on a CIFS or SMB filesystem in the specified domain.

Execute a file on a CIFS or SMB filesystem in the specified domain. This allows the specified domain to execute any file on these filesystems in the specified domain. This is not suggested.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

This interface was added to handle home directories on CIFS/SMB filesystems, in particular used by the ssh-agent policy.

Domain allowed to transition. The type of the new process. Create, read, write, and delete dirs on a configfs filesystem. Domain allowed access. Create, read, write, and delete files on a configfs filesystem. Domain allowed access. Mount a DOS filesystem, such as FAT32 or NTFS. Domain allowed access. Remount a DOS filesystem, such as FAT32 or NTFS. This allows some mount options to be changed. Domain allowed access. Unmount a DOS filesystem, such as FAT32 or NTFS. Domain allowed access. Get the attributes of a DOS filesystem, such as FAT32 or NTFS. Domain allowed access. Allow changing of the label of a DOS filesystem using the context= mount option. Domain allowed access. Search dosfs filesystem. Domain allowed access. List dirs DOS filesystem. Domain allowed access. Create, read, write, and delete dirs on a DOS filesystem. Domain allowed access. Read files on a DOS filesystem. Domain allowed access. Create, read, write, and delete files on a DOS filesystem. Domain allowed access. Read files in efivarfs - contains Linux Kernel configuration options for UEFI systems Domain allowed access. Read eventpollfs files.

Read eventpollfs files

This interface has been deprecated, and will be removed in the future.

Domain allowed access. Mount a FUSE filesystem. Domain allowed access. Unmount a FUSE filesystem. Domain allowed access. Mounton a FUSEFS filesystem. Domain allowed access. Search directories on a FUSEFS filesystem. Domain allowed access. Do not audit attempts to list the contents of directories on a FUSEFS filesystem. Domain to not audit. Create, read, write, and delete directories on a FUSEFS filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete directories on a FUSEFS filesystem. Domain to not audit. Read, a FUSEFS filesystem. Domain allowed access. Execute files on a FUSEFS filesystem. Domain allowed access. Create, read, write, and delete files on a FUSEFS filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete files on a FUSEFS filesystem. Domain to not audit. Read symbolic links on a FUSEFS filesystem. Domain allowed access. Get the attributes of an hugetlbfs filesystem. Domain allowed access. List hugetlbfs. Domain allowed access. Manage hugetlbfs dirs. Domain allowed access. Read and write hugetlbfs files. Domain allowed access. Allow the type to associate to hugetlbfs filesystems. The type of the object to be associated. Search inotifyfs filesystem. Domain allowed access. List inotifyfs filesystem. Domain allowed access. Dontaudit List inotifyfs filesystem. Domain to not audit. Create an object in a hugetlbfs filesystem, with a private type using a type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Mount an iso9660 filesystem, which is usually used on CDs. Domain allowed access. Remount an iso9660 filesystem, which is usually used on CDs. This allows some mount options to be changed. Domain allowed access. Unmount an iso9660 filesystem, which is usually used on CDs. Domain allowed access. Get the attributes of an iso9660 filesystem, which is usually used on CDs. Domain allowed access. Get the attributes of files on an iso9660 filesystem, which is usually used on CDs. Domain allowed access. Read files on an iso9660 filesystem, which is usually used on CDs. Domain allowed access. Mount a NFS filesystem. Domain allowed access. Remount a NFS filesystem. This allows some mount options to be changed. Domain allowed access. Unmount a NFS filesystem. Domain allowed access. Get the attributes of a NFS filesystem. Domain allowed access. Search directories on a NFS filesystem. Domain allowed access. List NFS filesystem. Domain allowed access. Do not audit attempts to list the contents of directories on a NFS filesystem. Domain to not audit. Mounton a NFS filesystem. Domain allowed access. Read files on a NFS filesystem. Domain allowed access. Do not audit attempts to read files on a NFS filesystem. Domain to not audit. Read files on a NFS filesystem. Domain allowed access. Execute files on a NFS filesystem. Domain allowed access. Append files on a NFS filesystem. Domain allowed access. dontaudit Append files on a NFS filesystem. Domain to not audit. Do not audit attempts to read or write files on a NFS filesystem. Domain to not audit. Read symbolic links on a NFS filesystem. Domain allowed access. Dontaudit read symbolic links on a NFS filesystem. Domain to not audit. Read named sockets on a NFS filesystem. Domain allowed access. Read named pipes on a NFS network filesystem. Domain allowed access. Get the attributes of directories of RPC file system pipes. Domain allowed access. Search directories of RPC file system pipes. Domain allowed access. Search removable storage directories. Domain allowed access. Do not audit attempts to list removable storage directories. Domain not to audit. Read removable storage files. Domain allowed access. Do not audit attempts to read removable storage files. Domain not to audit. Do not audit attempts to write removable storage files. Domain not to audit. Read removable storage symbolic links. Domain allowed access. Read block nodes on removable filesystems. Domain allowed access. Read and write block nodes on removable filesystems. Domain allowed access. Read directories of RPC file system pipes. Domain allowed access. Read files of RPC file system pipes. Domain allowed access. Read symbolic links of RPC file system pipes. Domain allowed access. Read sockets of RPC file system pipes. Domain allowed access. Read and write sockets of RPC file system pipes. Domain allowed access. Create, read, write, and delete directories on a NFS filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete directories on a NFS filesystem. Domain to not audit. Create, read, write, and delete files on a NFS filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete files on a NFS filesystem. Domain to not audit. Create, read, write, and delete symbolic links on a NFS network filesystem. Domain allowed access. Create, read, write, and delete named pipes on a NFS filesystem. Domain allowed access. Create, read, write, and delete named sockets on a NFS filesystem. Domain allowed access. Execute a file on a NFS filesystem in the specified domain.

Execute a file on a NFS filesystem in the specified domain. This allows the specified domain to execute any file on a NFS filesystem in the specified domain. This is not suggested.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

This interface was added to handle home directories on NFS filesystems, in particular used by the ssh-agent policy.

Domain allowed to transition. The type of the new process. Mount a NFS server pseudo filesystem. Domain allowed access. Mount a NFS server pseudo filesystem. This allows some mount options to be changed. Domain allowed access. Unmount a NFS server pseudo filesystem. Domain allowed access. Get the attributes of a NFS server pseudo filesystem. Domain allowed access. Search NFS server directories. Domain allowed access. List NFS server directories. Domain allowed access. Getattr files on an nfsd filesystem Domain allowed access. Read and write NFS server files. Domain allowed access. Read nsfs inodes (e.g. /proc/pid/ns/uts) Domain allowed access. Getattr on pstore dirs. Domain allowed access. Allow the type to associate to ramfs filesystems. The type of the object to be associated. Mount a RAM filesystem. Domain allowed access. Remount a RAM filesystem. This allows some mount options to be changed. Domain allowed access. Unmount a RAM filesystem. Domain allowed access. Get the attributes of a RAM filesystem. Domain allowed access. Search directories on a ramfs Domain allowed access. Dontaudit Search directories on a ramfs Domain to not audit. Create, read, write, and delete directories on a ramfs. Domain allowed access. Dontaudit read on a ramfs files. Domain to not audit. Dontaudit read on a ramfs fifo_files. Domain to not audit. Create, read, write, and delete files on a ramfs filesystem. Domain allowed access. Write to named pipe on a ramfs filesystem. Domain allowed access. Do not audit attempts to write to named pipes on a ramfs filesystem. Domain to not audit. Read and write a named pipe on a ramfs filesystem. Domain allowed access. Create, read, write, and delete named pipes on a ramfs filesystem. Domain allowed access. Write to named socket on a ramfs filesystem. Domain allowed access. Create, read, write, and delete named sockets on a ramfs filesystem. Domain allowed access. Mount a ROM filesystem. Domain allowed access. Remount a ROM filesystem. This allows some mount options to be changed. Domain allowed access. Unmount a ROM filesystem. Domain allowed access. Get the attributes of a ROM filesystem. Domain allowed access. Mount a RPC pipe filesystem. Domain allowed access. Remount a RPC pipe filesystem. This allows some mount option to be changed. Domain allowed access. Unmount a RPC pipe filesystem. Domain allowed access. Get the attributes of a RPC pipe filesystem. Domain allowed access. Read and write RPC pipe filesystem named pipes. Domain allowed access. Mount a tmpfs filesystem. Domain allowed access. Remount a tmpfs filesystem. Domain allowed access. Unmount a tmpfs filesystem. Domain allowed access. Get the attributes of a tmpfs filesystem. Domain allowed access. Allow the type to associate to tmpfs filesystems. The type of the object to be associated. Relabel from tmpfs filesystem. Domain allowed access. Get the attributes of tmpfs directories. Domain allowed access. Do not audit attempts to get the attributes of tmpfs directories. Domain to not audit. Mount on tmpfs directories. Domain allowed access. Set the attributes of tmpfs directories. Domain allowed access. Search tmpfs directories. Domain allowed access. List the contents of generic tmpfs directories. Domain allowed access. Do not audit attempts to list the contents of generic tmpfs directories. Domain to not audit. Create, read, write, and delete tmpfs directories Domain allowed access. Do not audit attempts to write tmpfs directories Domain to not audit. Relabel directory on tmpfs filesystems. Domain allowed access. Create an object in a tmpfs filesystem, with a private type using a type transition. Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Do not audit attempts to getattr generic tmpfs files. Domain to not audit. Do not audit attempts to read or write generic tmpfs files. Domain to not audit. Create, read, write, and delete auto moutpoints. Domain allowed access. Read generic tmpfs files. Domain allowed access. Read and write generic tmpfs files. Domain allowed access. Relabel files on tmpfs filesystems. Domain allowed access. Read tmpfs link files. Domain allowed access. Read and write character nodes on tmpfs filesystems. Domain allowed access. dontaudit Read and write character nodes on tmpfs filesystems. Domain to not audit. Relabel character nodes on tmpfs filesystems. Domain allowed access. Read and write block nodes on tmpfs filesystems. Domain allowed access. Relabel block nodes on tmpfs filesystems. Domain allowed access. Read and write, create and delete generic files on tmpfs filesystems. Domain allowed access. Read and write, create and delete symbolic links on tmpfs filesystems. Domain allowed access. Read and write, create and delete socket files on tmpfs filesystems. Domain allowed access. Read and write, create and delete character nodes on tmpfs filesystems. Domain allowed access. Read and write, create and delete block nodes on tmpfs filesystems. Domain allowed access. Mount a XENFS filesystem. Domain allowed access. Search the XENFS filesystem. Domain allowed access. Create, read, write, and delete directories on a XENFS filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete directories on a XENFS filesystem. Domain to not audit. Create, read, write, and delete files on a XENFS filesystem. Domain allowed access. Do not audit attempts to create, read, write, and delete files on a XENFS filesystem. Domain to not audit. Mount all filesystems. Domain allowed access. Remount all filesystems. This allows some mount options to be changed. Domain allowed access. Unmount all filesystems. Domain allowed access. Get the attributes of all filesystems.

Allow the specified domain to get the attributes of all filesystems. Example attributes:

- Type of the file system (e.g., ext3)
- Size of the file system
- Available space on the file system

Domain allowed access. Do not audit attempts to get the attributes all filesystems. Domain to not audit. Get the quotas of all filesystems. Domain allowed access. Set the quotas of all filesystems. Domain allowed access. Relabelfrom all filesystems. Domain allowed access. Get the attributes of all directories with a filesystem type. Domain allowed access. Search all directories with a filesystem type. Domain allowed access. List all directories with a filesystem type. Domain allowed access. Get the attributes of all files with a filesystem type. Domain allowed access. Do not audit attempts to get the attributes of all files with a filesystem type. Domain to not audit. Get the attributes of all symbolic links with a filesystem type. Domain allowed access. Do not audit attempts to get the attributes of all symbolic links with a filesystem type. Domain to not audit. Get the attributes of all named pipes with a filesystem type. Domain allowed access. Do not audit attempts to get the attributes of all named pipes with a filesystem type. Domain to not audit. Get the attributes of all named sockets with a filesystem type. Domain allowed access. Do not audit attempts to get the attributes of all named sockets with a filesystem type. Domain to not audit. Get the attributes of all block device nodes with a filesystem type. Domain allowed access. Get the attributes of all character device nodes with a filesystem type. Domain allowed access. Unconfined access to filesystems Domain allowed access.
Policy for kernel threads, proc filesystem, and unlabeled processes and objects.
This module has initial SIDs.
Allows the kernel to start userland processes by dynamic transitions to the specified domain. The process type entered by the kernel. Allows to start userland processes by transitioning to the specified domain. The process type entered by kernel. The executable type for the entrypoint. Allows to start userland processes by transitioning to the specified domain, with a range transition. The process type entered by kernel. The executable type for the entrypoint. Range for the domain. Allows the kernel to mount filesystems on the specified directory type. The type of the directory to use as a mountpoint. Set the process group of kernel threads. Domain allowed access. Set the priority of kernel threads. Domain allowed access. Send a SIGCHLD signal to kernel threads. Domain allowed access. Send a kill signal to kernel threads. Domain allowed access. Send a generic signal to kernel threads. Domain allowed access. Allows the kernel to share state information with the caller. The type of the process with which to share state information. Permits caller to use kernel file descriptors. Domain allowed access. Do not audit attempts to use kernel file descriptors. Domain to not audit. Read and write kernel unnamed pipes. Domain allowed access. Read/write to kernel using a unix domain stream socket. Domain allowed access. Connect to kernel using a unix domain stream socket. Domain allowed access. Getattr on kernel unix datagram sockets. Domain allowed access. Read and write kernel unix datagram sockets. (Deprecated) Domain allowed access. Send messages to kernel unix datagram sockets. Domain allowed access. Receive messages from kernel TCP sockets. (Deprecated) Domain allowed access. Send UDP network traffic to the kernel. (Deprecated) Domain allowed access. Receive messages from kernel UDP sockets. (Deprecated) Domain allowed access. Allows caller to load kernel modules Domain allowed access. Allow search the kernel key ring. Domain allowed access. dontaudit search the kernel key ring. Domain to not audit. Allow link to the kernel key ring. Domain allowed access. dontaudit link to the kernel key ring. Domain to not audit. Allows caller to read the ring buffer. Domain allowed access. Do not audit attempts to read the ring buffer. Domain to not audit. Change the level of kernel messages logged to the console. Domain allowed access. Allows the caller to clear the ring buffer. Domain allowed access. Allows caller to request the kernel to load a module

Allow the specified domain to request that the kernel load a kernel module. An example of this is the auto-loading of network drivers when doing an ioctl() on a network interface.

