Global tunables:

allow_console_login
Default value

false

Description

Allow users to connect to console (s390)

allow_execheap
Default value

false

Description

Allow making the heap executable.

allow_execmem
Default value

false

Description

Allow making anonymous memory executable, e.g. for runtime-code generation or executable stack.

allow_execmod
Default value

false

Description

Allow making a modified private file mapping executable (text relocation).

allow_execstack
Default value

false

Description

Allow making the stack executable via mprotect. Also requires allow_execmem.

allow_polyinstantiation
Default value

false

Description

Enable polyinstantiated directory support.

allow_ypbind
Default value

false

Description

Allow system to run with NIS

global_ssp
Default value

false

Description

Enable reading of urandom for all domains.

This should be enabled when all programs are compiled with ProPolice/SSP stack smashing protection. All domains will be allowed to read from /dev/urandom.

mail_read_content
Default value

false

Description

Allow email client to various content. nfs, samba, removable devices, user temp and untrusted content files

nfs_export_all_ro
Default value

false

Description

Allow nfs to be exported read only

nfs_export_all_rw
Default value

false

Description

Allow nfs to be exported read/write.

read_default_t
Default value

false

Description

Allow reading of default_t files.

read_untrusted_content
Default value

false

Description

Allow applications to read untrusted content If this is disallowed, Internet content has to be manually relabeled for read access to be granted

use_nfs_home_dirs
Default value

false

Description

Support NFS home directories

use_samba_home_dirs
Default value

false

Description

Support SAMBA home directories

user_tcp_server
Default value

false

Description

Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols.

write_untrusted_content
Default value

false

Description

Allow applications to write untrusted content If this is disallowed, no Internet content will be stored.

xen_use_nfs
Default value

false

Description

Allow xen to manage nfs files