| 8 K , K % K $L 8L LL dL L L L ? L ; L & ;M 9 bM M 9 M 7 M +N /N ' 8N , `N N . N , N N O & "O / IO . yO & O 0 O / P S 0P 8 P P P P 7 P &Q -Q 1Q 8Q LQ ]Q nQ Q Q Q Q Q % Q
R R ) 'R / QR R R R R R R R > R I 4S 7 ~S $ S S ^T C T ) T T G U I VU D U 8 U 7 V L VV - V C V O W eW - W 5 W & W ) X ) ;X 1 eX 7 X p X ? @Y = Y > Y g Y eZ U Z I Z E $[ 1 j[ 6 [ M [ < !\ : ^\ : \ 2 \ 1 ] 0 9] K j] H ] 0 ] : 0^ k^ . ^ ^ < ^ & _ 7_ 7 _ 8 _ S 0` ` ` & ` & ` a -a 0 Ea + va 1 a ' a ' a & $b % Kb Q qb @ b c "c ) Bc ' lc $ c c c 3 c - %d & Sd 8 zd ) d - d @ e $ Le 0 qe $ e e 9 Pf ' f ) f f = f + 9g F eg @ g ' g 4 h % Jh # ph h , h " h A i 6 Bi yi i " j T >j 9 j " j * j k % k 2 k 3 k , +l " Xl ! {l & l l l % l 6 !m 0 Xm + m % m N m *n Fn ! cn 1 n I n G o Io I fo ? o V o K Gp G p M p 7 )q H aq 8 q q / q /r s j s 1 Wt * t t 3 t u ` u $ }u 0 u * u ] u \v w f .w E w w & w K x + kx 2 x ! x ) x $ y $ ;y ) `y ? y < y ' z /z Cz Oz fz z ( z ) z z z z 2
{ @{ Z{ g{ t{ "| +| D| 2 [| # | 1 | | 2 | } 8} " Y} |} 7~ | ( ݀ P 6 T ! j " ( ʁ , ( - I % w ( 1 Ƃ * 2 # 8 V 9 Ƀ % 1
? ] 2 z $ ̈́ ! % 0 V / r Å ( & $ B g % + $ ׆ ! $ ; ` | ' ܇ 1 O n Ո " 0 E f ډ $ % 9 + _ # ۊ * G e * 5 ! ( B ! k " ! & Ҍ $ / 8 / h 4 B ͍ . ? H 4 ) ) . < @ ) } ) . я < ) = ) g . < $ ! " D ) `
ȑ ۑ
* F . R @ Β i u 9 p Ǔ 7 8 6 p ? Y > A 4 7 6 6 $ R [ A @ @ 1 ( r 5 U ї R ' 4 z Z `
: k y @ 5 a 5 6 ͚ 4 6 9 U p 0 ƛ V ; N 8 % Ü I ; 3 E o p & K J D K T - 3 . G . v 9 9 ߠ 0 / J 8 z 6 9 C $ 6 h 7 D ע 5 7 R 4 6 5 5 , ( b C 8 Ϥ 7 5 @ 5 v
¥ A N K O \ ; G H A ̧ N ) ] 7 Ψ * * 1 W \ E Ʃ : g G d g 2 | J - ; ( ( d < ' ʬ ( 5 V " u # ) ڭ ! = _ F
U b j \ ͯ i *
˰ Ұ 1 O " l
ͱ ױ - M ; \ " ( .
) ! K ) Q / { R ? 4 ' t + Ҵ
+ < D P l 4 ڵ 6 # Z g 3 ȶ " , ?
R ]
t < # ̷
* 8 Y ! t ø % : D F ! Թ
Q C K \ 6 i 5 C ֺ B ] ` | )
H * s
$ * B ) * * T 8 8 ս
- ; A J ( j ־ & 5 E " ` ( ݿ % > U h z
" 4 E V f w : 7 = [ c | 7 6 , n F
& : R ' B < j ; G + ( = $ f ( 0 + . 5 Z 6
q f l s " ! 2 O g =
| 3 , * ' . E t 1 ' ' E H ^ r ' ) D n " , * r D " 7 O ) m & ' ] p } 0 r U +
. * A L ^ L % C i " < E + 0 B 3 s # ; ^ ) , 4 # G k t V ~ ' ,
* 5 ( K ( t " ( ? [ v
+ ) U p
" # 7 4 8 < ; 7 x 7 3 c F $ = % @ 7 f
" ' / % A $ g # , % ' H e ~ c ^ ; Z J % E 7 M 4 0 @
> N % 4 > < B 9 E H u H P " 4 : F 4 - " G 5 j # : 8 C S ? %
3 > U Z j l n F " I ] + P G m " p v \ x g = O ` z t I Z 9 K N L / Q | O a c > r v 2 * ] o u M Y b i g m R c [ $ Z ^ w : z ` - Y = [ & : _ E c \ $ ` q = T = R R # ; v 1 b B G S K I * F t B o g n B J N d @ ? H 4 1 } b M F ` N I L @ ] O O ;
?
a O O M D ` N C
n
f F h [ B E N < P ; " g ^ f - 7 L j Z A \ C K S \ @ L A A , D n @ : K / b { F O % = u ; 5 : q > S ? l H 8 r f [ k f R ^ G x Q 9 q A - K ! g" c
# T q# ; # Z $ C ]$ $ I <% X % b % B& & 8 ' -( t ( : >) K y) i ) c /* W * A * X -+ A + B + K , Y W, L , @ , ?- X- d- # ~- - + - / - . . ' &. K N. & . . . .
/ / / 5 0 N0 K m0 0 @ 0 * 1 3 ,1 5 `1 1 2 z4 h5 0 q5 5 " 5
5 P 5 2 76 j6 0 6 * 6 A 6 : #7 = ^7 : 7 M 7 : %8 G `8 K 8 D 8 \ 99 Q 9 R 9 % ;: 6 a: ? : + : ' ; A ,; . n; 3 ; - ; + ; D +< $ p< = < . < 8 = ;= 9 T= 3 = , = + = ? > ; [> / > $ > 4 > 9 !? $ [? ) ? . ? * ? # @ ' (@ " P@ . s@ , @ 3 @ A - A , GA % tA 2 A = A " B 9 .B + hB " B ; B B 6 C 6 EC . |C B C > C ) -D WD 5 sD 5 D - D =
E 9 KE 4 E < E G E 3 ?F 4 sF ; F 5 F 2 G A MG 6 G 9 G # H 9 $H ? ^H ? H B H R !I 0 tI * I M I H J : gJ : J = J L K 9 hK 9 K < K K L @ eL @ L C L S +M 2 M - M 9 M @ N [N tN |N N N N N N N O 2 O PO A hO O ] O P Q ' $Q H LQ Q I "R H lR f R S Q S U S O RT N T A T o 3U [ U Z U P ZV ; V G V v /W _ W A X w HX z X L ;Y Y S MZ L Z R Z P A[ P [ M [ | 1\ ; \ o \ R Z] O ] A ] h ?^ U ^ Q ^ P_ _ x ` w "a [ a m a E db Y b E c F Jc Y c V c G Bd I d W d N ,e A {e k e G )f N qf Z f L g K hg A g P g O Gh N h 1 h h i S i W i W -j L j j j ) j k # *k I Nk t k i
l wl E l d @m U m p m 5 ln n n n 3 n ^ o 2 xo B o o pp |p w p ` p _q q cr W r =s ; s Q s > Nt X t ( t 0 u @u 8 Zu , u 8 u 5 u + /v , [v # v * v v v w K 9w w w w Y w r x x y y y
y y 0 y , *z # Wz ( {z ( z # z z { { ){ 5{ ?{ U{ j{ - v{ < { { D { * :| A e| B | | . | -} 5} 6 V} P } } } ( } ( ~ B <~ 3 ~ ' ~ % ~ :
< J 8 W B $ B Y . r F " C [ g m ) . . C c x U ; $ . = A F
U c 4 v * 5 փ * 7 D U 6 r $ ΄ B - S I
" f s } 1 + ӆ G C G $ % ڇ : L d { x % * 7 b 4 g Q , - I S 5 h D
$ " . 9 Q 1 . ʋ ! ' > C ' ! M 0 ~ ƍ ߍ
! 5 % H n Ԏ 9 S k F L , L & y ! ʐ ސ B B U : 5 Q ݒ C / 2 s Z ` e b ȕ " ޕ # %
= K Z & n A > ז 5 8 L 9
җ ݗ ٘ , % ' ! M ( o / ș " : + f v | - ) , ) G 7 q
> 0 0 $ L U ў 6 9 ҟ ' 0 4 = e / + Ӡ 7 7 # % " 7 Z & v . : ̢ # / + 4 [ q 9 V O 5 V ) f 9 G C ] a Ч ^
2 i . + ˨ J Y B % 2 © = 3 < K
S 6 a r ث # 9 C ( V ! o - ! , O | ? 6 2 ; M / 0 & ( 6 : 3 q 2 ( د , . 6 > F N V ^ f ( n 3 $ ˰ # # 5 G 8 } G H R M S N x C _ - 9 = C w 5 ^ P ] } µ
ݵ
- , A + n . 1 9 ^ a 8 E \ b P O
T , j Y a u 5 V T 5 N < P "
6 Y [ K k E p ? K I ; ? h - s \ R \ m \ ^ i r S ( z < / m h & x x 1 $ w R ; | . e y r S m @ - D a L M 2 d @ { " X > N { Q = w g = + s s ) X H 3 m & D } + . { 4 _ I $ [ 9 A _ ) - 1 0
O _ v r ^ b G c ~ > T w 6 x A / M ~ C & " ' < I K 3 A 6 $ 8 [ C g L ( k n F E i F ? ] t 7 v N d t G 8 Z H o 0 q 4 M G W v V ' e x U } v
] c / + q q F J > ) 5 u % R Z n ~ C 7 X j c f % R W F O z V 2 @ ` 4 B ! | Z k L | b ' j 9 f Q z o J _ o Q
Y [ n p p 3 W A U D P N J n ,
9 J " 2 < *
Z h y c ! X B ` 5 ] B ` T L l 7 d * | ' p t $ # l P 8 ( # % 1 } B U j y M 4 3 ( s ] G ; b I W t y H , r S U = * C = o Y : # ; > + q H l Q : 0 l * a k { , E ~ } . ^ K i e w @ f 7 % ? # D 6 S 0 z : O ) ` ! g e - V i g d / ! f : h u & 2 u
SELinux Distribution fcontext Equivalence
SELinux Local fcontext Equivalence
%s changed labels.