In the specific case of a module loading request on a network interface, the domain will also need the net_admin capability.

Domain allowed access. Do not audit requests to the kernel to load a module. Domain to not audit. Get information on all System V IPC objects. Domain allowed access. Get the attributes of a kernel debugging filesystem. Domain allowed access. Mount a kernel debugging filesystem. Domain allowed access. Unmount a kernel debugging filesystem. Domain allowed access. Remount a kernel debugging filesystem. Domain allowed access. Search the contents of a kernel debugging filesystem. Domain allowed access. Do not audit attempts to search the kernel debugging filesystem. Domain to not audit. Read information from the debugging filesystem. Domain allowed access. Do not audit attempts to write kernel debugging filesystem dirs. Domain to not audit. Manage information from the debugging filesystem. Domain allowed access. Mount a kernel VM filesystem. Domain allowed access. Unmount the proc filesystem. Domain allowed access. Get the attributes of the proc filesystem. Domain allowed access. Do not audit attempts to set the attributes of directories in /proc. Domain to not audit. Search directories in /proc. Domain allowed access. List the contents of directories in /proc. Domain allowed access. Do not audit attempts to list the contents of directories in /proc. Domain to not audit. Do not audit attempts to write the directories in /proc. Domain to not audit. Get the attributes of files in /proc. Domain allowed access. Read generic symbolic links in /proc.

Allow the specified domain to read (follow) generic symbolic links (symlinks) in the proc filesystem (/proc). This interface does not include access to the targets of these links. An example symlink is /proc/self.

Domain allowed access. Allows caller to read system state information in /proc.

Allow the specified domain to read general system state information from the proc filesystem (/proc).

Generally it should be safe to allow this access. Some example files that can be read based on this interface:

- /proc/cpuinfo
- /proc/meminfo
- /proc/uptime

This does not allow access to sysctl entries (/proc/sys/*) nor process state information (/proc/pid).

Domain allowed access. Write to generic proc entries. Domain allowed access. Do not audit attempts by caller to read system state information in proc. Domain to not audit. Do not audit attempts by caller to read symbolic links in proc. Domain to not audit. Allow caller to read and write state information for AFS. Domain allowed access. Allow caller to read the state information for software raid. Domain allowed access. Allow caller to read and set the state information for software raid. Domain allowed access. Allows caller to get attribues of core kernel interface. Domain allowed access. Do not audit attempts to get the attributes of core kernel interfaces. Domain to not audit. Allows caller to read the core kernel interface. Domain allowed access. Allow caller to read kernel messages using the /proc/kmsg interface. Domain allowed access. Allow caller to get the attributes of kernel message interface (/proc/kmsg). Domain allowed access. Do not audit attempts by caller to get the attributes of kernel message interfaces. Domain to not audit. Do not audit attempts to search the network state directory. Domain to not audit. Allow searching of network state directory. Domain allowed access. Read the network state information.

Allow the specified domain to read the networking state information. This includes several pieces of networking information, such as network interface names, netfilter (iptables) statistics, protocol information, routes, and remote procedure call (RPC) information.

Domain allowed access. Allow caller to read the network state symbolic links. Domain allowed access. Allow searching of xen state directory. Domain allowed access. Do not audit attempts to search the xen state directory. Domain to not audit. Allow caller to read the xen state information. Domain allowed access. Allow caller to read the xen state symbolic links. Domain allowed access. Allow caller to write xen state information. Domain allowed access. Allow attempts to list all proc directories. Domain allowed access. Do not audit attempts to list all proc directories. Domain to not audit. Do not audit attempts by caller to search the base directory of sysctls. Domain to not audit. Allow access to read sysctl directories. Domain allowed access. Allow caller to read the device sysctls. Domain allowed access. Read and write device sysctls. Domain allowed access. Allow caller to search virtual memory sysctls. Domain allowed access. Allow caller to read virtual memory sysctls. Domain allowed access. Read and write virtual memory sysctls. Domain allowed access. Search network sysctl directories. Domain allowed access. Do not audit attempts by caller to search network sysctl directories. Domain to not audit. Allow caller to read network sysctls. Domain allowed access. Allow caller to modiry contents of sysctl network files. Domain allowed access. Allow caller to read unix domain socket sysctls. Domain allowed access. Read and write unix domain socket sysctls. Domain allowed access. Read the hotplug sysctl. Domain allowed access. Read and write the hotplug sysctl. Domain allowed access. Read the modprobe sysctl. Domain allowed access. Read and write the modprobe sysctl. Domain allowed access. Do not audit attempts to search generic kernel sysctls. Domain to not audit. Read generic crypto sysctls. Domain allowed access. Read general kernel sysctls.

Allow the specified domain to read general kernel sysctl settings. These settings are typically read using the sysctl program. The settings that are included by this interface are prefixed with "kernel.", for example, kernel.sysrq.

This does not include access to the hotplug handler setting (kernel.hotplug) nor the module installer handler setting (kernel.modprobe).

Related interfaces:

- kernel_rw_kernel_sysctl()

Domain allowed access. Do not audit attempts to write generic kernel sysctls. Domain to not audit. Read and write generic kernel sysctls. Domain allowed access. Read filesystem sysctls. Domain allowed access. Read and write fileystem sysctls. Domain allowed access. Read IRQ sysctls. Domain allowed access. Read and write IRQ sysctls. Domain allowed access. Read RPC sysctls. Domain allowed access. Read and write RPC sysctls. Domain allowed access. Do not audit attempts to list all sysctl directories. Domain to not audit. Allow caller to read all sysctls. Domain allowed access. Read and write all sysctls. Domain allowed access. Send a kill signal to unlabeled processes. Domain allowed access. Mount a kernel unlabeled filesystem. Domain allowed access. Unmount a kernel unlabeled filesystem. Domain allowed access. Send general signals to unlabeled processes. Domain allowed access. Send a null signal to unlabeled processes. Domain allowed access. Send a stop signal to unlabeled processes. Domain allowed access. Send a child terminated signal to unlabeled processes. Domain allowed access. Get the attributes of unlabeled directories. Domain allowed access. Do not audit attempts to search unlabeled directories. Domain to not audit. List unlabeled directories. Domain allowed access. Read the process state (/proc/pid) of all unlabeled_t. Domain allowed access. Do not audit attempts to list unlabeled directories. Domain allowed access. Read and write unlabeled directories. Domain allowed access. Delete unlabeled directories. Domain allowed access. Create, read, write, and delete unlabeled directories. Domain allowed access. Mount a filesystem on an unlabeled directory. Domain allowed access. Read unlabeled files. Domain allowed access. Read and write unlabeled files. Domain allowed access. Delete unlabeled files. Domain allowed access. Create, read, write, and delete unlabeled files. Domain allowed access. Do not audit attempts by caller to get the attributes of an unlabeled file. Domain to not audit. Do not audit attempts by caller to read an unlabeled file. Domain to not audit. Delete unlabeled symbolic links. Domain allowed access. Create, read, write, and delete unlabeled symbolic links. Domain allowed access. Do not audit attempts by caller to get the attributes of unlabeled symbolic links. Domain to not audit. Do not audit attempts by caller to get the attributes of unlabeled named pipes. Domain to not audit. Do not audit attempts by caller to get the attributes of unlabeled named sockets. Domain to not audit. Do not audit attempts by caller to get attributes for unlabeled block devices. Domain to not audit. Read and write unlabeled block device nodes. Domain allowed access. Delete unlabeled block device nodes. Domain allowed access. Create, read, write, and delete unlabeled block device nodes. Domain allowed access. Do not audit attempts by caller to get attributes for unlabeled character devices. Domain to not audit. Do not audit attempts to write unlabeled character devices. Domain to not audit. Delete unlabeled character device nodes. Domain allowed access. Create, read, write, and delete unlabeled character device nodes. Domain allowed access. Allow caller to relabel unlabeled directories. Domain allowed access. Allow caller to relabel unlabeled files. Domain allowed access. Allow caller to relabel unlabeled symbolic links. Domain allowed access. Allow caller to relabel unlabeled named pipes. Domain allowed access. Delete unlabeled named pipes Domain allowed access. Allow caller to relabel unlabeled named sockets. Domain allowed access. Delete unlabeled named sockets. Domain allowed access. Send and receive messages from an unlabeled IPSEC association.

Send and receive messages from an unlabeled IPSEC association. Network connections that are not protected by IPSEC have use an unlabeled assocation.

The corenetwork interface corenet_non_ipsec_sendrecv() should be used instead of this one.

Domain allowed access. Do not audit attempts to send and receive messages from an unlabeled IPSEC association.

Do not audit attempts to send and receive messages from an unlabeled IPSEC association. Network connections that are not protected by IPSEC have use an unlabeled assocation.

The corenetwork interface corenet_dontaudit_non_ipsec_sendrecv() should be used instead of this one.

Domain to not audit. Receive TCP packets from an unlabeled connection.

Receive TCP packets from an unlabeled connection.

The corenetwork interface corenet_tcp_recv_unlabeled() should be used instead of this one.

Domain allowed access. Do not audit attempts to receive TCP packets from an unlabeled connection.

Do not audit attempts to receive TCP packets from an unlabeled connection.

The corenetwork interface corenet_dontaudit_tcp_recv_unlabeled() should be used instead of this one.

Domain to not audit. Receive UDP packets from an unlabeled connection.

Receive UDP packets from an unlabeled connection.

The corenetwork interface corenet_udp_recv_unlabeled() should be used instead of this one.

Domain allowed access. Do not audit attempts to receive UDP packets from an unlabeled connection.

Do not audit attempts to receive UDP packets from an unlabeled connection.

The corenetwork interface corenet_dontaudit_udp_recv_unlabeled() should be used instead of this one.

Domain to not audit. Receive Raw IP packets from an unlabeled connection.

Receive Raw IP packets from an unlabeled connection.

The corenetwork interface corenet_raw_recv_unlabeled() should be used instead of this one.

Domain allowed access. Do not audit attempts to receive Raw IP packets from an unlabeled connection.

Do not audit attempts to receive Raw IP packets from an unlabeled connection.

The corenetwork interface corenet_dontaudit_raw_recv_unlabeled() should be used instead of this one.

Domain to not audit. Send and receive unlabeled packets.

Send and receive unlabeled packets. These packets do not match any netfilter SECMARK rules.

The corenetwork interface corenet_sendrecv_unlabeled_packets() should be used instead of this one.

Domain allowed access. Receive packets from an unlabeled peer.

Receive packets from an unlabeled peer, these packets do not have any peer labeling information present.

The corenetwork interface corenet_recvfrom_unlabeled_peer() should be used instead of this one.

Domain allowed access. Do not audit attempts to receive packets from an unlabeled peer.

Do not audit attempts to receive packets from an unlabeled peer, these packets do not have any peer labeling information present.

The corenetwork interface corenet_dontaudit_*_recvfrom_unlabeled() should be used instead of this one.

Domain to not audit. Relabel from unlabeled database objects. Domain allowed access. Unconfined access to kernel module resources. Domain allowed access. Read virtual memory overcommit sysctl. Domain allowed access. Read and write virtual memory overcommit sysctl. Domain allowed access.

Disable kernel module loading.

Multicategory security policy
Contains attributes used in MCS policy.
Constrain by category access control (MCS).

Constrain the specified type by category based access control (MCS) This prevents this domain from interacting with subjects and operating on objects that it otherwise would be able to interact with or operate on respectively.

Type to be constrained by MCS. This domain is allowed to read files and directories regardless of their MCS category set. Domain target for user exemption. This domain is allowed to write files and directories regardless of their MCS category set. Domain target for user exemption. This domain is allowed to sigkill and sigstop all domains regardless of their MCS category set. Domain target for user exemption. This domain is allowed to ptrace all domains regardless of their MCS category set. Domain target for user exemption. Make specified domain MCS trusted for setting any category set for the processes it executes. Domain target for user exemption.
Multilevel security policy

This module contains interfaces for handling multilevel security. The interfaces allow the specified subjects and objects to be allowed certain privileges in the MLS rules.

Contains attributes used in MLS policy.
Make specified domain MLS trusted for reading from files up to its clearance. Domain allowed access. Make specified domain MLS trusted for reading from files at all levels. (Deprecated)

Make specified domain MLS trusted for reading from files at all levels.

This interface has been deprecated, please use mls_file_read_all_levels() instead.

Domain allowed access. Make specified domain MLS trusted for reading from files at all levels. Domain allowed access. Make specified domain MLS trusted for write to files up to its clearance. Domain allowed access. Make specified domain MLS trusted for relabelto to files up to its clearance. Domain allowed access. Make specified domain MLS trusted for writing to files at all levels. (Deprecated)

Make specified domain MLS trusted for writing to files at all levels.

This interface has been deprecated, please use mls_file_write_all_levels() instead.

