System initialization programs (init and init scripts).
false
Allow all daemons to write corefiles to /
false
Allow all daemons to use tcp wrappers.
false
Allow all daemons the ability to read/write terminals
false
Enable support for upstart as the init program.
Transition to the init script domain for all labeled init script types
Parameter: | Description: |
---|---|
domain |
Domain allowed access |
Execute a file in a bin directory in the initrc_t domain
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain for long running processes (daemons/services) which are started by init scripts.
Create a domain for long running processes (daemons/services) which are started by init scripts. Short running processes should use the init_system_domain() interface instead. Typically all long running processes started by an init script (usually in /etc/init.d) will need to use this interface.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the process must also run in a specific MLS/MCS level, the init_ranged_daemon_domain() should be used instead.
Parameter: | Description: |
---|---|
domain |
Type to be used as a daemon domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
Send and receive messages from init over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send and receive messages from init scripts over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send messages to init scripts over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain which can be started by init.
Parameter: | Description: |
---|---|
domain |
Type to be used as a domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
Execute init (/sbin/init) with a domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute init scripts with an automatic domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to get the attributes of initctl.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
dontaudit read and write an leaked file descriptors
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to lock init script pid files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Dontaudit read all init script files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to read init script status files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to read utmp.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to read and write initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to read and write utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
dontaudit read and write an leaked init scrip file descriptors
Parameter: | Description: |
---|---|
domain |
The type of the process performing this action. |
Dont audit the specified domain connecting to init scripts with a unix domain stream socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to inherit file descriptors from init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to inherit init script file descriptors.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Do not audit attempts to read and write the init script pty.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to write utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute the init program in the caller domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute all init scripts in the caller domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute init scripts in the caller domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attribute of all init script entrypoint files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attribute of init script entrypoint files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of init script status files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of init script process id files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the process group of init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the process group ID of init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create initrc domain.
Parameter: | Description: |
---|---|
domain |
Type to be used as a initrc daemon domain. |
Create initrc domain.
Parameter: | Description: |
---|---|
domain |
Type to be used as a initrc daemon domain. |
type |
Executable type. |
Transition to the init script domain on a specified labeled init script.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
init_script_file |
Labeled init script file. |
Manage init script status files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create, read, write, and delete utmp.
Parameter: | Description: |
---|---|
domain |
Domain access allowed. |
Create files in /var/run with the utmp file type.
Parameter: | Description: |
---|---|
domain |
Domain access allowed. |
Ptrace init
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain for long running processes (daemons/services) which are started by init scripts, running at a specified MLS/MCS range.
Create a domain for long running processes (daemons/services) which are started by init scripts, running at a specified MLS/MCS range. Short running processes should use the init_ranged_system_domain() interface instead. Typically all long running processes started by an init script (usually in /etc/init.d) will need to use this interface if they need to run in a specific MLS/MCS range.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the policy build option TYPE is standard (MLS and MCS disabled), this interface has the same behavior as init_daemon_domain().
Parameter: | Description: |
---|---|
domain |
Type to be used as a daemon domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
range |
MLS/MCS range for the domain. |
Create a domain which can be started by init, with a range transition.
Parameter: | Description: |
---|---|
domain |
Type to be used as a domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
range |
Range for the domain. |
Create a domain for short running processes which are started by init scripts.
Create a domain for long running processes (daemons/services) which are started by init scripts. These are generally applications that are used to initialize the system during boot. Long running processes should use the init_ranged_system_domain() interface instead. Typically all short running processes started by an init script (usually in /etc/init.d) will need to use this interface if they need to run in a specific MLS/MCS range.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the policy build option TYPE is standard (MLS and MCS disabled), this interface has the same behavior as init_system_domain().
Parameter: | Description: |
---|---|
domain |
Type to be used as a system domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
range |
Range for the domain. |
Read all init script files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read the process state (/proc/pid) of the init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read init script temporary data.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read the process state (/proc/pid) of init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Start and stop daemon programs directly.
Start and stop daemon programs directly in the traditional "/etc/init.d/daemon start" style, and do not require run_init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
role |
The role to be performing this action. |
Read and write init script inherited temporary data.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write init script unnamed pipes.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to read/write to init scripts with a unix domain stream sockets.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write init script temporary data.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain used for init scripts.
Create a domain used for init scripts. Can not be used in conjunction with init_script_file().
Parameter: | Description: |
---|---|
domain |
Type to be used as an init script domain. |
script_file |
Type of the script file used as an entry point to this domain. |
Create a file type used for init scripts.
Create a file type used for init scripts. It can not be used in conjunction with init_script_domain(). These script files are typically stored in the /etc/init.d directory.
Typically this is used to constrain what services an admin can start/stop. For example, a policy writer may want to constrain a web administrator to only being able to restart the web server, not other services. This special type will help address that goal.
This also makes the type usable for files; thus an explicit call to files_type() is redundant.
Parameter: | Description: |
---|---|
script_file |
Type to be used for a script file. |
Execute a init script in a specified domain.
Execute a init script in a specified domain.
No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.
Parameter: | Description: |
---|---|
source_domain |
Domain to transition from. |
target_domain |
Domain to transition to. |
Make init scripts an entry point for the specified domain.
Parameter: | Description: |
---|---|
domain |
The domain for which init scripts are an entrypoint. |
Transition to system_r when execute an init script
Execute a init script in a specified role
No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.
Parameter: | Description: |
---|---|
source_role |
Role to transition from. |
Create files in a init script temporary data directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
file_type |
The type of the object to be created |
object_class |
The object class. |
Send init a SIGCHLD signal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send SIGCHLD signals to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send generic signals to init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send generic signals to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send init a null signal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send null signals to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute init scripts with a specified domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Connect to init with a unix socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to connect to init scripts with a unix socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain for short running processes which are started by init scripts.
Create a domain for long running processes (daemons/services) which are started by init scripts. These are generally applications that are used to initialize the system during boot. Long running processes should use the init_daemon_domain() interface instead. Typically all short running processes started by an init script (usually in /etc/init.d) will need to use this interface.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the process must also run in a specific MLS/MCS level, the init_ranged_system_domain() should be used instead.
Parameter: | Description: |
---|---|
domain |
Type to be used as a system domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
Allow the specified domain to connect to daemon with a tcp socket
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Use telinit (Read and write initctl).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to connect to daemon with a udp socket
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send UDP network traffic to init. (Deprecated)
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send UDP network traffic to init scripts. (Deprecated)
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Inherit and use file descriptors from init.
Allow the specified domain to inherit file descriptors from the init program (process ID 1). Typically the only file descriptors to be inherited from init are for the console. This does not allow the domain any access to the object to which the file descriptors references.
Related interfaces:
init_dontaudit_use_fds()
term_dontaudit_use_console()
term_use_console()
Example usage:
init_use_fds(mydomain_t) term_use_console(mydomain_t)
Normally, processes that can inherit these file descriptors (usually services) write messages to the system log instead of writing to the console. Therefore, in many cases, this access should dontaudited instead.
Example dontaudit usage:
init_dontaudit_use_fds(mydomain_t) term_dontaudit_use_console(mydomain_t)
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Inherit and use init script file descriptors.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write the init script pty.
Read and write the init script pty. This pty is generally opened by the open_init_pty portion of the run_init program so that the daemon does not require direct access to the administrator terminal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Write to initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Write an init script unnamed pipe.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Write to utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |