[selinux-policy: 468/3172] update for 20050707 release
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 19:45:08 UTC 2010
commit 767266c2a75cdfafd8dfa75f2c0add3258818a01
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Thu Jul 7 17:19:13 2005 +0000
update for 20050707 release
www/api-docs/admin_consoletype.html | 5 +-
www/api-docs/admin_dmesg.html | 3 +-
www/api-docs/admin_logrotate.html | 3 +-
www/api-docs/admin_netutils.html | 3 +-
www/api-docs/admin_rpm.html | 3 +-
www/api-docs/admin_usermanage.html | 3 +-
www/api-docs/apps_gpg.html | 3 +-
www/api-docs/index.html | 11 +-
www/api-docs/interfaces.html | 686 +++++++++++++++++++++++++++++++-
www/api-docs/kernel.html | 3 +-
www/api-docs/kernel_bootloader.html | 3 +-
www/api-docs/kernel_corenetwork.html | 46 ++-
www/api-docs/kernel_devices.html | 46 ++-
www/api-docs/kernel_filesystem.html | 46 ++-
www/api-docs/kernel_kernel.html | 51 +++-
www/api-docs/kernel_selinux.html | 48 +++-
www/api-docs/kernel_storage.html | 144 +++++---
www/api-docs/kernel_terminal.html | 3 +-
www/api-docs/services_cron.html | 3 +-
www/api-docs/services_inetd.html | 3 +-
www/api-docs/services_kerberos.html | 5 +-
www/api-docs/services_mta.html | 46 ++-
www/api-docs/services_nis.html | 3 +-
www/api-docs/services_remotelogin.html | 3 +-
www/api-docs/services_sendmail.html | 3 +-
www/api-docs/services_ssh.html | 3 +-
www/api-docs/system.html | 8 +
www/api-docs/system_authlogin.html | 6 +-
www/api-docs/system_clock.html | 6 +-
www/api-docs/system_corecommands.html | 8 +-
www/api-docs/system_domain.html | 49 +++-
www/api-docs/system_files.html | 110 +++++-
www/api-docs/system_fstools.html | 6 +-
www/api-docs/system_getty.html | 6 +-
www/api-docs/system_hostname.html | 6 +-
www/api-docs/system_hotplug.html | 8 +-
www/api-docs/system_init.html | 163 +++++++-
www/api-docs/system_iptables.html | 6 +-
www/api-docs/system_libraries.html | 6 +-
www/api-docs/system_locallogin.html | 6 +-
www/api-docs/system_logging.html | 6 +-
www/api-docs/system_lvm.html | 6 +-
www/api-docs/system_miscfiles.html | 6 +-
www/api-docs/system_modutils.html | 6 +-
www/api-docs/system_mount.html | 6 +-
www/api-docs/system_selinuxutil.html | 6 +-
www/api-docs/system_sysnetwork.html | 6 +-
www/api-docs/system_udev.html | 6 +-
www/api-docs/system_unconfined.html | 395 ++++++++++++++++++
www/api-docs/system_userdomain.html | 47 +++-
www/api-docs/templates.html | 29 ++
51 files changed, 1954 insertions(+), 138 deletions(-)
---
diff --git a/www/api-docs/admin_consoletype.html b/www/api-docs/admin_consoletype.html
index 37a4b2d..8e96522 100644
--- a/www/api-docs/admin_consoletype.html
+++ b/www/api-docs/admin_consoletype.html
@@ -72,9 +72,10 @@
<h3>Description:</h3>
-<p>
+<p><p>
Determine of the console connected to the controlling terminal.
-</p>
+</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/admin_dmesg.html b/www/api-docs/admin_dmesg.html
index 0d4fb90..45c45d7 100644
--- a/www/api-docs/admin_dmesg.html
+++ b/www/api-docs/admin_dmesg.html
@@ -72,7 +72,8 @@
<h3>Description:</h3>
-<p>Policy for dmesg.</p>
+<p><p>Policy for dmesg.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/admin_logrotate.html b/www/api-docs/admin_logrotate.html
index d05e732..4554745 100644
--- a/www/api-docs/admin_logrotate.html
+++ b/www/api-docs/admin_logrotate.html
@@ -72,7 +72,8 @@
<h3>Description:</h3>
-<p>Rotate and archive system logs</p>
+<p><p>Rotate and archive system logs</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/admin_netutils.html b/www/api-docs/admin_netutils.html
index 7beb0fd..5c42b38 100644
--- a/www/api-docs/admin_netutils.html
+++ b/www/api-docs/admin_netutils.html
@@ -72,7 +72,8 @@
<h3>Description:</h3>
-<p>Network analysis utilities</p>
+<p><p>Network analysis utilities</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/admin_rpm.html b/www/api-docs/admin_rpm.html
index ed15c7c..285109b 100644
--- a/www/api-docs/admin_rpm.html
+++ b/www/api-docs/admin_rpm.html
@@ -72,7 +72,8 @@
<h3>Description:</h3>
-<p>Policy for the RPM package manager.</p>
+<p><p>Policy for the RPM package manager.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/admin_usermanage.html b/www/api-docs/admin_usermanage.html
index 6453b11..a2b5a9a 100644
--- a/www/api-docs/admin_usermanage.html
+++ b/www/api-docs/admin_usermanage.html
@@ -72,7 +72,8 @@
<h3>Description:</h3>
-<p>Policy for managing user accounts.</p>
+<p><p>Policy for managing user accounts.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/apps_gpg.html b/www/api-docs/apps_gpg.html
index c354b75..47cd6fc 100644
--- a/www/api-docs/apps_gpg.html
+++ b/www/api-docs/apps_gpg.html
@@ -55,7 +55,8 @@
<h3>Description:</h3>
-<p>Policy for GNU Privacy Guard and related programs.</p>
+<p><p>Policy for GNU Privacy Guard and related programs.</p></p>
+
diff --git a/www/api-docs/index.html b/www/api-docs/index.html
index 60256bc..76f05aa 100644
--- a/www/api-docs/index.html
+++ b/www/api-docs/index.html
@@ -169,6 +169,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -275,8 +278,7 @@ Device nodes and interfaces for many basic system devices.
<a href='kernel_kernel.html'>
kernel</a></td>
<td><p>
-Policy for kernel threads, proc filesystem,
-and unlabeled processes and objects.
+Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
</p></td>
<tr><td>
@@ -467,6 +469,11 @@ connection and disconnection of devices at runtime.
<td><p>Policy for udev.</p></td>
<tr><td>
+ <a href='system_unconfined.html'>
+ unconfined</a></td>
+ <td><p>The unconfined domain.</p></td>
+
+ <tr><td>
<a href='system_userdomain.html'>
userdomain</a></td>
<td><p>Policy for user domains</p></td>
diff --git a/www/api-docs/interfaces.html b/www/api-docs/interfaces.html
index aee2de3..38cd537 100644
--- a/www/api-docs/interfaces.html
+++ b/www/api-docs/interfaces.html
@@ -169,6 +169,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -11105,6 +11108,32 @@ Layer: <a href='kernel.html'>
kernel</a><p/>
<div id="codeblock">
+<b>corenet_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to network objects.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='kernel_corenetwork.html'>
+corenetwork</a><p/>
+Layer: <a href='kernel.html'>
+kernel</a><p/>
+<div id="codeblock">
+
<b>corenet_use_tun_tap_device</b>(
@@ -13744,6 +13773,32 @@ Layer: <a href='kernel.html'>
kernel</a><p/>
<div id="codeblock">
+<b>dev_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to devices.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='kernel_devices.html'>
+devices</a><p/>
+Layer: <a href='kernel.html'>
+kernel</a><p/>
+<div id="codeblock">
+
<b>dev_write_framebuffer</b>(
@@ -14582,6 +14637,32 @@ Layer: <a href='system.html'>
system</a><p/>
<div id="codeblock">
+<b>domain_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to domains.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_domain.html'>
+domain</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
<b>domain_use_wide_inherit_fd</b>(
@@ -14686,6 +14767,40 @@ Layer: <a href='system.html'>
system</a><p/>
<div id="codeblock">
+<b>files_create_home_dirs</b>(
+
+
+
+
+ domain
+
+
+
+ ,
+
+
+
+ home_type
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Create home directories
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_files.html'>
+files</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
<b>files_create_lock</b>(
@@ -16613,6 +16728,32 @@ Layer: <a href='system.html'>
system</a><p/>
<div id="codeblock">
+<b>files_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to files.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_files.html'>
+files</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
<b>files_unmount_all_file_type_fs</b>(
@@ -18204,6 +18345,32 @@ Layer: <a href='kernel.html'>
kernel</a><p/>
<div id="codeblock">
+<b>fs_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to filesystems
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='kernel_filesystem.html'>
+filesystem</a><p/>
+Layer: <a href='kernel.html'>
+kernel</a><p/>
+<div id="codeblock">
+
<b>fs_unmount_all_fs</b>(
@@ -19007,7 +19174,15 @@ system</a><p/>
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -19015,7 +19190,8 @@ system</a><p/>
<div id="description">
<p>
-Summary is missing!
+Create a domain for long running processes
+(daemons) which can be started by init scripts.
</p>
</div>
@@ -19033,7 +19209,15 @@ system</a><p/>
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -19041,7 +19225,7 @@ system</a><p/>
<div id="description">
<p>
-Summary is missing!
+Create a domain which can be started by init.
</p>
</div>
@@ -19444,6 +19628,42 @@ Layer: <a href='system.html'>
system</a><p/>
<div id="codeblock">
+<b>init_run_daemon</b>(
+
+
+
+
+ domain
+
+
+
+ ,
+
+
+
+ role
+
+
+
+ ,
+
+
+
+ terminal
+
+
+ )<br>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_init.html'>
+init</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
<b>init_rw_script_pid</b>(
@@ -19553,7 +19773,15 @@ system</a><p/>
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -19561,7 +19789,8 @@ system</a><p/>
<div id="description">
<p>
-Summary is missing!
+Create a domain for short running processes
+which can be started by init scripts.
</p>
</div>
@@ -20876,6 +21105,32 @@ Layer: <a href='kernel.html'>
kernel</a><p/>
<div id="codeblock">
+<b>kernel_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to the kernel.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='kernel_kernel.html'>
+kernel</a><p/>
+Layer: <a href='kernel.html'>
+kernel</a><p/>
+<div id="codeblock">
+
<b>kernel_use_fd</b>(
@@ -22553,7 +22808,15 @@ services</a><p/>
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -22561,7 +22824,8 @@ services</a><p/>
<div id="description">
<p>
-Summary is missing!
+Modified mailserver interface for
+sendmail daemon use.
</p>
</div>
@@ -23341,7 +23605,7 @@ Layer: <a href='kernel.html'>
kernel</a><p/>
<div id="codeblock">
-<b>selinux_validate_context</b>(
+<b>selinux_unconfined</b>(
@@ -23355,10 +23619,30 @@ kernel</a><p/>
</div>
<div id="interfacesmall">
-Module: <a href='services_sendmail.html'>
-sendmail</a><p/>
-Layer: <a href='services.html'>
-services</a><p/>
+Module: <a href='kernel_selinux.html'>
+selinux</a><p/>
+Layer: <a href='kernel.html'>
+kernel</a><p/>
+<div id="codeblock">
+
+<b>selinux_validate_context</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='services_sendmail.html'>
+sendmail</a><p/>
+Layer: <a href='services.html'>
+services</a><p/>
<div id="codeblock">
<b>sendmail_domtrans</b>(
@@ -24260,6 +24544,12 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Create block devices in /dev with the fixed disk type.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24280,6 +24570,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Do not audit attempts made by the caller to get
+the attributes of fixed disk device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24300,6 +24597,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Do not audit attempts made by the caller to get
+the attributes of removable devices device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24320,6 +24624,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Do not audit attempts made by the caller to set
+the attributes of fixed disk device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24340,6 +24651,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Do not audit attempts made by the caller to set
+the attributes of removable devices device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24360,6 +24678,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to get the attributes of fixed disk
+device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24380,6 +24705,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to get the attributes of removable
+devices device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24400,6 +24732,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to get the attributes of
+the generic SCSI interface device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24420,6 +24759,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Get attributes of the device nodes
+for the SCSI generic inerface.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24440,6 +24786,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to get the attributes
+of device nodes of tape devices.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24486,6 +24839,15 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read from a fixed disk.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24506,6 +24868,15 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read from a logical volume.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24526,6 +24897,16 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read from
+a removable device.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24546,6 +24927,15 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly write to a fixed disk.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24566,6 +24956,15 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read from a logical volume.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24586,6 +24985,16 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly write to
+a removable device.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24606,6 +25015,16 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read, in a
+generic fashion, from any SCSI device.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24626,6 +25045,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read
+a tape device.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24672,6 +25098,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Set attributes of the device nodes
+for the SCSI generic inerface.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24692,6 +25125,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to set the attributes of fixed disk
+device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24712,6 +25152,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to set the attributes of removable
+devices device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24732,6 +25179,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to set the attributes of
+the generic SCSI interface device nodes.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24752,6 +25206,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to set the attributes
+of device nodes of tape devices.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24787,6 +25248,32 @@ Layer: <a href='kernel.html'>
kernel</a><p/>
<div id="codeblock">
+<b>storage_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to storage devices.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='kernel_storage.html'>
+storage</a><p/>
+Layer: <a href='kernel.html'>
+kernel</a><p/>
+<div id="codeblock">
+
<b>storage_write_scsi_generic</b>(
@@ -24798,6 +25285,16 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly write, in a
+generic fashion, from any SCSI device.
+This is extremly dangerous as it can bypass the
+SELinux protections for filesystem objects, and
+should only be used by trusted domains.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -24818,6 +25315,13 @@ kernel</a><p/>
)<br>
</div>
+<div id="description">
+<p>
+Allow the caller to directly read
+a tape device.
+</p>
+</div>
+
</div>
<div id="interfacesmall">
@@ -25887,6 +26391,136 @@ system</a><p/>
</div>
<div id="interfacesmall">
+Module: <a href='system_unconfined.html'>
+unconfined</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
+<b>unconfined_domtrans_shell</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Transition to the unconfined domain by executing a shell.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_unconfined.html'>
+unconfined</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
+<b>unconfined_role</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Add the unconfined domain to the specified role.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_unconfined.html'>
+unconfined</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
+<b>unconfined_rw_pipe</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Read and write unconfined domain unnamed pipes.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_unconfined.html'>
+unconfined</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
+<b>unconfined_sigchld</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Send a SIGCHLD signal to the unconfined domain.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_unconfined.html'>
+unconfined</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
+<b>unconfined_use_fd</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Inherit file descriptors from the unconfined domain.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
Module: <a href='system_userdomain.html'>
userdomain</a><p/>
Layer: <a href='system.html'>
@@ -26237,6 +26871,32 @@ Layer: <a href='system.html'>
system</a><p/>
<div id="codeblock">
+<b>userdom_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+Unconfined access to user domains.
+</p>
+</div>
+
+</div>
+
+<div id="interfacesmall">
+Module: <a href='system_userdomain.html'>
+userdomain</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
<b>userdom_use_all_user_fd</b>(
diff --git a/www/api-docs/kernel.html b/www/api-docs/kernel.html
index 2a28af8..bac7cf2 100644
--- a/www/api-docs/kernel.html
+++ b/www/api-docs/kernel.html
@@ -109,8 +109,7 @@ Device nodes and interfaces for many basic system devices.
<a href='kernel_kernel.html'>
kernel</a></td>
<td><p>
-Policy for kernel threads, proc filesystem,
-and unlabeled processes and objects.
+Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
</p></td>
<tr><td>
diff --git a/www/api-docs/kernel_bootloader.html b/www/api-docs/kernel_bootloader.html
index f85589c..1eb1921 100644
--- a/www/api-docs/kernel_bootloader.html
+++ b/www/api-docs/kernel_bootloader.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Policy for the kernel modules, kernel image, and bootloader.</p>
+<p><p>Policy for the kernel modules, kernel image, and bootloader.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/kernel_corenetwork.html b/www/api-docs/kernel_corenetwork.html
index aac2e08..94444ca 100644
--- a/www/api-docs/kernel_corenetwork.html
+++ b/www/api-docs/kernel_corenetwork.html
@@ -78,7 +78,10 @@
<h3>Description:</h3>
-<p>Policy controlling access to network objects</p>
+<p><p>Policy controlling access to network objects</p></p>
+
+
+<p>This module is required to be included in all policies.</p>
<a name="interfaces"></a>
@@ -18293,6 +18296,47 @@ No
<div id="codeblock">
+<b>corenet_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to network objects.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+The domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>corenet_use_tun_tap_device</b>(
diff --git a/www/api-docs/kernel_devices.html b/www/api-docs/kernel_devices.html
index c899619..120e3ba 100644
--- a/www/api-docs/kernel_devices.html
+++ b/www/api-docs/kernel_devices.html
@@ -78,7 +78,7 @@
<h3>Description:</h3>
-<p>
+<p><p>
</p><p>
This module creates the device node concept and provides
the policy for many of the device files. Notable exceptions are
@@ -94,7 +94,8 @@ are used to label device nodes should use the dev_node macro.
Additionally, this module controls access to three things:
</p><ul><li>the device directories containing device nodes</li><li>device nodes as a group</li><li>individual access to specific device nodes covered by
this module.</li></ul><p>
-</p>
+</p></p>
+
<a name="interfaces"></a>
@@ -4051,6 +4052,47 @@ No
<div id="codeblock">
+<b>dev_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to devices.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>dev_write_framebuffer</b>(
diff --git a/www/api-docs/kernel_filesystem.html b/www/api-docs/kernel_filesystem.html
index f9f1667..a443856 100644
--- a/www/api-docs/kernel_filesystem.html
+++ b/www/api-docs/kernel_filesystem.html
@@ -78,7 +78,10 @@
<h3>Description:</h3>
-<p>Policy for filesystems.</p>
+<p><p>Policy for filesystems.</p></p>
+
+
+<p>This module is required to be included in all policies.</p>
<a name="interfaces"></a>
@@ -3290,6 +3293,47 @@ No
<div id="codeblock">
+<b>fs_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to filesystems
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>fs_unmount_all_fs</b>(
diff --git a/www/api-docs/kernel_kernel.html b/www/api-docs/kernel_kernel.html
index cb23abc..f2594a2 100644
--- a/www/api-docs/kernel_kernel.html
+++ b/www/api-docs/kernel_kernel.html
@@ -78,10 +78,12 @@
<h3>Description:</h3>
-<p>
-Policy for kernel threads, proc filesystem,
-and unlabeled processes and objects.
-</p>
+<p><p>
+Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
+</p></p>
+
+
+<p>This module is required to be included in all policies.</p>
<a name="interfaces"></a>
@@ -2153,6 +2155,47 @@ No
<div id="codeblock">
+<b>kernel_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to the kernel.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>kernel_use_fd</b>(
diff --git a/www/api-docs/kernel_selinux.html b/www/api-docs/kernel_selinux.html
index 4d7cd7a..b691441 100644
--- a/www/api-docs/kernel_selinux.html
+++ b/www/api-docs/kernel_selinux.html
@@ -78,9 +78,12 @@
<h3>Description:</h3>
-<p>
+<p><p>
Policy for kernel security interface, in particular, selinuxfs.
-</p>
+</p></p>
+
+
+<p>This module is required to be included in all policies.</p>
<a name="interfaces"></a>
@@ -526,6 +529,47 @@ No
<div id="codeblock">
+<b>selinux_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+
+<h5>Description</h5>
+<p>
+Unconfined access to the SELinux security server.
+</p>
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>selinux_validate_context</b>(
diff --git a/www/api-docs/kernel_storage.html b/www/api-docs/kernel_storage.html
index 1ec3c66..61332b5 100644
--- a/www/api-docs/kernel_storage.html
+++ b/www/api-docs/kernel_storage.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Policy controlling access to storage devices</p>
+<p><p>Policy controlling access to storage devices</p></p>
+
<a name="interfaces"></a>
@@ -101,12 +102,12 @@
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Create block devices in /dev with the fixed disk type.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -142,13 +143,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Do not audit attempts made by the caller to get
the attributes of fixed disk device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -184,13 +185,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Do not audit attempts made by the caller to get
the attributes of removable devices device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -226,13 +227,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Do not audit attempts made by the caller to set
the attributes of fixed disk device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -268,13 +269,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Do not audit attempts made by the caller to set
the attributes of removable devices device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -310,13 +311,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to get the attributes of fixed disk
device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -352,13 +353,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to get the attributes of removable
devices device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -394,13 +395,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to get the attributes of
the generic SCSI interface device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -436,13 +437,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Get attributes of the device nodes
for the SCSI generic inerface.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -478,13 +479,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to get the attributes
of device nodes of tape devices.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -561,8 +562,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read from a fixed disk.
This is extremly dangerous as it can bypass the
@@ -570,6 +570,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -605,8 +606,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read from a logical volume.
This is extremly dangerous as it can bypass the
@@ -614,6 +614,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -649,8 +650,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read from
a removable device.
@@ -659,6 +659,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -694,8 +695,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly write to a fixed disk.
This is extremly dangerous as it can bypass the
@@ -703,6 +703,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -738,8 +739,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read from a logical volume.
This is extremly dangerous as it can bypass the
@@ -747,6 +747,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -782,8 +783,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly write to
a removable device.
@@ -792,6 +792,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -827,8 +828,7 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read, in a
generic fashion, from any SCSI device.
@@ -837,6 +837,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -872,13 +873,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read
a tape device.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -955,13 +956,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Set attributes of the device nodes
for the SCSI generic inerface.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -997,13 +998,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to set the attributes of fixed disk
device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -1039,13 +1040,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to set the attributes of removable
devices device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -1081,13 +1082,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to set the attributes of
the generic SCSI interface device nodes.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -1123,13 +1124,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to set the attributes
of device nodes of tape devices.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -1194,7 +1195,7 @@ No
<div id="codeblock">
-<b>storage_write_scsi_generic</b>(
+<b>storage_unconfined</b>(
@@ -1206,8 +1207,48 @@ No
</div>
<div id="description">
+<h5>Summary</h5>
+<p>
+Unconfined access to storage devices.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
-<h5>Description</h5>
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
+<b>storage_write_scsi_generic</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
<p>
Allow the caller to directly write, in a
generic fashion, from any SCSI device.
@@ -1216,6 +1257,7 @@ SELinux protections for filesystem objects, and
should only be used by trusted domains.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
@@ -1251,13 +1293,13 @@ No
</div>
<div id="description">
-
-<h5>Description</h5>
+<h5>Summary</h5>
<p>
Allow the caller to directly read
a tape device.
</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
diff --git a/www/api-docs/kernel_terminal.html b/www/api-docs/kernel_terminal.html
index 4547c70..86b7485 100644
--- a/www/api-docs/kernel_terminal.html
+++ b/www/api-docs/kernel_terminal.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Policy for terminals.</p>
+<p><p>Policy for terminals.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_cron.html b/www/api-docs/services_cron.html
index a940957..7b6981b 100644
--- a/www/api-docs/services_cron.html
+++ b/www/api-docs/services_cron.html
@@ -81,7 +81,8 @@
<h3>Description:</h3>
-<p>Periodic execution of scheduled commands.</p>
+<p><p>Periodic execution of scheduled commands.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_inetd.html b/www/api-docs/services_inetd.html
index 74c94b2..1e0009c 100644
--- a/www/api-docs/services_inetd.html
+++ b/www/api-docs/services_inetd.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Internet services daemon.</p>
+<p><p>Internet services daemon.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_kerberos.html b/www/api-docs/services_kerberos.html
index d25efc4..f6f5724 100644
--- a/www/api-docs/services_kerberos.html
+++ b/www/api-docs/services_kerberos.html
@@ -78,7 +78,7 @@
<h3>Description:</h3>
-<p>
+<p><p>
</p><p>
This policy supports:
</p><p>
@@ -88,7 +88,8 @@ Servers:
</p><p>
Clients:
</p><ul><li>kinit</li><li>kdestroy</li><li>klist</li><li>ksu (incomplete)</li></ul><p>
-</p>
+</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_mta.html b/www/api-docs/services_mta.html
index 949e72d..036a1fc 100644
--- a/www/api-docs/services_mta.html
+++ b/www/api-docs/services_mta.html
@@ -81,7 +81,8 @@
<h3>Description:</h3>
-<p>Policy common to all email tranfer agents.</p>
+<p><p>Policy common to all email tranfer agents.</p></p>
+
<a name="interfaces"></a>
@@ -466,7 +467,15 @@ No
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -475,19 +484,46 @@ No
<h5>Summary</h5>
<p>
-Summary is missing!
+Modified mailserver interface for
+sendmail daemon use.
</p>
+<h5>Description</h5>
+<p>
+</p><p>
+A modified MTA mail server interface for
+the sendmail program. It's design does
+not fit well with policy, and using the
+regular interface causes a type_transition
+conflict if direct running of init scripts
+is enabled.
+</p><p>
+</p><p>
+This interface should most likely only be used
+by the sendmail policy.
+</p><p>
+</p>
+
<h5>Parameters</h5>
<table border="1" cellspacing="0" cellpadding="3" width="80%">
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
<tr><td>
-?
+domain
</td><td>
-Parameter descriptions are missing!
+The type to be used for the mail server.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+entry_point
+</td><td>
+
+The type to be used for the domain entry point program.
</td><td>
No
diff --git a/www/api-docs/services_nis.html b/www/api-docs/services_nis.html
index 5997c42..9670fc7 100644
--- a/www/api-docs/services_nis.html
+++ b/www/api-docs/services_nis.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Policy for NIS (YP) servers and clients</p>
+<p><p>Policy for NIS (YP) servers and clients</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_remotelogin.html b/www/api-docs/services_remotelogin.html
index 8bd22ed..70a0b7b 100644
--- a/www/api-docs/services_remotelogin.html
+++ b/www/api-docs/services_remotelogin.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Policy for rshd, rlogind, and telnetd.</p>
+<p><p>Policy for rshd, rlogind, and telnetd.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_sendmail.html b/www/api-docs/services_sendmail.html
index a8561ad..1dd53f4 100644
--- a/www/api-docs/services_sendmail.html
+++ b/www/api-docs/services_sendmail.html
@@ -78,7 +78,8 @@
<h3>Description:</h3>
-<p>Policy for sendmail.</p>
+<p><p>Policy for sendmail.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/services_ssh.html b/www/api-docs/services_ssh.html
index 2eadd26..46a0a11 100644
--- a/www/api-docs/services_ssh.html
+++ b/www/api-docs/services_ssh.html
@@ -81,7 +81,8 @@
<h3>Description:</h3>
-<p>Secure shell client and server policy.</p>
+<p><p>Secure shell client and server policy.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system.html b/www/api-docs/system.html
index 3002695..267d377 100644
--- a/www/api-docs/system.html
+++ b/www/api-docs/system.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -245,6 +248,11 @@ connection and disconnection of devices at runtime.