Domain allowed access. Make specified domain MLS trusted for writing to files at all levels. Domain allowed access. Make specified domain MLS trusted for raising the level of files. Domain allowed access. Make specified domain MLS trusted for lowering the level of files. Domain allowed access. Make specified domain trusted to be written to within its MLS range. The subject's MLS range must be a proper subset of the object's MLS range. Domain allowed access. Make specified domain MLS trusted for reading from sockets at any level. Domain allowed access. Make specified domain MLS trusted for reading from sockets at any level that is dominated by the process clearance. Domain allowed access. Make specified domain MLS trusted for writing to sockets up to its clearance. Domain allowed access. Make specified domain MLS trusted for writing to sockets at any level. Domain allowed access. Make specified domain MLS trusted for receiving network data from network interfaces or hosts at any level. Domain allowed access. Make specified domain trusted to write to network objects within its MLS range. The subject's MLS range must be a proper subset of the object's MLS range. Domain allowed access. Make specified domain trusted to write inbound packets regardless of the network's or node's MLS range. Domain allowed access. Make specified domain trusted to write outbound packets regardless of the network's or node's MLS range. Domain allowed access. Make specified domain MLS trusted for reading from System V IPC objects up to its clearance. Domain allowed access. Make specified domain MLS trusted for reading from System V IPC objects at any level. Domain allowed access. Make specified domain MLS trusted for writing to System V IPC objects up to its clearance. Domain allowed access. Make specified domain MLS trusted for writing to System V IPC objects at any level. Domain allowed access. Allow the specified domain to do a MLS range transition that changes the current level. Domain allowed access. Make specified domain a target domain for MLS range transitions that change the current level. Domain allowed access. Make specified domain MLS trusted for reading from processes up to its clearance. Domain allowed access. Make specified domain MLS trusted for reading from processes at all levels. (Deprecated)

Make specified domain MLS trusted for reading from processes at all levels.

This interface has been deprecated, please use mls_process_read_all_levels() instead.

Domain allowed access. Make specified domain MLS trusted for reading from processes at all levels. Domain allowed access. Make specified domain MLS trusted for writing to processes up to its clearance. Domain allowed access. Make specified domain MLS trusted for writing to processes at all levels. (Deprecated)

Make specified domain MLS trusted for writing to processes at all levels.

This interface has been deprecated, please use mls_process_write_all_levels() instead.

Domain allowed access. Make specified domain MLS trusted for writing to processes at all levels. Domain allowed access. Make specified domain MLS trusted for setting the level of processes it executes. Domain allowed access. Make specified domain MLS trusted for reading from X objects up to its clearance. Domain allowed access. Make specified domain MLS trusted for reading from X objects at any level. Domain allowed access. Make specified domain MLS trusted for write to X objects up to its clearance. Domain allowed access. Make specified domain MLS trusted for writing to X objects at any level. Domain allowed access. Make specified domain MLS trusted for reading from X colormaps at any level. Domain allowed access. Make specified domain MLS trusted for writing to X colormaps at any level. Domain allowed access. Make specified object MLS trusted.

Make specified object MLS trusted. This allows all levels to read and write the object.

This currently only applies to filesystem objects, for example, files and directories.

The type of the object. Make specified socket MLS trusted.

Make specified socket MLS trusted. For sockets marked as such, this allows all levels to: * sendto to unix_dgram_sockets * connectto to unix_stream_sockets respectively.

The type of the object. Make the specified domain trusted to inherit and use file descriptors from all levels. Domain allowed access. Make the file descriptors from the specifed domain inheritable by all levels. Domain allowed access. Make specified domain MLS trusted for translating contexts at all levels. Domain allowed access. Make specified domain MLS trusted for reading from databases at any level. Domain allowed access. Make specified domain MLS trusted for writing to databases at any level. Domain allowed access. Make specified domain MLS trusted for raising the level of databases. Domain allowed access. Make specified domain MLS trusted for lowering the level of databases. Domain allowed access. Make specified domain MLS trusted for sending dbus messages to all levels. Domain allowed access. Make specified domain MLS trusted for receiving dbus messages from all levels. Domain allowed access.
Policy for kernel security interface, in particular, selinuxfs.
Contains the policy for the kernel SELinux security interface.
Make the specified type used for labeling SELinux Booleans. This interface is only usable in the base module.

Make the specified type used for labeling SELinux Booleans.

This makes use of genfscon statements, which are only available in the base module. Thus any module which calls this interface must be included in the base module.

Type used for labeling a Boolean. Name of the Boolean. Get the mountpoint of the selinuxfs filesystem. Domain allowed access. Do not audit attempts to get the mountpoint of the selinuxfs filesystem. Domain to not audit. Mount the selinuxfs filesystem. Domain allowed access. Remount the selinuxfs filesystem. This allows some mount options to be changed. Domain allowed access. Unmount the selinuxfs filesystem. Domain allowed access. Get the attributes of the selinuxfs filesystem Domain allowed access. Do not audit attempts to get the attributes of the selinuxfs filesystem Domain to not audit. Do not audit attempts to get the attributes of the selinuxfs directory. Domain to not audit. Search selinuxfs. Domain allowed access. Do not audit attempts to search selinuxfs. Domain to not audit. Do not audit attempts to read generic selinuxfs entries Domain to not audit. Allows the caller to get the mode of policy enforcement (enforcing or permissive mode). Domain allowed access. Allow caller to set the mode of policy enforcement (enforcing or permissive mode).

Allow caller to set the mode of policy enforcement (enforcing or permissive mode).

Since this is a security event, this action is always audited.

Domain allowed access. Allow caller to load the policy into the kernel. Domain allowed access. Allow caller to read the policy from the kernel. Domain allowed access. Allow caller to set the state of Booleans to enable or disable conditional portions of the policy. (Deprecated)

Allow caller to set the state of Booleans to enable or disable conditional portions of the policy.

Since this is a security event, this action is always audited.

This interface has been deprecated. Please use selinux_set_generic_booleans() or selinux_set_all_booleans() instead.

Domain allowed access. Allow caller to set the state of generic Booleans to enable or disable conditional portions of the policy.

Allow caller to set the state of generic Booleans to enable or disable conditional portions of the policy.

Since this is a security event, this action is always audited.

Domain allowed access. Allow caller to set the state of all Booleans to enable or disable conditional portions of the policy.

Allow caller to set the state of all Booleans to enable or disable conditional portions of the policy.

Since this is a security event, this action is always audited.

Domain allowed access. Allow caller to set SELinux access vector cache parameters.

Allow caller to set SELinux access vector cache parameters. The allows the domain to set performance related parameters of the AVC, such as cache threshold.

Since this is a security event, this action is always audited.

Domain allowed access. Allows caller to validate security contexts. Domain allowed access. Do not audit attempts to validate security contexts. Domain to not audit. Allows caller to compute an access vector. Domain allowed access. Calculate the default type for object creation. Domain allowed access. Allows caller to compute polyinstatntiated directory members. Domain allowed access. Calculate the context for relabeling objects.

Calculate the context for relabeling objects. This is determined by using the type_change rules in the policy, and is generally used for determining the context for relabeling a terminal when a user logs in.

Domain allowed access. Allows caller to compute possible contexts for a user. Domain allowed access. Unconfined access to the SELinux kernel security server. Domain allowed access.

Boolean to determine whether the system permits loading policy, setting enforcing mode, and changing boolean values. Set this to true and you have to reboot to set it back.

Policy controlling access to storage devices
Allow the caller to get the attributes of fixed disk device nodes. Domain allowed access. Do not audit attempts made by the caller to get the attributes of fixed disk device nodes. Domain to not audit. Allow the caller to set the attributes of fixed disk device nodes. Domain allowed access. Do not audit attempts made by the caller to set the attributes of fixed disk device nodes. Domain to not audit. Allow the caller to directly read from a fixed disk. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Do not audit attempts made by the caller to read fixed disk device nodes. Domain to not audit. Allow the caller to directly write to a fixed disk. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Do not audit attempts made by the caller to write fixed disk device nodes. Domain to not audit. Allow the caller to directly read and write to a fixed disk. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Allow the caller to create fixed disk device nodes. Domain allowed access. Allow the caller to delete fixed disk device nodes. Domain allowed access. Create, read, write, and delete fixed disk device nodes. Domain allowed access. Create block devices in /dev with the fixed disk type via an automatic type transition. Domain allowed access. Optional filename of the block device to be created Create block devices in on a tmpfs filesystem with the fixed disk type via an automatic type transition. Domain allowed access. Relabel fixed disk device nodes. Domain allowed access. Enable a fixed disk device as swap space Domain allowed access. Allow the caller to get the attributes of device nodes of fuse devices. Domain allowed access. read or write fuse device interfaces. Domain allowed access. Do not audit attempts to read or write fuse device interfaces. Domain to not audit. Allow the caller to get the attributes of the generic SCSI interface device nodes. Domain allowed access. Allow the caller to set the attributes of the generic SCSI interface device nodes. Domain allowed access. Allow the caller to directly read, in a generic fashion, from any SCSI device. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Allow the caller to directly write, in a generic fashion, from any SCSI device. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Set attributes of the device nodes for the SCSI generic inerface. Domain allowed access. Do not audit attempts to read or write SCSI generic device interfaces. Domain to not audit. Allow the caller to get the attributes of removable devices device nodes. Domain allowed access. Do not audit attempts made by the caller to get the attributes of removable devices device nodes. Domain to not audit. Do not audit attempts made by the caller to read removable devices device nodes. Domain to not audit. Do not audit attempts made by the caller to write removable devices device nodes. Domain to not audit. Allow the caller to set the attributes of removable devices device nodes. Domain allowed access. Do not audit attempts made by the caller to set the attributes of removable devices device nodes. Domain to not audit. Allow the caller to directly read from a removable device. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Do not audit attempts to directly read removable devices. Domain to not audit. Allow the caller to directly write to a removable device. This is extremely dangerous as it can bypass the SELinux protections for filesystem objects, and should only be used by trusted domains. Domain allowed access. Do not audit attempts to directly write removable devices. Domain to not audit. Allow the caller to directly read a tape device. Domain allowed access. Allow the caller to directly write a tape device. Domain allowed access. Allow the caller to get the attributes of device nodes of tape devices. Domain allowed access. Allow the caller to set the attributes of device nodes of tape devices. Domain allowed access. Unconfined access to storage devices. Domain allowed access.
Policy for terminals.
Depended on by other required modules.
Transform specified type into a pty type. An object type that will applied to a pty. Transform specified type into an user pty type. This allows it to be relabeled via type change by login programs such as ssh. The type of the user domain associated with this pty. An object type that will applied to a pty. Transform specified type into a pty type used by login programs, such as sshd. An object type that will applied to a pty. Transform specified type into a tty type. An object type that will applied to a tty. Transform specified type into a user tty type. User domain that is related to this tty. An object type that will applied to a tty. Create a pty in the /dev/pts directory. The type of the process creating the pty. The type of the pty. Write the console, all ttys and all ptys. Domain allowed access. Read and write the console, all ttys and all ptys. Domain allowed access. Write to the console. Domain allowed access. Read from the console. Domain allowed access. Do not audit attempts to read from the console. Domain to not audit. Read from and write to the console. Domain allowed access. Do not audit attemtps to read from or write to the console. Domain to not audit. Set the attributes of the console device node. Domain allowed access. Relabel from and to the console type. Domain allowed access. Create the console device (/dev/console). Domain allowed access. Get the attributes of a pty filesystem Domain allowed access. Relabel from and to pty filesystem. Domain allowed access. Do not audit attempts to get the attributes of the /dev/pts directory. Domain to not audit. Search the contents of the /dev/pts directory. Domain allowed access. Do not audit attempts to search the contents of the /dev/pts directory. Domain to not audit. Read the /dev/pts directory to list all ptys. Domain allowed access. Do not audit attempts to read the /dev/pts directory. Domain to not audit. Do not audit attempts to create, read, write, or delete the /dev/pts directory. Domain to not audit. Relabel from and to pty directories. Domain allowed access. Get the attributes of generic pty devices. Domain to allow Do not audit attempts to get the attributes of generic pty devices. Domain to not audit. ioctl of generic pty devices. Domain allowed access. Allow setting the attributes of generic pty devices. Domain allowed access. Dontaudit setting the attributes of generic pty devices. Domain to not audit. Read and write the generic pty type. This is generally only used in the targeted policy. Domain allowed access. Dot not audit attempts to read and write the generic pty type. This is generally only used in the targeted policy. Domain to not audit. Set the attributes of the tty device Domain allowed access. Read and write the controlling terminal (/dev/tty). Domain allowed access. Get the attributes of the pty multiplexor (/dev/ptmx). Domain to not audit. Do not audit attempts to get attributes on the pty multiplexor (/dev/ptmx). Domain to not audit. Read and write the pty multiplexor (/dev/ptmx). Domain allowed access. Do not audit attempts to read and write the pty multiplexor (/dev/ptmx). Domain to not audit. Get the attributes of all pty device nodes. Domain allowed access. Do not audit attempts to get the attributes of any pty device nodes. Domain to not audit. Set the attributes of all pty device nodes. Domain allowed access. Relabel to all ptys. Domain allowed access. Write to all ptys. Domain allowed access. Read and write all ptys. Domain allowed access. Do not audit attempts to read or write any ptys. Domain to not audit. Relabel from and to all pty device nodes. Domain allowed access. Get the attributes of all user pty device nodes. (Deprecated) Domain allowed access. Do not audit attempts to get the attributes of any user pty device nodes. (Deprecated) Domain allowed access. Set the attributes of all user pty device nodes. (Deprecated) Domain allowed access. Relabel to all user ptys. (Deprecated) Domain allowed access. Write to all user ptys. (Deprecated) Domain allowed access. Read and write all user ptys. (Deprecated) Domain allowed access. Do not audit attempts to read any user ptys. (Deprecated) Domain to not audit. Relabel from and to all user user pty device nodes. (Deprecated) Domain allowed access. Get the attributes of all unallocated tty device nodes. Domain allowed access. Do not audit attempts to get the attributes of all unallocated tty device nodes. Domain to not audit. Set the attributes of all unallocated tty device nodes. Domain allowed access. Do not audit attempts to set the attributes of unallocated tty device nodes. Domain to not audit. Do not audit attempts to ioctl unallocated tty device nodes. Domain to not audit. Relabel from and to the unallocated tty type. Domain allowed access. Relabel from all user tty types to the unallocated tty type. Domain allowed access. Append to unallocated ttys. Domain allowed access. Write to unallocated ttys. Domain allowed access. Read and write unallocated ttys. Domain allowed access. Do not audit attempts to read or write unallocated ttys. Domain to not audit. Get the attributes of all tty device nodes. Domain allowed access. Do not audit attempts to get the attributes of any tty device nodes. Domain to not audit. Set the attributes of all tty device nodes. Domain allowed access. Relabel from and to all tty device nodes. Domain allowed access. Write to all ttys. Domain allowed access. Read and write all ttys. Domain allowed access. Do not audit attempts to read or write any ttys. Domain to not audit. Get the attributes of all user tty device nodes. (Deprecated) Domain allowed access. Do not audit attempts to get the attributes of any user tty device nodes. (Deprecated) Domain to not audit. Set the attributes of all user tty device nodes. (Deprecated) Domain allowed access. Relabel from and to all user user tty device nodes. (Deprecated) Domain allowed access. Write to all user ttys. (Deprecated) Domain allowed access. Read and write all user to all user ttys. (Deprecated) Domain allowed access. Do not audit attempts to read or write any user ttys. (Deprecated) Domain allowed access. Read from and write virtio console. Domain allowed access.
User-based access control policy
Contains attributes used in UBAC policy.
Constrain by user-based access control (UBAC).