%s is already in %s %s is not a domain type %s is not a valid context
%s is not a valid domain %s is not in %s %s must be a directory %s! Could not get current context for %s, not relabeling tty.
%s! Could not get new context for %s, not relabeling tty.
%s! Could not set new context for %s
%s: Can't load policy and enforcing mode requested: %s
%s: Can't load policy: %s
%s: Policy is already loaded and initial load requested
******************** IMPORTANT ***********************
... 600-1024 Add booleans from the %s policy: Add files/directories that %s manages Applications Enter name of application or user role: Enter network ports that %s binds on: Login Users Root Users Select additional roles for %s: Select common application traits for %s: Select domains that %s will administer: Select existing role to modify: Select network ports that %s connects to: Select roles that %s will transition to: Select the policy type for the application or user role you want to confine: Select the user_roles that will transition to %s: Select: TCP Ports UDP Ports Which directory you will generate the %s policy? Action Add Add %s Add Booleans Dialog Add File Context Add Network Port Add SELinux Login Mapping Add SELinux Network Ports Add SELinux User Add SELinux User Mapping Add SELinux Users Add User Add new SELinux User/Role definition. Add ports for %s Add user Add/Remove booleans used by the %s domain Addr %s is defined in policy, cannot be deleted Addr %s is not defined Admin User Role Administrator Login User Role Advanced << Advanced Search << All All domains Allow %s to call bindresvport with 0. Binding to port 600-1024 Allow ABRT to modify public files used for public file transfer services. Allow Apache to communicate with avahi service via dbus Allow Apache to execute tmp content. Allow Apache to modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t. Allow Apache to query NS records Allow Apache to run in stickshift mode, not transition to passenger Allow Apache to use mod_auth_ntlm_winbind Allow Apache to use mod_auth_pam Allow HTTPD scripts and modules to connect to cobbler over the network. Allow HTTPD scripts and modules to connect to databases over the network. Allow HTTPD scripts and modules to connect to the network using TCP. Allow HTTPD scripts and modules to server cobbler files. Allow HTTPD to connect to port 80 for graceful shutdown Allow HTTPD to run SSI executables in the same domain as system CGI scripts. Allow Puppet client to manage all file types. Allow Puppet master to use connect to MySQL and PostgreSQL database Allow ZoneMinder to modify public files used for public file transfer services. Allow ZoneMinder to run su/sudo. Allow a user to login as an unconfined domain Allow all daemons the ability to read/write terminals Allow all daemons to use tcp wrappers. Allow all daemons to write corefiles to / Allow all domains to execute in fips_mode Allow all domains to have the kernel load modules Allow all domains to use other domains file descriptors Allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t Allow antivirus programs to read non security files on a system Allow any files/directories to be exported read/only via NFS. Allow any files/directories to be exported read/write via NFS. Allow apache scripts to write to public content, directories/files must be labeled public_rw_content_t. Allow auditadm to exec content Allow cluster administrative cluster domains memcheck-amd64- to use executable memory Allow cluster administrative domains to connect to the network using TCP. Allow cluster administrative domains to manage all files on a system. Allow confined applications to run with kerberos. Allow confined applications to use nscd shared memory. Allow confined users the ability to execute the ping and traceroute commands. Allow confined virtual guests to interact with rawip sockets Allow confined virtual guests to interact with the sanlock Allow confined virtual guests to interact with the xserver Allow confined virtual guests to manage cifs files Allow confined virtual guests to manage nfs files Allow confined virtual guests to read fuse files Allow confined virtual guests to use executable memory and executable stack Allow confined virtual guests to use serial/parallel communication ports Allow confined virtual guests to use usb devices Allow confined web browsers to read home directory content Allow cups execmem/execstack Allow database admins to execute DML statement Allow dbadm to exec content Allow dhcpc client applications to execute iptables commands Allow ftpd to use ntfs/fusefs volumes. Allow glusterfsd to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t. Allow glusterfsd to share any file/directory read only. Allow glusterfsd to share any file/directory read/write. Allow gpg web domain to modify public files used for public file transfer services. Allow guest to exec content Allow http daemon to check spam Allow http daemon to connect to mythtv Allow http daemon to connect to zabbix Allow http daemon to send mail Allow httpd cgi support Allow httpd daemon to change its resource limits Allow httpd processes to manage IPA content Allow httpd scripts and modules execmem/execstack Allow