System initialization programs (init and init scripts).
false
Allow all daemons the ability to read/write terminals
false
Enable support for upstart as the init program.
Abstract socket service activation (systemd).
Parameter: | Description: |
---|---|
domain |
The domain to be started by systemd socket activation. |
Allow unconfined access to send instructions to init
Parameter: | Description: |
---|---|
domain |
Target domain |
Transition to the init script domain for all labeled init script types
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
Create a directory in the /run/systemd directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain for long running processes (daemons/services) which are started by init scripts.
Create a domain for long running processes (daemons/services) which are started by init scripts. Short running processes should use the init_system_domain() interface instead. Typically all long running processes started by an init script (usually in /etc/init.d) will need to use this interface.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the process must also run in a specific MLS/MCS level, the init_ranged_daemon_domain() should be used instead.
Parameter: | Description: |
---|---|
domain |
Type to be used as a daemon domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
Mark the file type as a daemon lock file, allowing initrc_t to create it
Parameter: | Description: |
---|---|
filetype |
Type to mark as a daemon lock file |
class |
Class on which the type is applied |
filename |
Filename of the file that the init script creates |
Mark the file type as a daemon pid file, allowing initrc_t to create it
Parameter: | Description: |
---|---|
filetype |
Type to mark as a daemon pid file |
class |
Class on which the type is applied |
filename |
Filename of the file that the init script creates |
Send and receive messages from systemd over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send and receive messages from init scripts over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send messages to init scripts over dbus.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Rename and de init_var_run_t files
Parameter: | Description: |
---|---|
domain |
domain |
Send messages to init unix datagram sockets.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Disable all services (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain which can be started by init.
Parameter: | Description: |
---|---|
domain |
Type to be used as a domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
Execute init (/sbin/init) with a domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
Execute labelled init scripts with an automatic domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
Execute init scripts with an automatic domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
Do not audit attempts to get the attributes of initctl.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to lock init script pid files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Dontaudit read all init script files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to read init script status files.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Dontaudit read the process state (/proc/pid) of init.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to read and write initctl.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to read and write utmp.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Dont audit the specified domain connecting to init scripts with a unix domain stream socket.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to inherit file descriptors from init.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to inherit init script file descriptors.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to read and write the init script pty.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Do not audit attempts to write utmp.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Allow domain dyntransition to init_t domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
Enable all systemd services (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute the init program in the caller domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute all init scripts in the caller domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute the rc application in the caller domain.
This is only applicable to Gentoo or distributions that use the OpenRC init system.
The OpenRC /sbin/rc binary is used for both init scripts as well as management applications and tools. When used for management purposes, calling /sbin/rc should never cause a transition to initrc_t.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Execute init scripts in the caller domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get status of all systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get status of generic systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow getting service status of initrc_exec_t scripts
Parameter: | Description: |
---|---|
domain |
Target domain |
Get all service status (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
get init process stats
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attribute of all init script entrypoint files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attribute of init script entrypoint files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of init script status files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the attributes of init script process id files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the process group of init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Get the process group ID of init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send a kill signal to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Transition to the init script domain on a specified labeled init script.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
init_script_file |
Labeled init script file. |
Allow listing of the /run/systemd directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
List /var/lib/systemd/ dir
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
All perms on all systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow manage service for initrc_exec_t scripts
Parameter: | Description: |
---|---|
domain |
Target domain |
Create, read, write, and delete utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Manage files in /var/lib/systemd/.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Named socket service activation (systemd).
Parameter: | Description: |
---|---|
domain |
The domain to be started by systemd socket activation. |
sock_file |
The domain socket file type. |
Create files in an init PID directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
file_type |
The type of the object to be created |
object_class |
The object class. |
name |
The name of the object being created. |
Create files in /var/run with the utmp file type.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Ptrace init
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain for long running processes (daemons/services) which are started by init scripts, running at a specified MLS/MCS range.
Create a domain for long running processes (daemons/services) which are started by init scripts, running at a specified MLS/MCS range. Short running processes should use the init_ranged_system_domain() interface instead. Typically all long running processes started by an init script (usually in /etc/init.d) will need to use this interface if they need to run in a specific MLS/MCS range.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the policy build option TYPE is standard (MLS and MCS disabled), this interface has the same behavior as init_daemon_domain().
Parameter: | Description: |
---|---|
domain |
Type to be used as a daemon domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
range |
MLS/MCS range for the domain. |
Create a domain which can be started by init, with a range transition.
Parameter: | Description: |
---|---|
domain |
Type to be used as a domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
range |
Range for the domain. |
Create a domain for short running processes which are started by init scripts.
Create a domain for long running processes (daemons/services) which are started by init scripts. These are generally applications that are used to initialize the system during boot. Long running processes should use the init_ranged_system_domain() interface instead. Typically all short running processes started by an init script (usually in /etc/init.d) will need to use this interface if they need to run in a specific MLS/MCS range.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the policy build option TYPE is standard (MLS and MCS disabled), this interface has the same behavior as init_system_domain().
Parameter: | Description: |
---|---|
domain |
Type to be used as a system domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
range |
Range for the domain. |
Read all init script files.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read init unnamed pipes.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read the process state (/proc/pid) of the init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read init script temporary data.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read the process state (/proc/pid) of init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
read systemd unit lnk files (usually under /run/systemd/units/)
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
read/follow symlinks under /var/lib/systemd/
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Reboot the system (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Relabel utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Relabel dirs in /var/lib/systemd/.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Reload all services (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Reload all systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Reload generic systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Rename init_var_run_t files
Parameter: | Description: |
---|---|
domain |
domain |
Start and stop daemon programs directly.