Constrain the specified type by user-based access control (UBAC). Typically, these are user processes or user files that need to be differentiated by SELinux user. Normally this does not include administrative or privileged programs. For the UBAC rules to be enforced, both the subject (source) type and the object (target) types must be UBAC constrained.

Type to be constrained by UBAC. Exempt user-based access control for files. Domain to be exempted. Exempt user-based access control for processes. Domain to be exempted. Exempt user-based access control for file descriptors. Domain to be exempted. Exempt user-based access control for sockets. Domain to be exempted. Exempt user-based access control for SysV IPC. Domain to be exempted. Exempt user-based access control for X Windows. Domain to be exempted. Exempt user-based access control for dbus. Domain to be exempted. Exempt user-based access control for keys. Domain to be exempted. Exempt user-based access control for databases. Domain to be exempted.
Policy modules for user roles.
Audit administrator role
Change to the audit administrator role. Role allowed access. Change from the audit administrator role.

Change from the audit administrator role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.
Log administrator role
Change to the log administrator role. Role allowed access. Change from the log administrator role.

Change from the log administrator role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.
Security administrator role
Change to the security administrator role. Role allowed access. Change from the security administrator role.

Change from the security administrator role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.
Administrator's unprivileged user role
Change to the staff role. Role allowed access. Change from the staff role.

Change from the staff role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.
General system administration role
Change to the system administrator role. Role allowed access. Change from the system administrator role.

Change from the system administrator role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access. Execute a shell in the sysadm domain. Domain allowed access. Execute a generic bin program in the sysadm domain. Domain allowed access. Execute all entrypoint files in the sysadm domain. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed access. Allow sysadm to execute all entrypoint files in a specified domain. This is an explicit transition, requiring the caller to use setexeccon().

Allow sysadm to execute all entrypoint files in a specified domain. This is an explicit transition, requiring the caller to use setexeccon().

This is a interface to support third party modules and its use is not allowed in upstream reference policy.

Domain allowed access. Allow sysadm to execute a generic bin program in a specified domain. This is an explicit transition, requiring the caller to use setexeccon().

Allow sysadm to execute a generic bin program in a specified domain.

This is a interface to support third party modules and its use is not allowed in upstream reference policy.

Domain to execute in. Send a SIGCHLD signal to sysadm users. Domain allowed access. Inherit and use sysadm file descriptors Domain allowed access. Read and write sysadm user unnamed pipes. Domain allowed access.

Allow sysadm to debug or ptrace all processes.

Generic unprivileged user role
Change to the generic user role. Role allowed access. Change from the generic user role.

Change from the generic user role to the specified role.

This is an interface to support third party modules and its use is not allowed in upstream reference policy.

Role allowed access.
Policy modules for system services, like cron, and network services, like sshd.
PostgreSQL relational database
Role access for SE-PostgreSQL. The role associated with the user domain. The type of the user domain. Marks as a SE-PostgreSQL loadable shared library module Type marked as a database object type. Marks as a SE-PostgreSQL database object type Type marked as a database object type. Marks as a SE-PostgreSQL schema object type Type marked as a schema object type. Marks as a SE-PostgreSQL table/column/tuple object type Type marked as a table/column/tuple object type. Marks as a SE-PostgreSQL system table/column/tuple object type Type marked as a table/column/tuple object type. Marks as a SE-PostgreSQL sequence type Type marked as a sequence type. Marks as a SE-PostgreSQL view object type Type marked as a view object type. Marks as a SE-PostgreSQL procedure object type Type marked as a procedure object type. Marks as a SE-PostgreSQL trusted procedure object type Type marked as a trusted procedure object type. Marks as a SE-PostgreSQL procedural language object type Type marked as a procedural language object type. Marks as a SE-PostgreSQL binary large object type Type marked as a database binary large object type. Allow the specified domain to search postgresql's database directory. Domain allowed access. Allow the specified domain to manage postgresql's database. Domain allowed access. Execute postgresql in the postgresql domain. Domain allowed to transition. Allow domain to signal postgresql Domain allowed access. Allow the specified domain to read postgresql's etc. Domain allowed access. Allow the specified domain to connect to postgresql with a tcp socket. Domain allowed access. Allow the specified domain to connect to postgresql with a unix socket. Domain allowed access. Allow the specified domain unprivileged accesses to unifined database objects managed by SE-PostgreSQL, Domain allowed access. Allow the specified domain unconfined accesses to any database objects managed by SE-PostgreSQL, Domain allowed access. All of the rules required to administrate an postgresql environment Domain allowed access. The role to be allowed to manage the postgresql domain.

Allow unprived users to execute DDL statement

Allow transmit client label to foreign database

Allow database admins to execute DML statement

Secure shell client and server policy.
Basic SSH client template.

This template creates a derived domains which are used for ssh client sessions. A derived type is also created to protect the user ssh keys.

This template was added for NX.

The prefix of the domain (e.g., user is the prefix for user_t).
The type of the domain.
The role associated with the user domain.
The template to define a ssh server.

This template creates a domains to be used for creating a ssh server. This is typically done to have multiple ssh servers of different sensitivities, such as for an internal network-facing ssh server, and a external network-facing ssh server.

The prefix of the server domain (e.g., sshd is the prefix for sshd_t).
Role access for ssh
The prefix of the role (e.g., user is the prefix for user_r).
Role allowed access
User domain for the role
Send a SIGCHLD signal to the ssh server. Domain allowed access. Send a generic signal to the ssh server. Domain allowed access. Send a null signal to sshd processes. Domain allowed access. Read a ssh server unnamed pipe. Domain allowed access. Read and write a ssh server unnamed pipe. Domain allowed access. Read and write ssh server unix domain stream sockets. Domain allowed access. Read and write ssh server TCP sockets. Domain allowed access. Do not audit attempts to read and write ssh server TCP sockets. Domain to not audit. Connect to SSH daemons over TCP sockets. (Deprecated) Domain allowed access. Execute the ssh daemon sshd domain. Domain allowed to transition. Execute the ssh client in the caller domain. Domain allowed access. Set the attributes of sshd key files. Domain allowed access. Execute the ssh agent client in the caller domain. Domain allowed access. Read ssh home directory content Domain allowed access. Execute the ssh key generator in the ssh keygen domain. Domain allowed to transition. Read ssh server keys Domain to not audit. Manage ssh home directory content Domain allowed access. Delete from the ssh temp files. Domain allowed access.

allow host key based authentication

Allow ssh logins as sysadm_r:sysadm_t

Allow ssh to use gpg-agent

X Windows Server
Rules required for using the X Windows server and environment, for restricted users. Role allowed access. Domain allowed access. Rules required for using the X Windows server and environment. Role allowed access. Domain allowed access. Create sessions on the X server, with read-only access to the X server shared memory segments. Domain allowed access. The type of the domain SYSV tmpfs files. Create sessions on the X server, with read and write access to the X server shared memory segments. Domain allowed access. The type of the domain SYSV tmpfs files. Create non-drawing client sessions on an X server. Domain allowed access. Create full client sessions on a user X server. Domain allowed access. The type of the domain SYSV tmpfs files. Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application. The prefix of the X client domain (e.g., user is the prefix for user_t). Client domain allowed access. Template for creating the set of types used in an X windows domain. The prefix of the X client domain (e.g., user is the prefix for user_t). Interface to provide X object permissions on a given X server to an X client domain. Provides the minimal set required by a basic X client application. The prefix of the X client domain (e.g., user is the prefix for user_t). Client domain allowed access. The type of the domain SYSV tmpfs files. Read user fonts, user font configuration, and manage the user font cache.

Read user fonts, user font configuration, and manage the user font cache.

This is a templated interface, and should only be called from a per-userdomain template.

Domain allowed access. Transition to the Xauthority domain. Domain allowed to transition. Create a Xauthority file in the user home directory. Domain allowed access. Read all users fonts, user font configurations, and manage all users font caches. Domain allowed access. Read all users .Xauthority. Domain allowed access. Set the attributes of the X windows console named pipes. Domain allowed access. Read and write the X windows console named pipe. Domain allowed access. Use file descriptors for xdm. Domain allowed access. Do not audit attempts to inherit XDM file descriptors. Domain to not audit. Read and write XDM unnamed pipes. Domain allowed access. Do not audit attempts to read and write XDM unnamed pipes. Domain to not audit. Send and receive messages from xdm over dbus. Domain allowed access. Read xdm process state files. Domain allowed access. Create, read, write, and delete xdm_spool files. Domain allowed access. Connect to XDM over a unix domain stream socket. Domain allowed access. Read xdm-writable configuration files. Domain allowed access. Set the attributes of XDM temporary directories. Domain allowed access. Create a named socket in a XDM temporary directory. Domain allowed access. Read XDM pid files. Domain allowed access. Read XDM var lib files. Domain allowed access. Make an X session script an entrypoint for the specified domain. The domain for which the shell is an entrypoint. Execute an X session in the target domain. This is an explicit transition, requiring the caller to use setexeccon().

Execute an Xsession in the target domain. This is an explicit transition, requiring the caller to use setexeccon().

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. The type of the shell process. Get the attributes of X server logs. Domain allowed access. Do not audit attempts to write the X server log files. Domain to not audit. Delete X server log files. Domain allowed access. Read X keyboard extension libraries. Domain allowed access. Read xdm temporary files. Domain allowed access. Do not audit attempts to read xdm temporary files. Domain to not audit. Read write xdm temporary files. Domain allowed access. Create, read, write, and delete xdm temporary files. Domain allowed access. Do not audit attempts to get the attributes of xdm temporary named sockets. Domain to not audit. Execute the X server in the X server domain. Domain allowed to transition. Signal X servers Domain allowed access. Kill X servers Domain allowed access. Read and write X server Sys V Shared memory segments. Domain allowed access. Do not audit attempts to read and write to X server sockets. Domain to not audit. Do not audit attempts to read and write X server unix domain stream sockets. Domain to not audit. Connect to the X server over a unix domain stream socket. Domain allowed access. Read X server temporary files. Domain allowed access. Interface to provide X object permissions on a given X server to an X client domain. Gives the domain permission to read the virtual core keyboard and virtual core pointer devices. Domain allowed access. Interface to provide X object permissions on a given X server to an X client domain. Gives the domain complete control over the display. Domain allowed access.

Allows clients to write to the X server shared memory segments.

Allow xdm logins as sysadm

Support X userspace object manager

Policy modules for system functions from init to multi-user login.
Policy for user executable applications.
Make the specified type usable as an application domain. Type to be used as a domain type. Make the specified type usable for files that are exectuables, such as binary programs. This does not include shared libraries. Type to be used for files. Execute application executables in the caller domain. Domain allowed access. Execute all executable files. Domain allowed access. Create a domain for applications.

Create a domain for applications. Typically these are programs that are run interactively.

The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.

Type to be used as an application domain. Type of the program to be used as an entry point to this domain. Send null signals to all application domains. Domain allowed access. Do not audit attempts to send null signals to all application domains. Domain to not audit. Send general signals to all application domains. Domain allowed access. Do not audit attempts to send general signals to all application domains. Domain to not audit. Do not audit attempts to send kill signals to all application domains. Domain to not audit.
Common policy for authentication and user login.
Role access for password authentication. Role allowed access. Domain allowed access. Use PAM for authentication. Domain allowed access. Make the specified domain used for a login program. Domain type used for a login program domain. Use the login program as an entry point program. Domain allowed access. Make the specified type usable as a login file.

Make the specified type usable as a login file, This type has restricted modification capabilities when used with other interfaces that permit files_type access. The default type has properties similar to that of the shadow file. This will also make the type usable as a security file, making calls to files_security_file() redundant.

Type to be used as a login file. Execute a login_program in the target domain. Domain allowed to transition. The type of the login_program process. Execute a login_program in the target domain, with a range transition. Domain allowed to transition. The type of the login_program process. Range of the login program. Search authentication cache Domain allowed access. Read authentication cache Domain allowed access. Read/Write authentication cache Domain allowed access. Manage authentication cache Domain allowed access. Automatic transition from cache_t to cache. Domain allowed access. Run unix_chkpwd to check a password. Domain allowed to transition. Run unix_chkpwd to check a password. Stripped down version to be called within boolean Domain allowed to transition. Execute chkpwd programs in the chkpwd domain. Domain allowed to transition. The role to allow the chkpwd domain. Execute a domain transition to run unix_update. Domain allowed to transition. Execute updpwd programs in the updpwd domain. Domain allowed to transition. The role to allow the updpwd domain. Get the attributes of the shadow passwords file. Domain allowed access. Do not audit attempts to get the attributes of the shadow passwords file. Domain to not audit. Read the shadow passwords file (/etc/shadow) Domain allowed access. Pass shadow assertion for reading.

Pass shadow assertion for reading. This should only be used with auth_tunable_read_shadow(), and only exists because typeattribute does not work in conditionals.

Domain allowed access. Read the shadow password file.

Read the shadow password file. This should only be used in a conditional; it does not pass the reading shadow assertion.

Domain allowed access. Do not audit attempts to read the shadow password file (/etc/shadow). Domain to not audit. Read and write the shadow password file (/etc/shadow). Domain allowed access. Create, read, write, and delete the shadow password file. Domain allowed access. Automatic transition from etc to shadow. Domain allowed access. Relabel to the shadow password file type. Domain allowed access. Relabel from and to the shadow password file type. Domain allowed access. Append to the login failure log. Domain allowed access. Read and write the login failure log. Domain allowed access. Manage the login failure logs. Domain allowed access. Read the last logins log. Domain allowed access. Append only to the last logins log. Domain allowed access. Read and write to the last logins log. Domain allowed access. Execute pam programs in the pam domain. Domain allowed to transition. Send generic signals to pam processes. Domain allowed access. Execute pam programs in the PAM domain. Domain allowed to transition. The role to allow the PAM domain. Execute the pam program. Domain allowed access. Read var auth files. Used by various other applications and pam applets etc. Domain allowed access. Read and write var auth files. Used by various other applications and pam applets etc. Domain allowed access. Manage var auth files. Used by various other applications and pam applets etc. Domain allowed access. Read PAM PID files. Domain allowed access. Do not audit attemps to read PAM PID files. Domain to not audit. Create specified objects in pid directories with the pam var run file type using a file type transition. Domain allowed access. Class of the object being created. The name of the object being created. Delete pam PID files. Domain allowed access. Manage pam PID files. Domain allowed access. Execute pam_console with a domain transition. Domain allowed to transition. Search the contents of the pam_console data directory. Domain allowed access. List the contents of the pam_console data directory. Domain allowed access. Create pam var console pid directories. Domain allowed access. Relabel pam_console data directories. Domain allowed access. Read pam_console data files. Domain allowed access. Create, read, write, and delete pam_console data files. Domain allowed access. Delete pam_console data. Domain allowed access. Create specified objects in pid directories with the pam var console pid file type using a file type transition. Domain allowed access. Class of the object being created. The name of the object being created. Read all directories on the filesystem, except login files and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all directories on the filesystem, except the shadow passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all files on the filesystem, except login files and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all files on the filesystem, except the shadow passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all symbolic links on the filesystem, except login files and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read all symbolic links on the filesystem, except the shadow passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Relabel all files on the filesystem, except login files and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Relabel all files on the filesystem, except the shadow passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read and write all files on the filesystem, except login files and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Read and write all files on the filesystem, except the shadow passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Manage all files on the filesystem, except login files passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Manage all files on the filesystem, except the shadow passwords and listed exceptions. Domain allowed access. The types to be excluded. Each type or attribute must be negated by the caller. Execute utempter programs in the utempter domain. Domain allowed to transition. Execute utempter programs in the utempter domain. Domain allowed to transition. The role to allow the utempter domain. Do not audit attemps to execute utempter executable. Domain to not audit. Set the attributes of login record files. Domain allowed access. Read login records files (/var/log/wtmp). Domain allowed access. Do not audit attempts to read login records files (/var/log/wtmp). Domain to not audit. Do not audit attempts to write to login records files. Domain to not audit. Append to login records (wtmp). Domain allowed access. Write to login records (wtmp). Domain allowed access. Read and write login records. Domain allowed access. Create a login records in the log directory using a type transition. Domain allowed access. Create, read, write, and delete login records files. Domain allowed access. Relabel login record files. Domain allowed access. Use nsswitch to look up user, password, group, or host information.

Allow the specified domain to look up user, password, group, or host information using the name service. The most common use of this interface is for services that do host name resolution (usually DNS resolution).

Domain allowed access. Unconfined access to the authlogin module.

Unconfined access to the authlogin module.

Currently, this only allows assertions for the shadow passwords file (/etc/shadow) to be passed. No access is granted yet.

Domain allowed access.

Allow users to resolve user passwd entries directly from ldap rather then using a sssd server

Policy for reading and setting the hardware clock.
Execute hwclock in the clock domain. Domain allowed to transition. Execute hwclock in the clock domain, and allow the specified role the hwclock domain. Domain allowed to transition. Role allowed access. Execute hwclock in the caller domain. Domain allowed access. Read clock drift adjustments. Domain allowed access. Do not audit attempts to write clock drift adjustments. Domain to not audit. Read and write clock drift adjustments. Domain allowed access.
Tools for filesystem management, such as mkfs and fsck.
Execute fs tools in the fstools domain. Domain allowed to transition. Execute fs tools in the fstools domain, and allow the specified role the fs tools domain. Domain allowed to transition. Role allowed access. Execute fsadm in the caller domain. Domain allowed access. Send signal to fsadm process Domain allowed access. Inherit fstools file descriptors. The type of the process performing this action. Read fstools unnamed pipes. Domain allowed access. Relabel a file to the type used by the filesystem tools programs. Domain allowed access. Create, read, write, and delete a file used by the filesystem tools programs. Domain allowed access. Getattr swapfile Domain allowed access.
Policy for getty.
Execute gettys in the getty domain. Domain allowed to transition. Inherit and use getty file descriptors. Domain allowed access. Allow process to read getty log file. Domain allowed access. Allow process to read getty config file. Domain allowed access. Allow process to edit getty config file. Domain allowed access.
Policy for changing the system host name.
Execute hostname in the hostname domain. Domain allowed to transition. Execute hostname in the hostname domain, and allow the specified role the hostname domain. Domain allowed to transition. Role allowed access. Execute hostname in the caller domain. Domain allowed access.
Policy for hotplug system, for supporting the connection and disconnection of devices at runtime.
Execute hotplug with a domain transition. Domain allowed to transition. Execute hotplug in the caller domain. Domain allowed access. Inherit and use hotplug file descriptors. Domain allowed access. Do not audit attempts to inherit hotplug file descriptors. Domain to not audit. Do not audit attempts to search the hotplug configuration directories. Domain to not audit. Get the attributes of the hotplug configuration directory. Domain allowed access. Search the hotplug configuration directory. Domain allowed access. Read the configuration files for hotplug. Domain allowed access. Search the hotplug PIDs. Domain allowed access.
System initialization programs (init and init scripts).
Create a file type used for init scripts.

Create a file type used for init scripts. It can not be used in conjunction with init_script_domain(). These script files are typically stored in the /etc/init.d directory.

Typically this is used to constrain what services an admin can start/stop. For example, a policy writer may want to constrain a web administrator to only being able to restart the web server, not other services. This special type will help address that goal.

This also makes the type usable for files; thus an explicit call to files_type() is redundant.

Type to be used for a script file. Make the specified type usable for systemd unit files. Type to be used for systemd unit files. Create a domain used for init scripts.

Create a domain used for init scripts. Can not be used in conjunction with init_script_file().

Type to be used as an init script domain. Type of the script file used as an entry point to this domain. Create a domain which can be started by init. Type to be used as a domain. Type of the program to be used as an entry point to this domain. Create a domain which can be started by init, with a range transition. Type to be used as a domain. Type of the program to be used as an entry point to this domain. Range for the domain. Create a domain for long running processes (daemons/services) which are started by init scripts.

Create a domain for long running processes (daemons/services) which are started by init scripts. Short running processes should use the init_system_domain() interface instead. Typically all long running processes started by an init script (usually in /etc/init.d) will need to use this interface.

The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.

If the process must also run in a specific MLS/MCS level, the init_ranged_daemon_domain() should be used instead.

Type to be used as a daemon domain. Type of the program to be used as an entry point to this domain. Create a domain for long running processes (daemons/services) which are started by init scripts, running at a specified MLS/MCS range.

Create a domain for long running processes (daemons/services) which are started by init scripts, running at a specified MLS/MCS range. Short running processes should use the init_ranged_system_domain() interface instead. Typically all long running processes started by an init script (usually in /etc/init.d) will need to use this interface if they need to run in a specific MLS/MCS range.

The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.

If the policy build option TYPE is standard (MLS and MCS disabled), this interface has the same behavior as init_daemon_domain().

Type to be used as a daemon domain. Type of the program to be used as an entry point to this domain. MLS/MCS range for the domain. Abstract socket service activation (systemd). The domain to be started by systemd socket activation. Named socket service activation (systemd). The domain to be started by systemd socket activation. The domain socket file type. Create a domain for short running processes which are started by init scripts.

Create a domain for short running processes which are started by init scripts. These are generally applications that are used to initialize the system during boot. Long running processes, such as daemons/services should use the init_daemon_domain() interface instead. Typically all short running processes started by an init script (usually in /etc/init.d) will need to use this interface.

The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.

If the process must also run in a specific MLS/MCS level, the init_ranged_system_domain() should be used instead.

Type to be used as a system domain. Type of the program to be used as an entry point to this domain. Create a domain for short running processes which are started by init scripts.

Create a domain for long running processes (daemons/services) which are started by init scripts. These are generally applications that are used to initialize the system during boot. Long running processes should use the init_ranged_system_domain() interface instead. Typically all short running processes started by an init script (usually in /etc/init.d) will need to use this interface if they need to run in a specific MLS/MCS range.

The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.

If the policy build option TYPE is standard (MLS and MCS disabled), this interface has the same behavior as init_system_domain().

Type to be used as a system domain. Type of the program to be used as an entry point to this domain. Range for the domain. Mark the file type as a daemon pid file, allowing initrc_t to create it Type to mark as a daemon pid file Class on which the type is applied Filename of the file that the init script creates Mark the file type as a daemon run dir, allowing initrc_t to create it Type to mark as a daemon run dir Filename of the directory that the init script creates Execute init (/sbin/init) with a domain transition. Domain allowed to transition. Execute the init program in the caller domain. Domain allowed access. Execute the rc application in the caller domain.

This is only applicable to Gentoo or distributions that use the OpenRC init system.

The OpenRC /sbin/rc binary is used for both init scripts as well as management applications and tools. When used for management purposes, calling /sbin/rc should never cause a transition to initrc_t.

Domain allowed access. Get the process group of init. Domain allowed access. Send init a null signal. Domain allowed access. Send init a SIGCHLD signal. Domain allowed access. Connect to init with a unix socket. Domain allowed access. Inherit and use file descriptors from init.

Allow the specified domain to inherit file descriptors from the init program (process ID 1). Typically the only file descriptors to be inherited from init are for the console. This does not allow the domain any access to the object to which the file descriptors references.

Related interfaces:

- init_dontaudit_use_fds()
- term_dontaudit_use_console()
- term_use_console()

Example usage:

init_use_fds(mydomain_t) term_use_console(mydomain_t)

Normally, processes that can inherit these file descriptors (usually services) write messages to the system log instead of writing to the console. Therefore, in many cases, this access should dontaudited instead.

Example dontaudit usage:

init_dontaudit_use_fds(mydomain_t) term_dontaudit_use_console(mydomain_t)

Domain allowed access. Do not audit attempts to inherit file descriptors from init. Domain to not audit. Send messages to init unix datagram sockets. Domain allowed access. Allow the specified domain to read/write to init with unix domain stream sockets. Domain allowed access. Send UDP network traffic to init. (Deprecated) Domain allowed access. Get all service status (systemd). Domain allowed access. Enable all systemd services (systemd). Domain allowed access. Disable all services (systemd). Domain allowed access. Reload all services (systemd). Domain allowed access. Reboot the system (systemd). Domain allowed access. Shutdown (halt) the system (systemd). Domain allowed access. Allow specified domain to get init status Domain to allow access. Allow specified domain to get init start Domain to allow access. Send and receive messages from systemd over dbus. Domain allowed access. Manage files in /var/lib/systemd/. Domain allowed access. The type of the object to be created The object class. The name of the object being created. Create files in /var/lib/systemd with an automatic type transition. Domain allowed access. The type of object to be created The object class. The name of the object being created. Create files in an init PID directory. Domain allowed access. The type of the object to be created The object class. The name of the object being created. Get the attributes of initctl. Domain allowed access. Do not audit attempts to get the attributes of initctl. Domain to not audit. Write to initctl. Domain allowed access. Use telinit (Read and write initctl). Domain allowed access. Read and write initctl. Domain allowed access. Do not audit attempts to read and write initctl. Domain to not audit. Make init scripts an entry point for the specified domain. Domain allowed access. Execute init scripts with a specified domain transition. Domain allowed to transition. Execute init scripts with an automatic domain transition. Domain allowed to transition. Execute a init script in a specified domain.