<td><p>Policy for udev.</p></td>
<tr><td>
+ <a href='system_unconfined.html'>
+ unconfined</a></td>
+ <td><p>The unconfined domain.</p></td>
+
+ <tr><td>
<a href='system_userdomain.html'>
userdomain</a></td>
<td><p>Policy for user domains</p></td>
diff --git a/www/api-docs/system_authlogin.html b/www/api-docs/system_authlogin.html
index bcd8a82..89a2f0c 100644
--- a/www/api-docs/system_authlogin.html
+++ b/www/api-docs/system_authlogin.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -123,7 +126,8 @@
<h3>Description:</h3>
-<p>Common policy for authentication and user login.</p>
+<p><p>Common policy for authentication and user login.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_clock.html b/www/api-docs/system_clock.html
index 3301e7c..fba0684 100644
--- a/www/api-docs/system_clock.html
+++ b/www/api-docs/system_clock.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for reading and setting the hardware clock.</p>
+<p><p>Policy for reading and setting the hardware clock.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_corecommands.html b/www/api-docs/system_corecommands.html
index 7d065e9..cb66c7f 100644
--- a/www/api-docs/system_corecommands.html
+++ b/www/api-docs/system_corecommands.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,10 +123,11 @@
<h3>Description:</h3>
-<p>
+<p><p>
Core policy for shells, and generic programs
in /bin, /sbin, /usr/bin, and /usr/sbin.
-</p>
+</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_domain.html b/www/api-docs/system_domain.html
index f02e5b7..7ab8532 100644
--- a/www/api-docs/system_domain.html
+++ b/www/api-docs/system_domain.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -123,7 +126,10 @@
<h3>Description:</h3>
-<p>Core policy for domains.</p>
+<p><p>Core policy for domains.</p></p>
+
+
+<p>This module is required to be included in all policies.</p>
<a name="interfaces"></a>
@@ -1127,6 +1133,47 @@ No
<div id="codeblock">
+<b>domain_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to domains.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+The type of the process performing this action.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>domain_use_wide_inherit_fd</b>(
diff --git a/www/api-docs/system_files.html b/www/api-docs/system_files.html
index cdfd1f7..b2b23a6 100644
--- a/www/api-docs/system_files.html
+++ b/www/api-docs/system_files.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,14 +123,17 @@
<h3>Description:</h3>
-<p>
+<p><p>
</p><p>
This module contains basic filesystem types and interfaces. This
includes:
</p><ul><li>The concept of different file types including basic
files, mount points, tmp files, etc.</li><li>Access to groups of files and all files.</li><li>Types and interfaces for the basic filesystem layout
(/, /etc, /tmp, /usr, etc.).</li></ul><p>
-</p>
+</p></p>
+
+
+<p>This module is required to be included in all policies.</p>
<a name="interfaces"></a>
@@ -220,6 +226,65 @@ No
<div id="codeblock">
+<b>files_create_home_dirs</b>(
+
+
+
+
+ domain
+
+
+
+ ,
+
+
+
+ home_type
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Create home directories
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+The type of the process performing this action.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+home_type
+</td><td>
+
+The type of the home directory
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>files_create_lock</b>(
@@ -3361,6 +3426,47 @@ No
<div id="codeblock">
+<b>files_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to files.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>files_unmount_all_file_type_fs</b>(
diff --git a/www/api-docs/system_fstools.html b/www/api-docs/system_fstools.html
index 6475699..bf68ba9 100644
--- a/www/api-docs/system_fstools.html
+++ b/www/api-docs/system_fstools.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Tools for filesystem management, such as mkfs and fsck.</p>
+<p><p>Tools for filesystem management, such as mkfs and fsck.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_getty.html b/www/api-docs/system_getty.html
index eb97234..810af4d 100644
--- a/www/api-docs/system_getty.html
+++ b/www/api-docs/system_getty.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for getty.</p>
+<p><p>Policy for getty.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_hostname.html b/www/api-docs/system_hostname.html
index a45d686..93e46aa 100644
--- a/www/api-docs/system_hostname.html
+++ b/www/api-docs/system_hostname.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for changing the system host name.</p>
+<p><p>Policy for changing the system host name.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_hotplug.html b/www/api-docs/system_hotplug.html
index c517d4b..519b4a9 100644
--- a/www/api-docs/system_hotplug.html
+++ b/www/api-docs/system_hotplug.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,10 +123,11 @@
<h3>Description:</h3>
-<p>
+<p><p>
Policy for hotplug system, for supporting the
connection and disconnection of devices at runtime.
-</p>
+</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_init.html b/www/api-docs/system_init.html
index 6c086fc..265a959 100644
--- a/www/api-docs/system_init.html
+++ b/www/api-docs/system_init.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>System initialization programs (init and init scripts).</p>
+<p><p>System initialization programs (init and init scripts).</p></p>
+
<a name="interfaces"></a>
@@ -136,7 +140,15 @@
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -145,7 +157,8 @@
<h5>Summary</h5>
<p>
-Summary is missing!
+Create a domain for long running processes
+(daemons) which can be started by init scripts.
</p>
@@ -154,10 +167,20 @@ Summary is missing!
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
<tr><td>
-?
+domain
</td><td>
-Parameter descriptions are missing!
+Type to be used as a domain.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+entry_point
+</td><td>
+
+Type of the program to be used as an entry point to this domain.
</td><td>
No
@@ -177,7 +200,15 @@ No
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -186,7 +217,7 @@ No
<h5>Summary</h5>
<p>
-Summary is missing!
+Create a domain which can be started by init.
</p>
@@ -195,10 +226,20 @@ Summary is missing!
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
<tr><td>
-?
+domain
</td><td>
-Parameter descriptions are missing!
+Type to be used as a domain.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+entry_point
+</td><td>
+
+Type of the program to be used as an entry point to this domain.