httpd to access FUSE file systems Allow httpd to access cifs file systems Allow httpd to access nfs file systems Allow httpd to access openstack ports Allow httpd to act as a FTP client connecting to the ftp port and ephemeral ports Allow httpd to act as a FTP server by listening on the ftp port. Allow httpd to act as a relay Allow httpd to connect to sasl Allow httpd to connect to memcache server Allow httpd to connect to the ldap port Allow httpd to read home directories Allow httpd to read user content Allow httpd to run gpg Allow httpd to use built in scripting (usually php) Allow ksmtuned to use cifs/Samba file systems Allow ksmtuned to use nfs file systems Allow logging in and using the system from /dev/console. Allow mailman to access FUSE file systems Allow mock to read files in home directories. Allow mozilla plugin domain to connect to the network using TCP. Allow mozilla plugin to support GPS. Allow mozilla plugin to support spice protocols. Allow mysqld to connect to all ports Allow nfs servers to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t. Allow openshift to access nfs file systems without labels Allow openvpn to run unconfined scripts Allow pcp to bind to all unreserved_ports Allow pcp to read generic logs Allow piranha-lvs domain to connect to the network using TCP. Allow polipo to connect to all ports > 1023 Allow postfix_local domain full write access to mail_spool directories Allow postgresql to use ssh and rsync for point-in-time recovery Allow pppd to be run for a regular user Allow pppd to load kernel modules for certain modems Allow qemu-ga to manage qemu-ga date. Allow qemu-ga to read qemu-ga date. Allow racoon to read shadow Allow regular users direct dri device access Allow rpcd_t to manage fuse files Allow rsync server to manage all files/directories on the system. Allow rsync to export any files/directories read only. Allow rsync to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t. Allow rsync to run as a client Allow samba to act as a portmapper Allow samba to act as the domain controller, add users, groups and change passwords. Allow samba to create new home directories (e.g. via PAM) Allow samba to export NFS volumes. Allow samba to export ntfs/fusefs volumes. Allow samba to modify public files used for public file transfer services. Files/Directories must be labeled public_content_rw_t. Allow samba to run unconfined scripts Allow samba to share any file/directory read only. Allow samba to share any file/directory read/write. Allow samba to share users home directories. Allow sanlock to manage cifs files Allow sanlock to manage nfs files Allow sanlock to read/write fuse files Allow sasl to read shadow Allow secadm to exec content Allow sge to access nfs file systems. Allow sge to connect to the network using any TCP port Allow spamd to read/write user home directories. Allow spamd_update to connect to all ports. Allow ssh logins as sysadm_r:sysadm_t Allow ssh with chroot env to read and write files in the user home directories Allow staff to exec content Allow sysadm to exec content Allow syslogd daemon to send mail Allow syslogd the ability to read/write terminals Allow system cron jobs to relabel filesystem for restoring file contexts. Allow system cronjob to be executed on on NFS, CIFS or FUSE filesystem. Allow system to run with NIS Allow tftp to modify public files used for public file transfer services. Allow tftp to read and write files in the user home directories Allow the Irssi IRC Client to connect to any port, and to bind to any unreserved port. Allow the Telepathy connection managers to connect to any generic TCP port. Allow the Telepathy connection managers to connect to any network port. Allow the graphical login program to create files in HOME dirs as xdm_home_t. Allow the graphical login program to execute bootloader Allow the graphical login program to login directly as sysadm_r:sysadm_t Allow the mount commands to mount any directory or file. Allow tor to act as a relay Allow transmit client label to foreign database Allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla Allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla Allow unconfined users to transition to the Mozilla plugin domain when running xulrunner plugin-container. Allow unprivileged users to execute DDL statement Allow user to use ssh chroot environment. Allow user music sharing Allow user spamassassin clients to use the network. Allow user to exec content Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY) Allow users to connect to PostgreSQL Allow users to connect to the local mysql server Allow users to login using a radius server Allow users to resolve user passwd entries directly from ldap rather then using a sssd server Allow users to run TCP servers (bind to ports and accept connection from the same domain and outside users) disabling this forces FTP passive mode and may change other protocols. Allow xen to manage nfs files Allow xend to run blktapctrl/tapdisk. Not required if using dedicated logical volumes for disk images. Allow xend to run qemu-dm. Not required if using paravirt and no vfb. Allow xguest to exec content Allow xguest to use blue tooth devices Allow xguest users to configure Network Manager and connect to apache ports Allow xguest users to mount removable media Allow zebra daemon to write it configuration files Allows %s to bind to any udp port Allows %s to bind to any udp ports > 1024 Allows %s to connect to any tcp port Allows %s to connect to any udp port Allows XServer to execute writable memory Allows clients to write to the X server shared memory segments. Alternate SELinux policy, defaults to /sys/fs/selinux/policy Alternate root directory, defaults to / Analyzing Policy... Application Application File Types Applications - Advanced Search Apply Are you sure you want to delete %s '%s'? Bad format %(BOOLNAME)s: Record %(VALUE)s Boolean Boolean