Execute a init script in a specified domain.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Transition to the init script domain on a specified labeled init script. Domain allowed to transition. Labeled init script file. Transition to the init script domain for all labeled init script types Domain allowed to transition. Allow the role to start and stop labeled services. Domain allowed to transition. The role to be performing this action. Type to be used as a daemon domain. Labeled init script file. Systemd unit file type. Start and stop daemon programs directly.

Start and stop daemon programs directly in the traditional "/etc/init.d/daemon start" style, and do not require run_init.

Domain allowed access. The role to be performing this action. Read the process state (/proc/pid) of init. Domain allowed access. Ptrace init Domain allowed access. Write an init script unnamed pipe. Domain allowed access. Get the attribute of init script entrypoint files. Domain allowed access. Read init scripts. Domain allowed access. Execute init scripts in the caller domain. Domain allowed access. Get the attribute of all init script entrypoint files. Domain allowed access. Read all init script files. Domain allowed access. Dontaudit read all init script files. Domain to not audit. Execute all init scripts in the caller domain. Domain allowed access. Read the process state (/proc/pid) of the init scripts. Domain allowed access. Inherit and use init script file descriptors. Domain allowed access. Do not audit attempts to inherit init script file descriptors. Domain to not audit. Search init script keys. Domain allowed access. Get the process group ID of init scripts. Domain allowed access. Send SIGCHLD signals to init scripts. Domain allowed access. Send generic signals to init scripts. Domain allowed access. Send null signals to init scripts. Domain allowed access. Read and write init script unnamed pipes. Domain allowed access. Send UDP network traffic to init scripts. (Deprecated) Domain allowed access. Allow the specified domain to connect to init scripts with a unix socket. Domain allowed access. Allow the specified domain to read/write to init scripts with a unix domain stream sockets. Domain allowed access. Dont audit the specified domain connecting to init scripts with a unix domain stream socket. Domain to not audit. Send messages to init scripts over dbus. Domain allowed access. Send and receive messages from init scripts over dbus. Domain allowed access. Read and write the init script pty.

Read and write the init script pty. This pty is generally opened by the open_init_pty portion of the run_init program so that the daemon does not require direct access to the administrator terminal.

Domain allowed access. Read and write inherited init script ptys. Domain allowed access. Do not audit attempts to read and write the init script pty. Domain to not audit. Get the attributes of init script status files. Domain allowed access. Do not audit attempts to read init script status files. Domain to not audit. Search the /run/systemd directory. Domain allowed access. Read init script temporary data. Domain allowed access. Read and write init script temporary data. Domain allowed access. Create files in a init script temporary data directory. Domain allowed access. The type of the object to be created The object class. The name of the object being created. Get the attributes of init script process id files. Domain allowed access. Read utmp. Domain allowed access. Do not audit attempts to write utmp. Domain to not audit. Write to utmp. Domain allowed access. Do not audit attempts to lock init script pid files. Domain to not audit. Read and write utmp. Domain allowed access. Do not audit attempts to read and write utmp. Domain to not audit. Create, read, write, and delete utmp. Domain allowed access. Create files in /var/run with the utmp file type. Domain allowed access. Allow the specified domain to connect to daemon with a tcp socket Domain allowed access. Allow the specified domain to connect to daemon with a udp socket Domain allowed access. Search systemd unit dirs. Domain allowed access. Get status of generic systemd units. Domain allowed access. Start generic systemd units. Domain allowed access. Stop generic systemd units. Domain to not audit. Reload generic systemd units. Domain allowed access. Get status of all systemd units. Domain allowed access. Start all systemd units. Domain allowed access. Stop all systemd units. Domain to not audit. Reload all systemd units. Domain allowed access.

Enable support for upstart as the init program.

TCP/IP encryption
Execute ipsec in the ipsec domain. Domain allowed to transition. Connect to IPSEC using a unix domain stream socket. Domain allowed access. Execute ipsec in the ipsec mgmt domain. Domain allowed access. Connect to racoon using a unix domain stream socket. Domain allowed access. Get the attributes of an IPSEC key socket. Domain allowed access. Execute the IPSEC management program in the caller domain. Domain allowed access. Send ipsec mgmt a general signal. Domain allowed access. Send ipsec mgmt a null signal. Domain allowed access. Send ipsec mgmt a kill signal. Domain allowed access. Send and receive messages from ipsec-mgmt over dbus. Domain allowed access. Read the IPSEC configuration Domain allowed access. Match the default SPD entry. Domain allowed access. Set the context of a SPD entry to the default context. Domain allowed access. write the ipsec_var_run_t files. Domain allowed access. Create, read, write, and delete the IPSEC pid files. Domain allowed access. Execute racoon in the racoon domain. Domain allowed to transition. Execute racoon and allow the specified role the domain. Domain allowed to transition. Role allowed access. Execute setkey in the setkey domain. Domain allowed to transition. Execute setkey and allow the specified role the domains. Domain allowed to transition. Role allowed access.. All of the rules required to administrate an ipsec environment. Domain allowed access. Role allowed access.

Allow racoon to read shadow

Policy for iptables.
Execute iptables in the iptables domain. Domain allowed to transition. Execute iptables in the iptables domain, and allow the specified role the iptables domain. Domain allowed to transition. Role allowed access. Execute iptables in the caller domain. Domain allowed access. Execute iptables init scripts in the init script domain. Domain allowed to transition. Set the attributes of iptables config files. Domain allowed access. Read iptables config files. Domain allowed access. Create files in /etc with the type used for the iptables config files. Domain allowed access. Manage iptables config files. Domain allowed access. All of the rules required to administrate an iptables environment. Domain allowed access. Role allowed access.
Policy for system libraries.
Execute ldconfig in the ldconfig domain. Domain allowed to transition. Execute ldconfig in the ldconfig domain. Domain allowed to transition. The role to allow the ldconfig domain. Execute ldconfig in the caller domain. Domain allowed access. Use the dynamic link/loader for automatic loading of shared libraries. Domain allowed access. Use the dynamic link/loader for automatic loading of shared libraries with legacy support. Domain allowed access. Execute the dynamic link/loader in the caller's domain. Domain allowed access. Create, read, write, and delete the dynamic link/loader. Domain allowed access. Relabel to and from the type used for the dynamic link/loader. Domain allowed access. Modify the dynamic link/loader's cached listing of shared libraries. Domain allowed access. Search library directories. Domain allowed access. Do not audit attempts to write to library directories.

Do not audit attempts to write to library directories. Typically this is used to quiet attempts to recompile python byte code.

Domain to not audit. Create, read, write, and delete library directories. Domain allowed access. dontaudit attempts to setattr on library files Domain to not audit. Read files in the library directories, such as static libraries. Domain allowed access. Execute library scripts in the caller domain. Domain allowed access. Load and execute functions from generic lib files as shared libraries. Domain allowed access. Create, read, write, and delete generic files in library directories. Domain allowed access. Relabel files to the type used in library directories. Domain allowed access. Relabel to and from the type used for generic lib files. Domain allowed access. Delete generic symlinks in library directories. Domain allowed access. Create, read, write, and delete shared libraries. Domain allowed access. Load and execute functions from shared libraries. Domain allowed access. Load and execute functions from shared libraries, with legacy support. Domain allowed access. Relabel to and from the type used for shared libraries. Domain allowed access. Create an object in lib directories, with the shared libraries type using a type transition. Domain allowed access. The object class of the object being created. Create an object in lib directories, with the shared libraries type using a type transition. (Deprecated)

Create an object in lib directories, with the shared libraries type using a type transition. (Deprecated)

lib_filetrans_shared_lib() should be used instead.

Domain allowed access. The object class of the object being created.
Policy for local logins.
Execute local logins in the local login domain. Domain allowed to transition. Allow calling domain to read locallogin state. Domain allowed permission. Allow processes to inherit local login file descriptors. Domain allowed access. Do not audit attempts to inherit local login file descriptors. Domain to not audit. Send a null signal to local login processes. Domain allowed access. Search for key. Domain allowed access. Allow link to the local_login key ring. Domain allowed access. Execute single-user logins in the single-user login domain. Domain allowed to transition.
Policy for the kernel message logger and system logging daemon.
Make the specified type usable for log files in a filesystem.

Make the specified type usable for log files in a filesystem. This will also make the type usable for files, making calls to files_type() redundant. Failure to use this interface for a log file type may result in problems with log rotation, log analysis, and log monitoring programs.

Related interfaces:

- logging_log_filetrans()

Example usage with a domain that can create and append to a private log file stored in the general directories (e.g., /var/log):

type mylogfile_t; logging_log_file(mylogfile_t) allow mydomain_t mylogfile_t:file { create_file_perms append_file_perms }; logging_log_filetrans(mydomain_t, mylogfile_t, file)

Type to be used for files. Send audit messages. Domain allowed access. dontaudit attempts to send audit messages. Domain to not audit. Set login uid Domain allowed access. Set tty auditing Domain allowed access. Set up audit Domain allowed access. Read the audit log. Domain allowed access. Execute auditctl in the auditctl domain. Domain allowed to transition. Execute auditctl in the auditctl domain, and allow the specified role the auditctl domain. Domain allowed to transition. Role allowed access. Execute auditd in the auditd domain. Domain allowed to transition. Execute auditd in the auditd domain, and allow the specified role the auditd domain. Domain allowed to transition. Role allowed access. Connect to auditdstored over an unix stream socket. Domain allowed access. Execute a domain transition to run the audit dispatcher. Domain allowed to transition. Signal the audit dispatcher. Domain allowed access. Create a domain for processes which can be started by the system audit dispatcher Type to be used as a domain. Type of the program to be used as an entry point to this domain. Connect to the audit dispatcher over an unix stream socket. Domain allowed access. Manage the auditd configuration files. Domain allowed access. Manage the audit log. Domain allowed access. Execute klogd in the klog domain. Domain allowed to transition. Check if syslogd is executable. Domain allowed access. Execute syslogd in the syslog domain. Domain allowed to transition. Create an object in the log directory, with a private type.

Allow the specified domain to create an object in the general system log directories (e.g., /var/log) with a private type. Typically this is used for creating private log files in /var/log with the private type instead of the general system log type. To accomplish this goal, either the program must be SELinux-aware, or use this interface.

Related interfaces:

- logging_log_file()

Example usage with a domain that can create and append to a private log file stored in the general directories (e.g., /var/log):

type mylogfile_t; logging_log_file(mylogfile_t) allow mydomain_t mylogfile_t:file { create_file_perms append_file_perms }; logging_log_filetrans(mydomain_t, mylogfile_t, file)

Domain allowed access. The type of the object to be created. The object class of the object being created. The name of the object being created. Send system log messages.

Allow the specified domain to connect to the system log service (syslog), to send messages be added to the system logs. Typically this is used by services that do not have their own log file in /var/log.

This does not allow messages to be sent to the auditing system.

Programs which use the libc function syslog() will require this access.

Related interfaces:

- logging_send_audit_msgs()

Domain allowed access. Allow domain to relabelto devlog sock_files Domain allowed access. Read the auditd configuration files. Domain allowed access. dontaudit search of auditd configuration files. Domain to not audit. Read syslog configuration files. Domain allowed access. Create, read, write, and delete syslog PID sockets. Domain allowed access. Allows the domain to open a file in the log directory, but does not allow the listing of the contents of the log directory. Domain allowed access. Do not audit attempts to search the var log directory. Domain not to audit. List the contents of the generic log directory (/var/log). Domain allowed access. Read and write the generic log directory (/var/log). Domain allowed access. Search through all log dirs. Domain allowed access. Set attributes on all log dirs. Domain allowed access. Do not audit attempts to get the attributes of any log files. Domain to not audit. Read the atttributes of any log file Domain allowed access Append to all log files. Domain allowed access. Read all log files. Domain allowed access. Execute all log files in the caller domain. Domain allowed access. read/write to all log files. Domain allowed access. Create, read, write, and delete all log files. Domain allowed access. Read generic log files. Domain allowed access. Write generic log files. Domain allowed access. Dontaudit Write generic log files. Domain to not audit. Read and write generic log files. Domain allowed access. Create, read, write, and delete generic log files. Domain allowed access. All of the rules required to administrate the audit environment Domain allowed access. User role allowed access. All of the rules required to administrate the syslog environment Domain allowed access. User role allowed access. All of the rules required to administrate the logging environment Domain allowed access. User role allowed access.
Policy for logical volume management programs.
Execute lvm programs in the lvm domain. Domain allowed to transition. Execute lvm programs in the caller domain. Domain allowed access. Execute lvm programs in the lvm domain. Domain allowed to transition. The role to allow the LVM domain. Read LVM configuration files. Domain allowed access. Manage LVM configuration files. Domain allowed access. Create lvm_lock_t directories Domain allowed access. Execute a domain transition to run clvmd. Domain allowed to transition. All of the rules required to administrate an lvm environment. Domain allowed access. Role allowed access.
Miscellaneous files.
Make the specified type usable as a cert file.

Make the specified type usable for cert files. This will also make the type usable for files, making calls to files_type() redundant. Failure to use this interface for a temporary file may result in problems with cert management tools.

Related interfaces:

- files_type()

Example:

type mycertfile_t; cert_type(mycertfile_t) allow mydomain_t mycertfile_t:file read_file_perms; files_search_etc(mydomain_t)

Type to be used for files. Read all SSL certificates. Domain allowed access. Read generic SSL certificates. Domain allowed access. Manage generic SSL certificates. Domain allowed access. Manage generic SSL certificates. Domain allowed access. Read SSL certificates. Domain allowed access. Manage SSL certificates. Domain allowed access. Manage SSL certificates. Domain allowed access. Read fonts. Domain allowed access. Set the attributes on a fonts directory. Domain allowed access. Do not audit attempts to set the attributes on a fonts directory. Domain to not audit. Do not audit attempts to write fonts. Domain to not audit. Create, read, write, and delete fonts. Domain allowed access. Set the attributes on a fonts cache directory. Domain allowed access. Do not audit attempts to set the attributes on a fonts cache directory. Domain to not audit. Create, read, write, and delete fonts cache. Domain allowed access. Read hardware identification data. Domain allowed access. Allow process to setattr localization info Domain allowed access. Allow process to read localization information.