</td><td>
No
@@ -828,6 +869,83 @@ No
<div id="codeblock">
+<b>init_run_daemon</b>(
+
+
+
+
+ domain
+
+
+
+ ,
+
+
+
+ role
+
+
+
+ ,
+
+
+
+ terminal
+
+
+ )<br>
+</div>
+<div id="description">
+
+
+<h5>Description</h5>
+<p>
+Start and stop daemon programs directly.
+</p>
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+The type of the process performing this action.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+role
+</td><td>
+
+The role to be performing this action.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+terminal
+</td><td>
+
+The type of the terminal of the user.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>init_rw_script_pid</b>(
@@ -997,7 +1115,15 @@ No
- ?
+ domain
+
+
+
+ ,
+
+
+
+ entry_point
)<br>
@@ -1006,7 +1132,8 @@ No
<h5>Summary</h5>
<p>
-Summary is missing!
+Create a domain for short running processes
+which can be started by init scripts.
</p>
@@ -1015,10 +1142,20 @@ Summary is missing!
<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
<tr><td>
-?
+domain
</td><td>
-Parameter descriptions are missing!
+Type to be used as a domain.
+
+</td><td>
+No
+</td></tr>
+
+<tr><td>
+entry_point
+</td><td>
+
+Type of the program to be used as an entry point to this domain.
</td><td>
No
diff --git a/www/api-docs/system_iptables.html b/www/api-docs/system_iptables.html
index d0cff12..c57dd88 100644
--- a/www/api-docs/system_iptables.html
+++ b/www/api-docs/system_iptables.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for iptables.</p>
+<p><p>Policy for iptables.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_libraries.html b/www/api-docs/system_libraries.html
index 73686d5..ff2c5b3 100644
--- a/www/api-docs/system_libraries.html
+++ b/www/api-docs/system_libraries.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for system libraries.</p>
+<p><p>Policy for system libraries.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_locallogin.html b/www/api-docs/system_locallogin.html
index 248f982..34495f7 100644
--- a/www/api-docs/system_locallogin.html
+++ b/www/api-docs/system_locallogin.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for local logins.</p>
+<p><p>Policy for local logins.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_logging.html b/www/api-docs/system_logging.html
index 4554b10..bc1079e 100644
--- a/www/api-docs/system_logging.html
+++ b/www/api-docs/system_logging.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for the kernel message logger and system logging daemon.</p>
+<p><p>Policy for the kernel message logger and system logging daemon.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_lvm.html b/www/api-docs/system_lvm.html
index 0da71a8..ce57f08 100644
--- a/www/api-docs/system_lvm.html
+++ b/www/api-docs/system_lvm.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for logical volume management programs.</p>
+<p><p>Policy for logical volume management programs.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_miscfiles.html b/www/api-docs/system_miscfiles.html
index be5525b..1bf647e 100644
--- a/www/api-docs/system_miscfiles.html
+++ b/www/api-docs/system_miscfiles.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Miscelaneous files.</p>
+<p><p>Miscelaneous files.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_modutils.html b/www/api-docs/system_modutils.html
index 3684975..fdbb731 100644
--- a/www/api-docs/system_modutils.html
+++ b/www/api-docs/system_modutils.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for kernel module utilities</p>
+<p><p>Policy for kernel module utilities</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_mount.html b/www/api-docs/system_mount.html
index 7f61be8..48b6164 100644
--- a/www/api-docs/system_mount.html
+++ b/www/api-docs/system_mount.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for mount.</p>
+<p><p>Policy for mount.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_selinuxutil.html b/www/api-docs/system_selinuxutil.html
index ad54f25..6ed7287 100644
--- a/www/api-docs/system_selinuxutil.html
+++ b/www/api-docs/system_selinuxutil.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for SELinux policy and userland applications.</p>
+<p><p>Policy for SELinux policy and userland applications.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_sysnetwork.html b/www/api-docs/system_sysnetwork.html
index 7fcfd26..3dca320 100644
--- a/www/api-docs/system_sysnetwork.html
+++ b/www/api-docs/system_sysnetwork.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for network configuration: ifconfig and dhcp client.</p>
+<p><p>Policy for network configuration: ifconfig and dhcp client.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_udev.html b/www/api-docs/system_udev.html
index d25f12e..d6d9caa 100644
--- a/www/api-docs/system_udev.html
+++ b/www/api-docs/system_udev.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -120,7 +123,8 @@
<h3>Description:</h3>
-<p>Policy for udev.</p>
+<p><p>Policy for udev.</p></p>
+
<a name="interfaces"></a>
diff --git a/www/api-docs/system_unconfined.html b/www/api-docs/system_unconfined.html
new file mode 100644
index 0000000..a57bce1
--- /dev/null
+++ b/www/api-docs/system_unconfined.html
@@ -0,0 +1,395 @@
+<html>
+<head>
+<title>
+ Security Enhanced Linux Reference Policy
+ </title>
+<style type="text/css" media="all">@import "style.css";</style>
+</head>
+<body>
+<div id="Header">Security Enhanced Linux Reference Policy</div>
+<div id='Menu'>