Enabled Boolean %s Allow Rules Boolean %s is defined in policy, cannot be deleted Boolean %s is not defined Boolean Name Boolean name Boolean to determine whether the system permits loading policy, setting enforcing mode, and changing boolean values. Set this to true and you have to reboot to set it back. Booleans Builtin Permissive Types Calling Process Domain Can not combine +/- with other types of categories Can not have multiple sensitivities Can not modify sensitivity levels using '+' on %s Cancel Cannot find your entry in the shadow passwd file.
Cannot read policy store. Change process mode to enforcing Change process mode to permissive. Changing the policy type will cause a relabel of the entire file system on the next boot. Relabeling takes a long time depending on the size of the file system. Do you wish to continue? Changing to SELinux disabled requires a reboot. It is not recommended. If you later decide to turn SELinux back on, the system will be required to relabel. If you just want to see if SELinux is causing a problem on your system, you can go to permissive mode which will only log errors and not enforce SELinux policy. Permissive mode does not require a reboot Do you wish to continue? Changing to SELinux enabled will cause a relabel of the entire file system on the next boot. Relabeling takes a long time depending on the size of the file system. Do you wish to continue? Class Command required for this type of policy Configue SELinux Confined Root Administrator Role Context Copyright (c)2006 Red Hat, Inc.
Copyright (c) 2006 Dan Walsh Could not add SELinux user %s Could not add addr %s Could not add file context for %s Could not add interface %s Could not add login mapping for %s Could not add port %(PROTOCOL)s/%(PORT)s Could not add prefix %(PREFIX)s for %(ROLE)s Could not add role %(ROLE)s for %(NAME)s Could not check if SELinux user %s is defined Could not check if addr %s is defined Could not check if boolean %s is defined Could not check if file context for %s is defined Could not check if interface %s is defined Could not check if login mapping for %s is defined Could not check if port %(PROTOCOL)s/%(PORT)s is defined Could not check if port @%(PROTOCOL)s/%(PORT)s is defined Could not close descriptors.
Could not commit semanage transaction Could not create a key for %(PROTOTYPE)s/%(PORT)s Could not create a key for %s Could not create addr for %s Could not create context for %(PROTOCOL)s/%(PORT)s Could not create context for %s Could not create file context for %s Could not create interface for %s Could not create key for %s Could not create login mapping for %s Could not create module key Could not create port for %(PROTOCOL)s/%(PORT)s Could not create semanage handle Could not delete SELinux user %s Could not delete addr %s Could not delete all interface mappings Could not delete boolean %s Could not delete file context for %s Could not delete interface %s Could not delete login mapping for %s Could not delete port %(PROTOCOL)s/%(PORT)s Could not delete the file context %s Could not delete the port %s Could not deleteall node mappings Could not determine enforcing mode.
Could not disable module %s Could not enable module %s Could not establish semanage connection Could not extract key for %s Could not get module enabled Could not get module lang_ext Could not get module name Could not get module priority Could not list SELinux modules Could not list SELinux users Could not list addrs Could not list booleans Could not list file contexts Could not list interfaces Could not list local file contexts Could not list login mappings Could not list ports Could not list roles for user %s Could not list the file contexts Could not list the ports Could not modify SELinux user %s Could not modify addr %s Could not modify boolean %s Could not modify file context for %s Could not modify interface %s Could not modify login mapping for %s Could not modify port %(PROTOCOL)s/%(PORT)s Could not open file %s
Could not query addr %s Could not query file context %s Could not query file context for %s Could not query interface %s Could not query port %(PROTOCOL)s/%(PORT)s Could not query seuser for %s Could not query user for %s Could not remove module %s (remove failed) Could not remove permissive domain %s (remove failed) Could not set MLS level for %s Could not set MLS range for %s Could not set SELinux user for %s Could not set active value of boolean %s Could not set addr context for %s Could not set exec context to %s.