Allow the specified domain to read the localization files. This is typically for time zone configuration files, such as /etc/localtime and files in /usr/share/zoneinfo. Typically, any domain which needs to know the GMT/UTC offset of the current timezone will need access to these files. Generally, it should be safe for any domain to read these files.

Domain allowed access. Allow process to write localization info Domain allowed access. Allow process to relabel localization info Domain allowed access. Allow process to read legacy time localization info Domain allowed access. Search man pages. Domain allowed access. Do not audit attempts to search man pages. Domain to not audit. Read man pages Domain allowed access. Delete man pages Domain allowed access. Create, read, write, and delete man pages Domain allowed access. Read man cache content. Domain allowed access. Create, read, write, and delete man cache content. Domain allowed access. Read public files used for file transfer services. Domain allowed access. Create, read, write, and delete public files and directories used for file transfer services. Domain allowed access. Read TeX data Domain allowed access. Execute TeX data programs in the caller domain. Domain allowed access. Let test files be an entry point for a specified domain. Domain allowed access. Read test files and directories. Domain allowed access. Execute test files. Domain allowed access. Create files in etc directories with localization file type. Domain allowed access. Create, read, write, and delete localization Domain allowed access.
Policy for kernel module utilities
Getattr the dependencies of kernel modules. Domain allowed access. Read the dependencies of kernel modules. Domain allowed access. Read the configuration options used when loading modules. Domain allowed access. Rename a file with the configuration options used when loading modules. Domain allowed access. Unlink a file with the configuration options used when loading modules. Domain allowed access. Manage files with the configuration options used when loading modules. Domain allowed access. Unconditionally execute insmod in the insmod domain. Domain allowed to transition. Execute insmod in the insmod domain. Domain allowed to transition. Execute insmod in the insmod domain, and allow the specified role the insmod domain, and use the caller's terminal. Has a sigchld backchannel. Domain allowed to transition. Role allowed access. Execute insmod in the caller domain. Domain allowed access. Execute depmod in the depmod domain. Domain allowed to transition. Execute depmod in the depmod domain. Domain allowed to transition. Role allowed access. Execute depmod in the caller domain. Domain allowed access. Execute update_modules in the update_modules domain. Domain allowed to transition. Execute update_modules in the update_modules domain. Domain allowed to transition. Role allowed access. Execute update_modules in the caller domain. Domain allowed access.
Policy for mount.
Execute mount in the mount domain. Domain allowed to transition. Execute mount in the mount domain, and allow the specified role the mount domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute mount in the caller domain. Domain allowed access. Send a generic signal to mount. Domain allowed access. Use file descriptors for mount. The type of the process performing this action. Allow the mount domain to send nfs requests for mounting network drives

Allow the mount domain to send nfs requests for mounting network drives

This interface has been deprecated as these rules were a side effect of leaked mount file descriptors. This interface has no effect.

Domain allowed access. Execute mount in the unconfined mount domain. Domain allowed to transition. Execute mount in the unconfined mount domain, and allow the specified role the unconfined mount domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Read loopback filesystem image files. Domain allowed access. Read and write loopback filesystem image files. Domain allowed access.

Allow the mount command to mount any directory or file.

NetLabel/CIPSO labeled networking management
Execute netlabel_mgmt in the netlabel_mgmt domain. Domain allowed to transition. Execute netlabel_mgmt in the netlabel_mgmt domain, and allow the specified role the netlabel_mgmt domain. Domain allowed to transition. Role allowed access.
Policy for SELinux policy and userland applications.
Execute checkpolicy in the checkpolicy domain. Domain allowed to transition. Execute checkpolicy in the checkpolicy domain, and allow the specified role the checkpolicy domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute checkpolicy in the caller domain. Domain allowed access. Execute load_policy in the load_policy domain. Domain allowed to transition. Execute load_policy in the load_policy domain, and allow the specified role the load_policy domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute load_policy in the caller domain. Domain allowed access. Read the load_policy program file. Domain allowed access. Execute newrole in the newole domain. Domain allowed to transition. Execute newrole in the newrole domain, and allow the specified role the newrole domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute newrole in the caller domain. Domain allowed access. Do not audit the caller attempts to send a signal to newrole. Domain to not audit. Send a SIGCHLD signal to newrole.

Allow the specified domain to send a SIGCHLD signal to newrole. This signal is automatically sent from a process that is terminating to its parent. This may be needed by domains that are executed from newrole.

Domain allowed access. Inherit and use newrole file descriptors. Domain allowed access. Do not audit attempts to inherit and use newrole file descriptors. Domain to not audit. Execute restorecon in the restorecon domain. (Deprecated) Domain allowed to transition. Execute restorecon in the restorecon domain, and allow the specified role the restorecon domain, and use the caller's terminal. (Deprecated) Domain allowed to transition. Role allowed access. Execute restorecon in the caller domain. (Deprecated) Domain allowed access. Execute run_init in the run_init domain. Domain allowed to transition. Execute file in the run_init domain.

Execute file in the run_init domain. This is used for the Gentoo integrated run_init.

Domain allowed to transition. Type of entry file. Execute init scripts in the run_init domain.

Execute init scripts in the run_init domain. This is used for the Gentoo integrated run_init.

Domain allowed to transition. Execute run_init in the run_init domain, and allow the specified role the run_init domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute init scripts in the run_init domain, and allow the specified role the run_init domain, and use the caller's terminal.

Execute init scripts in the run_init domain, and allow the specified role the run_init domain, and use the caller's terminal.

This is used for the Gentoo integrated run_init.

Domain allowed to transition. Role allowed access. Execute specified file in the run_init domain, and allow the specified role the run_init domain, and use the caller's terminal.

Execute specified file in the run_init domain, and allow the specified role the run_init domain, and use the caller's terminal.

This is used for the Gentoo integrated run_init.

Domain allowed to transition. Role allowed access. Type of init script. Inherit and use run_init file descriptors. Domain allowed access. Execute setfiles in the setfiles domain. Domain allowed to transition. Execute setfiles in the setfiles domain, and allow the specified role the setfiles domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute setfiles in the caller domain. Domain allowed access. Do not audit attempts to search the SELinux configuration directory (/etc/selinux). Domain to not audit. Do not audit attempts to read the SELinux userland configuration (/etc/selinux). Domain to not audit. Read the general SELinux configuration files. Domain allowed access. Read and write the general SELinux configuration files. Domain allowed access. Create, read, write, and delete the general selinux configuration files. (Deprecated)

Create, read, write, and delete the general selinux configuration files.

This interface has been deprecated, please use the seutil_manage_config() interface instead.

Domain allowed access. Create, read, write, and delete the general selinux configuration files. Domain allowed access. Create, read, write, and delete the general selinux configuration directories. Domain allowed access. Search the policy directory with default_context files. Domain allowed access. Read the default_contexts files. Domain allowed access. Create, read, write, and delete the default_contexts files. Domain allowed access. Read the file_contexts files. Domain allowed access. Do not audit attempts to read the file_contexts files. Domain to not audit. Read and write the file_contexts files. Domain allowed access. Create, read, write, and delete the file_contexts files. Domain allowed access. Read the SELinux binary policy. Domain allowed access. Create the SELinux binary policy. Domain allowed access. Allow the caller to relabel a file to the binary policy type. Domain allowed access. Create, read, write, and delete the SELinux binary policy. Domain allowed access. Read SELinux policy source files. Domain allowed access. Create, read, write, and delete SELinux policy source files. Domain allowed access. Execute a domain transition to run semanage. Domain allowed to transition. Execute semanage in the semanage domain, and allow the specified role the semanage domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Read the semanage module store. Domain allowed access. Full management of the semanage module store. Domain allowed access. Get read lock on module store Domain allowed access. Get trans lock on module store Domain allowed access. SELinux-enabled program access for libselinux-linked programs.

SELinux-enabled programs are typically linked to the libselinux library. This interface will allow access required for the libselinux constructor to function.

Domain allowed access. Do not audit SELinux-enabled program access for libselinux-linked programs.

SELinux-enabled programs are typically linked to the libselinux library. This interface will dontaudit access required for the libselinux constructor to function.

Generally this should not be used on anything but simple SELinux-enabled programs that do not rely on data initialized by the libselinux constructor.

Domain to not audit.
SELinux MLS/MCS label translation service.
Execute setrans server in the setrans domain. Domain allowed to transition. Allow a domain to translate contexts. Domain allowed access. All of the rules required to administrate an setrans environment. Domain allowed access. Role allowed access.
Policy for network configuration: ifconfig and dhcp client.
Execute dhcp client in dhcpc domain. Domain allowed to transition. Execute DHCP clients in the dhcpc domain, and allow the specified role the dhcpc domain. Domain allowed to transition. Role allowed access. Do not audit attempts to read and write dhcpc udp socket descriptors. Domain to not audit. Do not audit attempts to use the dhcp file descriptors. Domain to not audit. Do not audit attempts to read/write to the dhcp unix stream socket descriptors. Domain to not audit. Send a SIGCHLD signal to the dhcp client. Domain allowed access. Send a kill signal to the dhcp client. Domain allowed access. Send a SIGSTOP signal to the dhcp client. Domain allowed access. Send a null signal to the dhcp client. Domain allowed access. Send a generic signal to the dhcp client. Domain allowed access. Send and receive messages from dhcpc over dbus. Domain allowed access. Read and write dhcp configuration files. Domain allowed access. Search the DHCP client state directories. Domain allowed access. Read dhcp client state files. Domain allowed access. Delete the dhcp client state files. Domain allowed access. Set the attributes of network config files. Domain allowed access. Read network config files.

Allow the specified domain to read the general network configuration files. A common example of this is the /etc/resolv.conf file, which has domain name system (DNS) server IP addresses. Typically, most networking processes will require the access provided by this interface.

Higher-level interfaces which involve networking will generally call this interface, for example:

- sysnet_dns_name_resolve()
- sysnet_use_ldap()
- sysnet_use_portmap()

Domain allowed access. Do not audit attempts to read network config files. Domain to not audit. Write network config files. Domain allowed access. Create network config files. Domain allowed access. Create files in /etc with the type used for the network config files. Domain allowed access. The name of the object being created. Create, read, write, and delete network config files. Domain allowed access. Read the dhcp client pid file. Domain allowed access. Delete the dhcp client pid file. Domain allowed access. Execute ifconfig in the ifconfig domain. Domain allowed to transition. Execute ifconfig in the ifconfig domain, and allow the specified role the ifconfig domain, and use the caller's terminal. Domain allowed to transition. Role allowed access. Execute ifconfig in the caller domain. Domain allowed access. Send a generic signal to ifconfig. Domain allowed access. Send null signals to ifconfig. Domain allowed access. Read the DHCP configuration files. Domain allowed access. Search the DHCP state data directory. Domain allowed access. Create DHCP state data.

Create DHCP state data.

This is added for DHCP server, as the server and client put their state files in the same directory.

Domain allowed access. The type of the object to be created The object class. The name of the object being created. Perform a DNS name resolution. Domain allowed access. Connect and use a LDAP server. Domain allowed access. Connect and use remote port mappers. Domain allowed access.
Systemd components (not PID 1)
Make the specified type usable as an log parse environment type. Type to be used as a log parse environment type. Read systemd_login PID files. Domain allowed access. Manage systemd_login PID pipes. Domain allowed access. Use inherited systemd logind file descriptors. Domain allowed access. Send and receive messages from systemd logind over dbus. Domain allowed access. Allow process to write to systemd_kmod_conf_t. Domain allowed access. Allow process to relabel to systemd_kmod_conf_t. Domain allowed access. Get the system status information from systemd_login Domain allowed access. Send systemd_login a null signal. Domain allowed access. Allow specified domain to start power units Domain to not audit.

Enable support for systemd-tmpfiles to manage all non-security files.

Policy for udev.
Send generic signals to udev. Domain allowed access. Execute udev in the udev domain. Domain allowed to transition. Execute udev in the caller domain. Domain allowed access. Execute a udev helper in the udev domain. Domain allowed to transition. Allow process to read udev process state. Domain allowed access. Allow domain to create uevent sockets. Domain allowed access. Do not audit attempts to inherit a udev file descriptor. Domain to not audit. Do not audit attempts to read or write to a udev unix datagram socket. Domain to not audit. Manage udev rules files Domain allowed access. Do not audit search of udev database directories. Domain to not audit. Read the udev device table.

Allow the specified domain to read the udev device table.

Domain allowed access. Allow process to modify list of devices. Domain allowed access. Search through udev pid content Domain allowed access. Create, read, write, and delete udev pid directories Domain allowed access. Read udev pid files. Domain allowed access. Create, read, write, and delete udev pid files. Domain allowed access. Create directories in the run location with udev_var_run_t type Domain allowed access. Name of the directory that is created
The unconfined domain.
Make the specified domain unconfined. Domain to make unconfined. Make the specified domain unconfined and audit executable heap usage.

Make the specified domain unconfined and audit executable heap usage. With exception of memory protections, usage of this interface will result in the level of access the domain has is like SELinux was not being used.

Only completely trusted domains should use this interface.