Start and stop daemon programs directly in the traditional "/etc/init.d/daemon start" style, and do not require run_init.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
role |
The role to be performing this action. |
Read and write init script inherited temporary data.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write to inherited init unix streams.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write init script unnamed pipes.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to read/write to init scripts with a unix domain stream sockets.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write init script temporary data.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to read/write to init with unix domain stream sockets.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain used for init scripts.
Create a domain used for init scripts. Can not be used in conjunction with init_script_file().
Parameter: | Description: |
---|---|
domain |
Type to be used as an init script domain. |
script_file |
Type of the script file used as an entry point to this domain. |
Create a file type used for init scripts.
Create a file type used for init scripts. It can not be used in conjunction with init_script_domain(). These script files are typically stored in the /etc/init.d directory.
Typically this is used to constrain what services an admin can start/stop. For example, a policy writer may want to constrain a web administrator to only being able to restart the web server, not other services. This special type will help address that goal.
This also makes the type usable for files; thus an explicit call to files_type() is redundant.
Parameter: | Description: |
---|---|
script_file |
Type to be used for a script file. |
Execute a init script in a specified domain.
Execute a init script in a specified domain.
No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.
Parameter: | Description: |
---|---|
source_domain |
Domain allowed to transition. |
target_domain |
Domain to transition to. |
Make init scripts an entry point for the specified domain.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create files in a init script temporary data directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
file_type |
The type of the object to be created |
object_class |
The object class. |
name |
The name of the object being created. |
Allow search directory in the /run/systemd directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Search the /run/systemd directory.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Search init script keys.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Search systemd unit dirs.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow specified domain to get init start
Parameter: | Description: |
---|---|
domain |
Domain to allow access. |
Allow specified domain to get init status
Parameter: | Description: |
---|---|
domain |
Domain to allow access. |
Shutdown (halt) the system (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send init a SIGCHLD signal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send SIGCHLD signals to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send init a generic signal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send generic signals to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send init a null signal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Send null signals to init scripts.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Setup a domain which can be manually transitioned to from init.
Create a domain used for systemd services where the SELinuxContext option is specified in the .service file. This allows for the manual transition from systemd into the new domain. This is used when automatic transitions won't work. Used for the case where the same binary is used for multiple target domains.
Parameter: | Description: |
---|---|
domain |
Type to be used as a domain. |
entry_point |
Type of the program being executed when starting this domain. |
Execute init scripts with a specified domain transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
Start all systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Start generic systemd units.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
start service (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Start and stop init_script_file_type services
Parameter: | Description: |
---|---|
domain |
domain that can start and stop the services |
Allow the role to start and stop labeled services.
Parameter: | Description: |
---|---|
domain |
Domain allowed to transition. |
role |
The role to be performing this action. |
domain |
Type to be used as a daemon domain. |
init_script_file |
Labeled init script file. |
unit |
Systemd unit file type. |
Stop all systemd units.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
Stop generic systemd units.
Parameter: | Description: |
---|---|
domain |
Domain to not audit. |
stop service (systemd).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Connect to init with a unix socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to connect to init scripts with a unix socket.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create a domain for short running processes which are started by init scripts.
Create a domain for short running processes which are started by init scripts. These are generally applications that are used to initialize the system during boot. Long running processes, such as daemons/services should use the init_daemon_domain() interface instead. Typically all short running processes started by an init script (usually in /etc/init.d) will need to use this interface.
The types will be made usable as a domain and file, making calls to domain_type() and files_type() redundant.
If the process must also run in a specific MLS/MCS level, the init_ranged_system_domain() should be used instead.
Parameter: | Description: |
---|---|
domain |
Type to be used as a system domain. |
entry_point |
Type of the program to be used as an entry point to this domain. |
Allow the specified domain to connect to daemon with a tcp socket
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Use telinit (Read and write initctl).
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to connect to daemon with a udp socket
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Make the specified type usable for systemd unit files.
Parameter: | Description: |
---|---|
type |
Type to be used for systemd unit files. |
Inherit and use file descriptors from init.
Allow the specified domain to inherit file descriptors from the init program (process ID 1). Typically the only file descriptors to be inherited from init are for the console. This does not allow the domain any access to the object to which the file descriptors references.
Related interfaces:
init_dontaudit_use_fds()
term_dontaudit_use_console()
term_use_console()
Example usage:
init_use_fds(mydomain_t) term_use_console(mydomain_t)
Normally, processes that can inherit these file descriptors (usually services) write messages to the system log instead of writing to the console. Therefore, in many cases, this access should dontaudited instead.
Example dontaudit usage:
init_dontaudit_use_fds(mydomain_t) term_dontaudit_use_console(mydomain_t)
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write inherited init script ptys.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Inherit and use init script file descriptors.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Read and write the init script pty.
Read and write the init script pty. This pty is generally opened by the open_init_pty portion of the run_init program so that the daemon does not require direct access to the administrator terminal.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Create files in /var/lib/systemd with an automatic type transition.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
type |
The type of object to be created |
object_class |
The object class. |
name |
The name of the object being created. |
Write to initctl.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Allow the specified domain to write to init sock file.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Write an init script unnamed pipe.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |
Write to utmp.
Parameter: | Description: |
---|---|
domain |
Domain allowed access. |