Could not set file context for %s Could not set interface context for %s Could not set mask for %s Could not set message context for %s Could not set mls fields in addr context for %s Could not set mls fields in file context for %s Could not set mls fields in interface context for %s Could not set mls fields in port context for %(PROTOCOL)s/%(PORT)s Could not set module key name Could not set name for %s Could not set permissive domain %s (module installation failed) Could not set port context for %(PROTOCOL)s/%(PORT)s Could not set role in addr context for %s Could not set role in file context for %s Could not set role in interface context for %s Could not set role in port context for %(PROTOCOL)s/%(PORT)s Could not set type in addr context for %s Could not set type in file context for %s Could not set type in interface context for %s Could not set type in port context for %(PROTOCOL)s/%(PORT)s Could not set user in addr context for %s Could not set user in file context for %s Could not set user in interface context for %s Could not set user in port context for %(PROTOCOL)s/%(PORT)s Could not start semanage transaction Could not test MLS enabled status Couldn't get default type.
Create/Manipulate temporary files in /tmp Current Enforcing Mode Customized Customized Permissive Types DBUS System Daemon Default Default Level Delete Delete %s Delete File Context Delete Network Port Delete SELinux User Mapping Delete User Delete modified SELinux User/Role definitions. Delete user Deny any process from ptracing or debugging any other processes. Deny user domains applications to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla Description Desktop Login User Role Determine whether Bind can bind tcp socket to http ports. Determine whether Bind can write to master zone files. Generally this is used for dynamic DNS or zone transfers. Determine whether Cobbler can access cifs file systems. Determine whether Cobbler can access nfs file systems. Determine whether Cobbler can connect to the network using TCP. Determine whether Cobbler can modify public files used for public file transfer services. Determine whether Condor can connect to the network using TCP. Determine whether DHCP daemon can use LDAP backends. Determine whether Git CGI can access cifs file systems. Determine whether Git CGI can access nfs file systems. Determine whether Git CGI can search home directories. Determine whether Git session daemon can bind TCP sockets to all unreserved ports. Determine whether Git system daemon can access cifs file systems. Determine whether Git system daemon can access nfs file systems. Determine whether Git system daemon can search home directories. Determine whether Gitosis can send mail. Determine whether Polipo can access nfs file systems. Determine whether Polipo session daemon can bind tcp sockets to all unreserved ports. Determine whether attempts by wine to mmap low regions should be silently blocked. Determine whether awstats can purge httpd log files. Determine whether calling user domains can execute Git daemon in the git_session_t domain. Determine whether calling user domains can execute Polipo daemon in the polipo_session_t domain. Determine whether can antivirus programs use JIT compiler. Determine whether cdrecord can read various content. nfs, samba, removable devices, user temp and untrusted content files Determine whether collectd can connect to the network using TCP. Determine whether conman can connect to all TCP ports Determine whether cvs can read shadow password files. Determine whether dbadm can manage generic user files. Determine whether dbadm can read generic user files. Determine whether docker can connect to all TCP ports. Determine whether entropyd can use audio devices as the source for the entropy feeds. Determine whether exim can connect to databases. Determine whether exim can create, read, write, and delete generic user content files. Determine whether exim can read generic user content files. Determine whether fenced can connect to the TCP network. Determine whether fenced can use ssh. Determine whether ftpd can bind to all unreserved ports for passive mode. Determine whether ftpd can connect to all unreserved ports. Determine whether ftpd can connect to databases over the TCP network. Determine whether ftpd can login to local users and can read and write all files on the system, governed by DAC. Determine whether ftpd can modify public files used for public file transfer services. Directories/Files must be labeled public_content_rw_t. Determine whether ftpd can use CIFS used for public file transfer services. Determine whether ftpd can use NFS used for public file transfer services. Determine whether icecast can listen on and connect to any TCP port. Determine whether irc clients can listen on and connect to any unreserved TCP ports. Determine whether mcelog can execute scripts. Determine whether mcelog can use all the user ttys. Determine whether mcelog supports client mode. Determine whether mcelog supports server mode. Determine whether minidlna can read generic user content. Determine whether mpd can traverse user home directories. Determine whether mpd can use cifs file systems. Determine whether mpd can use nfs file systems. Determine whether mplayer can make its stack executable. Determine whether neutron can connect to all TCP ports Determine whether openvpn can connect to the TCP network. Determine whether openvpn can read generic user home content files. Determine whether polipo can access cifs file systems. Determine whether privoxy can connect to all tcp ports. Determine whether smartmon can support devices on 3ware controllers. Determine whether squid can connect to all TCP ports. Determine whether squid can run as a transparent proxy. Determine whether swift can connect to all TCP ports Determine whether tmpreaper can use cifs file systems. Determine whether tmpreaper can use nfs file systems. Determine whether tmpreaper can use samba_share files Determine whether to support lpd server. Determine whether tor can bind tcp sockets to all unreserved ports. Determine whether varnishd can use the full TCP network. Determine whether webadm can manage generic user files. Determine whether webadm can read generic user files. Determine whether zabbix can connect to all TCP ports Disable Disable Audit Disable kernel module loading. Disabled Disabled