Domain to make unconfined. Add an alias type to the unconfined domain. (Deprecated)

Add an alias type to the unconfined domain. (Deprecated)

This is added to support targeted policy. Its use should be limited. It has no effect on the strict policy.

New alias of the unconfined domain. Add an alias type to the unconfined execmem program file type. (Deprecated)

Add an alias type to the unconfined execmem program file type. (Deprecated)

This is added to support targeted policy. Its use should be limited. It has no effect on the strict policy.

New alias of the unconfined execmem program type. Transition to the unconfined domain. Domain allowed to transition. Execute specified programs in the unconfined domain. Domain allowed to transition. The role to allow the unconfined domain. Transition to the unconfined domain by executing a shell. Domain allowed to transition. Allow unconfined to execute the specified program in the specified domain.

Allow unconfined to execute the specified program in the specified domain.

This is a interface to support third party modules and its use is not allowed in upstream reference policy.

Domain to execute in. Domain entry point file. Allow unconfined to execute the specified program in the specified domain. Allow the specified domain the unconfined role and use of unconfined user terminals.

Allow unconfined to execute the specified program in the specified domain. Allow the specified domain the unconfined role and use of unconfined user terminals.

This is a interface to support third party modules and its use is not allowed in upstream reference policy.

Domain to execute in. Domain entry point file. Inherit file descriptors from the unconfined domain. Domain allowed access. Send a SIGCHLD signal to the unconfined domain. Domain allowed access. Send a SIGNULL signal to the unconfined domain. Domain allowed access. Send generic signals to the unconfined domain. Domain allowed access. Read unconfined domain unnamed pipes. Domain allowed access. Do not audit attempts to read unconfined domain unnamed pipes. Domain to not audit. Read and write unconfined domain unnamed pipes. Domain allowed access. Do not audit attempts to read and write unconfined domain unnamed pipes. Domain to not audit. Connect to the unconfined domain using a unix domain stream socket. Domain allowed access. Do not audit attempts to read or write unconfined domain tcp sockets.

Do not audit attempts to read or write unconfined domain tcp sockets.

This interface was added due to a broken symptom in ldconfig.

Domain to not audit. Create keys for the unconfined domain. Domain allowed access. Send messages to the unconfined domain over dbus. Domain allowed access. Send and receive messages from unconfined_t over dbus. Domain allowed access. Connect to the the unconfined DBUS for service (acquire_svc). Domain allowed access.
Policy for user domains
The template containing the most basic rules common to all users.

The template containing the most basic rules common to all users.

This template creates a user domain, types, and rules for the user's tty and pty.

The prefix of the user domain (e.g., user is the prefix for user_t).
Allow a home directory for which the role has read-only access.

Allow a home directory for which the role has read-only access.

This does not allow execute access.

The user role The user domain Allow a home directory for which the role has full access.

Allow a home directory for which the role has full access.

This does not allow execute access.

The user role The user domain Manage user temporary files Role allowed access. Domain allowed access. The execute access user temporary files. Domain allowed access. Role access for the user tmpfs type that the user has full access.

Role access for the user tmpfs type that the user has full access.

This does not allow execute access.

Role allowed access. Domain allowed access. The template allowing the user basic network permissions The prefix of the user domain (e.g., user is the prefix for user_t). The template for creating a user xwindows client. (Deprecated) The prefix of the user domain (e.g., user is the prefix for user_t). The template for allowing the user to change passwords. The prefix of the user domain (e.g., user is the prefix for user_t). The template containing rules common to unprivileged users and administrative users.

This template creates a user domain, types, and rules for the user's tty, pty, tmp, and tmpfs files.

The prefix of the user domain (e.g., user is the prefix for user_t). The template for creating a login user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

The prefix of the user domain (e.g., user is the prefix for user_t). The template for creating a unprivileged login user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

The prefix of the user domain (e.g., user is the prefix for user_t). The template for creating a unprivileged xwindows login user.

The template for creating a unprivileged xwindows login user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

The prefix of the user domain (e.g., user is the prefix for user_t). The template for creating a unprivileged user roughly equivalent to a regular linux user.

The template for creating a unprivileged user roughly equivalent to a regular linux user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

The prefix of the user domain (e.g., user is the prefix for user_t). The template for creating an administrative user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

The privileges given to administrative users are:

- Raw disk access
- Set all sysctls
- All kernel ring buffer controls
- Create, read, write, and delete all files but shadow
- Manage source and binary format SELinux policy
- Run insmod

The prefix of the user domain (e.g., sysadm is the prefix for sysadm_t). Allow user to run as a secadm

Create objects in a user home directory with an automatic type transition to a specified private type.

This is a templated interface, and should only be called from a per-userdomain template.

Domain allowed access. The role of the object to create. Make the specified type usable as a user application domain type. Type to be used as a user application domain. Make the specified type usable as a user application domain. Type to be used as a user application domain. Type to be used as the domain entry point. Make the specified type usable in a user home directory. Type to be used as a file in the user home directory. Make the specified type usable as a user temporary file. Type to be used as a file in the temporary directories. Make the specified type usable as a user tmpfs file. Type to be used as a file in tmpfs directories. Allow domain to attach to TUN devices created by administrative users. Domain allowed access. Set the attributes of a user pty. Domain allowed access. Create a user pty. Domain allowed access. Get the attributes of user home directories. Domain allowed access. Do not audit attempts to get the attributes of user home directories. Domain to not audit. Search user home directories. Domain allowed access. Do not audit attempts to search user home directories.

Do not audit attempts to search user home directories. This will suppress SELinux denial messages when the specified domain is denied the permission to search these directories.

Domain to not audit. List user home directories. Domain allowed access. Do not audit attempts to list user home subdirectories. Domain to not audit. Create user home directories. Domain allowed access. Manage user home directories. Domain allowed access. Relabel to user home directories. Domain allowed access. Create directories in the home dir root with the user home directory type. Domain allowed access. The name of the object being created. Do a domain transition to the specified domain when executing a program in the user home directory.

Do a domain transition to the specified domain when executing a program in the user home directory.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Domain allowed to transition. Domain to transition to. Do not audit attempts to search user home content directories. Domain to not audit. List all users home content directories. Domain allowed access. List contents of users home directory. Domain allowed access. Create, read, write, and delete directories in a user home subdirectory. Domain allowed access. Delete all user home content directories. Domain allowed access. Delete directories in a user home subdirectory. Domain allowed access. Set attributes of all user home content directories. Domain allowed access. Do not audit attempts to set the attributes of user home files. Domain to not audit. Mmap user home files. Domain allowed access. Read user home files. Domain allowed access. Do not audit attempts to read user home files. Domain to not audit. Do not audit attempts to append user home files. Domain to not audit. Do not audit attempts to write user home files. Domain to not audit. Delete all user home content files. Domain allowed access. Delete files in a user home subdirectory. Domain allowed access. Do not audit attempts to relabel user home files. Domain to not audit. Read user home subdirectory symbolic links. Domain allowed access. Execute user home files. Domain allowed access. Do not audit attempts to execute user home files. Domain to not audit. Create, read, write, and delete files in a user home subdirectory. Domain allowed access. Do not audit attempts to create, read, write, and delete directories in a user home subdirectory. Domain to not audit. Create, read, write, and delete symbolic links in a user home subdirectory. Domain allowed access. Delete all user home content symbolic links. Domain allowed access. Delete symbolic links in a user home directory. Domain allowed access. Create, read, write, and delete named pipes in a user home subdirectory. Domain allowed access. Create, read, write, and delete named sockets in a user home subdirectory. Domain allowed access. Create objects in a user home directory with an automatic type transition to a specified private type. Domain allowed access. The type of the object to create. The class of the object to be created. The name of the object being created. Create objects in a directory located in a user home directory with an automatic type transition to a specified private type. Domain allowed access. The type of the object to create. The class of the object to be created. The name of the object being created. Create objects in a user home directory with an automatic type transition to the user home file type. Domain allowed access. The class of the object to be created. The name of the object being created. Read user SSL certificates. Domain allowed access. Do not audit attempts to manage the user SSL certificates. Domain allowed access. Manage user SSL certificates. Domain allowed access. Write to user temporary named sockets. Domain allowed access. List user temporary directories. Domain allowed access. Do not audit attempts to list user temporary directories. Domain to not audit. Do not audit attempts to manage users temporary directories. Domain to not audit. Read user temporary files. Domain allowed access. Do not audit attempts to read users temporary files. Domain to not audit. Do not audit attempts to append users temporary files. Domain to not audit. Read and write user temporary files. Domain allowed access. Do not audit attempts to manage users temporary files. Domain to not audit. Read user temporary symbolic links. Domain allowed access. Create, read, write, and delete user temporary directories. Domain allowed access. Create, read, write, and delete user temporary files. Domain allowed access. Create, read, write, and delete user temporary symbolic links. Domain allowed access. Create, read, write, and delete user temporary named pipes. Domain allowed access. Create, read, write, and delete user temporary named sockets. Domain allowed access. Create objects in a user temporary directory with an automatic type transition to a specified private type. Domain allowed access. The type of the object to create. The class of the object to be created. The name of the object being created. Create objects in the temporary directory with an automatic type transition to the user temporary type. Domain allowed access. The class of the object to be created. The name of the object being created. Read user tmpfs files. Domain allowed access. Search users runtime directories. Domain allowed access. Search user runtime root directories. Domain allowed access. Create, read, write, and delete user runtime root dirs. Domain allowed access. Create, read, write, and delete user runtime dirs. Domain allowed access. Mount a filesystem on user runtime dir directories. Domain allowed access. Relabel to user runtime directories. Domain allowed access. Create objects in the pid directory with an automatic type transition to the user runtime root type. Domain allowed access. The class of the object to be created. The name of the object being created. Create objects in a user runtime directory with an automatic type transition to a specified private type. Domain allowed access. The type of the object to create. The class of the object to be created. The name of the object being created. Create objects in the user runtime directory with an automatic type transition to the user temporary type. Domain allowed access. The class of the object to be created. The name of the object being created. Create objects in the user runtime root directory with an automatic type transition to the user runtime dir type. Domain allowed access. The class of the object to be created. The name of the object being created. Read and write user tmpfs files. Domain allowed access. Delete user tmpfs files. Domain allowed access. Create, read, write, and delete user tmpfs files. Domain allowed access. Get the attributes of a user domain tty. Domain allowed access. Do not audit attempts to get the attributes of a user domain tty. Domain to not audit. Set the attributes of a user domain tty. Domain allowed access. Do not audit attempts to set the attributes of a user domain tty. Domain to not audit. Read and write a user domain tty. Domain allowed access. Read and write a user domain pty. Domain allowed access. Read and write a user TTYs and PTYs.

Allow the specified domain to read and write user TTYs and PTYs. This will allow the domain to interact with the user via the terminal. Typically all interactive applications will require this access.

However, this also allows the applications to spy on user sessions or inject information into the user session. Thus, this access should likely not be allowed for non-interactive domains.

Domain allowed access. Do not audit attempts to read and write a user domain tty and pty. Domain to not audit. Execute a shell in all user domains. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed to transition. Execute an Xserver session in all user domains. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed to transition. Execute a shell in all unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed to transition. Execute an Xserver session in all unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed to transition. Read and write unpriviledged user SysV sempaphores. Domain allowed access. Manage unpriviledged user SysV sempaphores. Domain allowed access. Read and write unpriviledged user SysV shared memory segments. Domain allowed access. Manage unpriviledged user SysV shared memory segments. Domain allowed access. Execute bin_t in the unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed to transition. Execute all entrypoint files in unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon(). Domain allowed access. Search users home directories. Domain allowed access. Send signull to unprivileged user domains. Domain allowed access. Send general signals to unprivileged user domains. Domain allowed access. Inherit the file descriptors from unprivileged user domains. Domain allowed access. Do not audit attempts to inherit the file descriptors from unprivileged user domains.

Do not audit attempts to inherit the file descriptors from unprivileged user domains. This will suppress SELinux denial messages when the specified domain is denied the permission to inherit these file descriptors.

Domain to not audit. Do not audit attempts to use user ptys. Domain to not audit. Relabel files to unprivileged user pty types. Domain allowed access. Do not audit attempts to relabel files from user pty types. Domain to not audit. Write all users files in /tmp Domain allowed access. Do not audit attempts to use user ttys. Domain to not audit. Read the process state of all user domains. Domain allowed access. Get the attributes of all user domains. Domain allowed access. Inherit the file descriptors from all user domains Domain allowed access. Do not audit attempts to inherit the file descriptors from any user domains. Domain to not audit. Send general signals to all user domains. Domain allowed access. Send a SIGCHLD signal to all user domains. Domain allowed access. Create keys for all user domains. Domain allowed access. Send a dbus message to all user domains. Domain allowed access.

Allow users to connect to mysql

Allow users to connect to PostgreSQL

Allow regular users direct mouse access

Allow users to read system messages.

Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)

Allow user to execute files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)

Allow user to write files on removable devices (e.g. external USB memory devices or floppies)

Allow w to display everyone

Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla

Allow unconfined executables to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla")

Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t")

Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla")

Enable polyinstantiated directory support.

Allow system to run with NIS

Allow logging in and using the system from /dev/console.

Enable reading of urandom for all domains.

This should be enabled when all programs are compiled with ProPolice/SSP stack smashing protection. All domains will be allowed to read from /dev/urandom.

Allow email client to various content. nfs, samba, removable devices, and user temp files

Allow any files/directories to be exported read/write via NFS.

Allow any files/directories to be exported read/only via NFS.

Support NFS home directories

Support SAMBA home directories

Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.

Allow users to run UDP servers (bind to ports and accept connection from the same domain and outside users)

Enabling secure mode disallows programs, such as newrole, from transitioning to administrative user domains.