+
+ <a href="admin.html">+
+ admin</a></br/>
+ <div id='subitem'>
+
+ </div>
+
+ <a href="apps.html">+
+ apps</a></br/>
+ <div id='subitem'>
+
+ </div>
+
+ <a href="kernel.html">+
+ kernel</a></br/>
+ <div id='subitem'>
+
+ </div>
+
+ <a href="services.html">+
+ services</a></br/>
+ <div id='subitem'>
+
+ </div>
+
+ <a href="system.html">+
+ system</a></br/>
+ <div id='subitem'>
+
+ - <a href='system_authlogin.html'>
+ authlogin</a><br/>
+
+ - <a href='system_clock.html'>
+ clock</a><br/>
+
+ - <a href='system_corecommands.html'>
+ corecommands</a><br/>
+
+ - <a href='system_domain.html'>
+ domain</a><br/>
+
+ - <a href='system_files.html'>
+ files</a><br/>
+
+ - <a href='system_fstools.html'>
+ fstools</a><br/>
+
+ - <a href='system_getty.html'>
+ getty</a><br/>
+
+ - <a href='system_hostname.html'>
+ hostname</a><br/>
+
+ - <a href='system_hotplug.html'>
+ hotplug</a><br/>
+
+ - <a href='system_init.html'>
+ init</a><br/>
+
+ - <a href='system_iptables.html'>
+ iptables</a><br/>
+
+ - <a href='system_libraries.html'>
+ libraries</a><br/>
+
+ - <a href='system_locallogin.html'>
+ locallogin</a><br/>
+
+ - <a href='system_logging.html'>
+ logging</a><br/>
+
+ - <a href='system_lvm.html'>
+ lvm</a><br/>
+
+ - <a href='system_miscfiles.html'>
+ miscfiles</a><br/>
+
+ - <a href='system_modutils.html'>
+ modutils</a><br/>
+
+ - <a href='system_mount.html'>
+ mount</a><br/>
+
+ - <a href='system_selinuxutil.html'>
+ selinuxutil</a><br/>
+
+ - <a href='system_sysnetwork.html'>
+ sysnetwork</a><br/>
+
+ - <a href='system_udev.html'>
+ udev</a><br/>
+
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
+ - <a href='system_userdomain.html'>
+ userdomain</a><br/>
+
+ </div>
+
+ <br/><p/>
+ <a href="interfaces.html">* Interface Index</a>
+ <br/><p/>
+ <a href="templates.html">* Template Index</a>
+</div>
+
+<div id="Content">
+<a name="top":></a>
+<h1>Layer: system</h1><p/>
+<h2>Module: unconfined</h2><p/>
+
+
+<a href=#interfaces>Interfaces</a>
+<a href=#templates>Templates</a>
+
+
+<h3>Description:</h3>
+
+<p><p>The unconfined domain.</p></p>
+
+
+
+<a name="interfaces"></a>
+<h3>Interfaces: </h3>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
+<b>unconfined_domtrans_shell</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Transition to the unconfined domain by executing a shell.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
+<b>unconfined_role</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Add the unconfined domain to the specified role.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
+<b>unconfined_rw_pipe</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Read and write unconfined domain unnamed pipes.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
+<b>unconfined_sigchld</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Send a SIGCHLD signal to the unconfined domain.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
+<b>unconfined_use_fd</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Inherit file descriptors from the unconfined domain.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+
+<a href=#top>Return</a>
+
+
+<a name="templates"></a>
+<h3>Templates: </h3>
+
+<div id="template">
+
+
+<div id="codeblock">
+
+<b>unconfined_domain_template</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+A template to make the specified domain unconfined.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain to make unconfined.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+
+<a href=#top>Return</a>
+
+
+</div>
+</body>
+</html>
diff --git a/www/api-docs/system_userdomain.html b/www/api-docs/system_userdomain.html
index e428af7..0d4c3b9 100644
--- a/www/api-docs/system_userdomain.html
+++ b/www/api-docs/system_userdomain.html
@@ -100,6 +100,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -123,7 +126,8 @@
<h3>Description:</h3>
-<p>Policy for user domains</p>
+<p><p>Policy for user domains</p></p>
+
<a name="interfaces"></a>
@@ -673,6 +677,47 @@ No
<div id="codeblock">
+<b>userdom_unconfined</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+<div id="description">
+
+<h5>Summary</h5>
+<p>
+Unconfined access to user domains.
+</p>
+
+
+<h5>Parameters</h5>
+<table border="1" cellspacing="0" cellpadding="3" width="80%">
+<tr><th >Parameter:</td><th >Description:</td><th >Optional:</td></tr>
+
+<tr><td>
+domain
+</td><td>
+
+Domain allowed access.
+
+</td><td>
+No
+</td></tr>
+
+</table>
+</div>
+</div>
+
+<div id="interface">
+
+
+<div id="codeblock">
+
<b>userdom_use_all_user_fd</b>(
diff --git a/www/api-docs/templates.html b/www/api-docs/templates.html
index 38289ba..258b89c 100644
--- a/www/api-docs/templates.html
+++ b/www/api-docs/templates.html
@@ -169,6 +169,9 @@
- <a href='system_udev.html'>
udev</a><br/>
+ - <a href='system_unconfined.html'>
+ unconfined</a><br/>
+
- <a href='system_userdomain.html'>
userdomain</a><br/>
@@ -472,6 +475,32 @@ The template to define a ssh server.
</div>
<div id="templatesmall">
+Module: <a href='system_unconfined.html'>
+unconfined</a><p/>
+Layer: <a href='system.html'>
+system</a><p/>
+<div id="codeblock">
+
+<b>unconfined_domain_template</b>(
+
+
+
+
+ domain
+
+
+ )<br>
+</div>
+
+<div id="description">
+<p>
+A template to make the specified domain unconfined.
+</p>
+</div>
+
+</div>
+
+<div id="templatesmall">
Module: <a href='system_userdomain.html'>
userdomain</a><p/>
Layer: <a href='system.html'>
More information about the scm-commits
mailing list