Permissive
Enforcing
Display applications that can transition into or out of the '%s'. Display applications that can transition into or out of the 'selected domain'. Display boolean information that can be used to modify the policy for the '%s'. Display boolean information that can be used to modify the policy for the 'selected domain'. Display file type information that can be used by the '%s'. Display file type information that can be used by the 'selected domain'. Display network ports to which the '%s' can connect or listen to. Display network ports to which the 'selected domain' can connect or listen to. Domain name(s) of man pages to be created Edit Network Port Enable Enable Audit Enable cluster mode for daemons. Enable extra rules in the cron domain to support fcron. Enable polyinstantiated directory support. Enable reading of urandom for all domains. Enable/Disable additional audit rules, that are normally not reported in the log files. Enabled Enforcing Enter SELinux role(s) to which the administror domain will transition Enter SELinux user(s) which will transition to this domain Enter a comma separated list of tcp ports or ranges of ports that %s connects to. Example: 612, 650-660 Enter a comma separated list of udp ports or ranges of ports that %s binds to. Example: 612, 650-660 Enter a comma separated list of udp ports or ranges of ports that %s connects to. Example: 612, 650-660 Enter complete path for executable to be confined. Enter complete path to init script used to start the confined application. Enter domain type which you will be extending Enter domain(s) which this confined admin will administrate Enter interface names, you wish to query Enter unique name for the confined application or user role. Equivalence class for %s already exists Equivalence class for %s does not exists Error allocating memory.
Error allocating shell's argv0.
Error changing uid, aborting.
Error connecting to audit system.
Error resetting KEEPCAPS, aborting
Error sending audit message.
Error! Could not clear O_NONBLOCK on %s
Error! Could not open %s.
Error! Shell is not valid.
Error: multiple levels specified
Error: multiple roles specified
Error: multiple types specified
Error: you are not allowed to change levels on a non secure terminal
Executable Executable File Executable Files Executables which will transition to a different domain, when the '%s' executes them. Executables which will transition to a different domain, when the 'selected domain' executes them. Executables which will transition to the '%s', when executing a selected domains entrypoint. Executables which will transition to the 'selected domain', when executing a selected domains entrypoint. Existing Domain Type Existing User Roles Existing_User Export Export system settings to a file Failed to close tty properly
Failed to drop capabilities %m
Failed to read %s policy file Failed to send audit message Failed to transition to namespace
File
Specification File
Type File Contexts file File Labeling File Name File Path File Specification File Type File Types defined for the '%s'. File Types defined for the 'selected domain'. File class: %s File context for %s is defined in policy, cannot be deleted File context for %s is not defined File path used to enter the '%s' domain. File path used to enter the 'selected domain'. File path: %s File specification can not include spaces Files Files to which the '%s' domain can write. Files to which the 'selected domain' can write. Files/Directories which the %s "manages". Pid Files, Log Files, /var/lib Files ... Filter GPL Generate '%s' policy Generate '%s' policy Generate HTML man pages structure for selected SELinux man page Generate SELinux Policy module template Generate SELinux man pages Generate new policy module Graphical User Interface for SELinux Policy Group View Import Import system settings from another machine Inbound Init script Interacts with the terminal Interface %s does not exist. Interface %s is defined in policy, cannot be deleted Interface %s is not defined Interface file Internet Services Daemon Internet Services Daemon (inetd) Internet Services Daemon are daemons started by xinetd Invalid Port Invalid file specification Invalid priority %d (needs to be between 1 and 999) Labeling Language Linux Group %s does not exist Linux User %s does not exist List SELinux Policy interfaces List View Load Policy Module Load policy module Login
Name Login '%s' is required Login Name Login Name : %s Login mapping for %s is defined in policy, cannot be deleted Login mapping for %s is not defined MCS Level MCS Range MLS MLS/ MLS/
MCS Range MLS/MCS
Level MLS/MCS Range Minimal Terminal Login User Role Minimal Terminal User Role Minimal X Windows Login User Role Minimal X Windows User Role Modify Modify %s Modify File Context Modify SELinux User Mapping Modify SELinux Users Modify User Modify an existing login user record. Modify user Module %s already loaded in current policy.
Do you want to continue? Module Name Module does not exists %s Module information for a new type More Details More Types Name Name must be alpha numberic with no spaces. Consider using option "-n MODULENAME" Network Network
Bind tab Network Port Network Ports to which the '%s' is allowed to connect. Network Ports to which the '%s' is allowed to listen. Network Ports to which the 'selected domain' is allowed to connect. Network Ports to which the 'selected domain' is allowed to listen. No No SELinux Policy installed No context in file %s
Node Address is required Not yet implemented Only Daemon apps can use an init script.. Options Error %s Out of memory!
Outbound Password: Permissive Permit to prosody to bind apache port. Need to be activated to use BOSH. Policy Directory Policy Module Policy types which require a command Port Port %(PROTOCOL)s/%(PORT)s already defined Port %(PROTOCOL)s/%(PORT)s is defined in policy, cannot be deleted Port %(PROTOCOL)s/%(PORT)s is not defined Port @%(PROTOCOL)s/%(PORT)s is not defined Port Number Port is required Port number "%s" is not valid. 0 < PORT_NUMBER < 65536 Ports must be numbers or ranges of numbers from 1 to %d Prefix Priority Process Domain Process Types Proto Protocol Protocol udp or tcp is required Query SELinux policy network information Red Hat 2007 Relabel on next reboot. Remove loadable policy module Requires at least one category Requires prefix or roles Requires prefix, roles, level or range Requires setype Requires setype or serange Requires setype, serange or seuser Requires seuser or serange Revert Revert Changes Revert boolean setting to system default Role Roles: %s Root Admin User Role SELinux
User SELinux Administration SELinux Application Type SELinux Directory Type SELinux File Label SELinux File Type SELinux Interface SELinux Policy Generation Tool SELinux Port
Type SELinux Port Type SELinux Roles SELinux Type SELinux Type is required SELinux User SELinux User : %s SELinux User Name SELinux User: %s SELinux Username SELinux boolean SELinux fcontext SELinux file type: %s SELinux node type is required SELinux policy is not managed or store cannot be accessed. SELinux user %s is defined in policy, cannot be deleted SELinux user %s is not defined SELinux user '%s' is required Sandbox Select Management Object Select Ports Select Root Administrator User Role, if this user will be used to administer the machine while running as root. This user will not be able to login to the system directly. Select applications domains that %s will transition to. Select directory to generate policy files in Select directory(s) that the confined application owns and writes into Select domain Select executable file to be confined. Select file(s) that confined application creates or writes Select if you wish to relabel then entire file system on next reboot. Relabeling can take a very long time, depending on the size of the system. If you are changing policy types or going from disabled to enforcing, a relabel is required. Select init script file to be confined. Select the domains that you would like this user administer. Select the user roles that will transiton to the %s domain. Select the user roles that will transiton to this applications domains. Selinux
File Type Semanage transaction already in progress Semanage transaction not in progress Sends audit messages Sends email Service Setup Script Show Modified Only Show ports defined for this SELinux type Sorry, -l may be used with SELinux MLS support.
Sorry, newrole failed to drop capabilities
Sorry, newrole may be used only on a SELinux kernel.
Sorry, run_init may be used only on a SELinux kernel.
Source Domain Spec file Standard Init Daemon Standard Init Daemon are daemons started on boot via init scripts. Usually requires a script in /etc/rc.d/init.d State Status Support NFS home directories Support SAMBA home directories Support X userspace object manager Support ecryptfs home directories Support fusefs home directories System Default Enforcing Mode System Default Policy Type: System Status: Disabled System Status: Enforcing System Status: Permissive Target %s is not valid. Target is not allowed to end with '/' Target Domain The sepolgen python module is required to setup permissive domains.
In some distributions it is included in the policycoreutils-devel patckage.
# yum install policycoreutils-devel
Or similar for your distro. This user can login to a machine via X or terminal. By default this user will have no setuid, no networking, no sudo, no su This user will login to a machine only via a terminal or remote login. By default this user will have no setuid, no networking, no su, no sudo. To make this policy package active, execute: Toggle between Customized and All Booleans Toggle between Customized and All Ports Toggle between all and customized file context Transitions Type %s is invalid, must be a file or device type Type %s is invalid, must be a node type Type %s is invalid, must be a port type Type %s_t already defined in current policy.
Do you want to continue? Type Enforcement file Type field required Type is required Types USAGE: run_init