Read the process state (/proc/pid) of NetworkManager.

All of the rules required to administrate an abrt environment

Append abrt cache

Send and receive messages from abrt over dbus.

Execute abrt in the abrt domain.

Execute abrt-helper in the abrt-helper domain.

Execute abrt-retrace in the abrt-retrace domain.

Dontaudit read abrt configuration file.

Do not audit attempts to write abrt sock files

Execute abrt_dump_oops in the abrt_dump_oops_t domain.

Execute abrt in the caller domain.

Transition to abrt named content

Manage abrt cache

Create, read, write, and delete abrt PID files.

Manage abrt retrace server cache

Read abrt cache

Read abrt retrace server cache

Read abrt configuration file.

Read abrt logs.

Read abrt PID files.

Read abrt retrace server cache

Allow the domain to read abrt state files in /proc.

Execute abrt helper in the abrt_helper domain, and allow the specified role the abrt_helper domain.

Read and write abrt fifo files.

Read/Write inherited abrt cache

Send a null signal to abrt.

Connect to abrt over a unix stream socket.

abrt stub interface. No access allowed.

Execute abrt server in the abrt domain.

All of the rules required to administrate an accountsd environment

Send and receive messages from accountsd over dbus.

Execute a domain transition to run accountsd.

Do not audit attempts to read and write Accounts Daemon fifo files.

Create, read, write, and delete accountsd lib files.

Read accountsd lib files.

Search accountsd lib directories.

All of the rules required to administrate an accountsd environment.

All of the rules required to administrate an acct environment.

Transition to the accounting management domain.

Dontaudit Attempts to list acct_data directory

Execute accounting management tools in the caller domain.

Execute accounting management data in the caller domain.

Create, read, write, and delete process accounting data.

Execute the ada program in the ada domain.

Execute ada in the ada domain, and allow the specified role the ada domain.

All of the rules required to administrate an afs environment.

Execute a domain transition to run the afs client.

Execute afs server in the afs domain.

Read AFS config data

Read and write afs cache files.

Read and write afs client UDP sockets.

All of the rules required to administrate an aiccu environment.

Execute a domain transition to run aiccu.

Execute aiccu server in the aiccu domain.

Read aiccu PID files.

All of the rules required to administrate an aide environment.

Execute aide in the aide domain.

Execute aide programs in the AIDE domain and allow the specified role the AIDE domain.

Execute a domain transition to run aisexec.

Read aisexec log files content.

Connect to aisexec over a unix stream socket.

All of the rules required to administrate an aisexec environment.

All of the rules required to administrate an ajaxterm environment

Execute a domain transition to run ajaxterm.

Execute ajaxterm server in the ajaxterm domain.

Read and write the ajaxterm pty type.

Execute a domain transition to run Alsa.

Transition to alsa named content

Transition to alsa named content

Create, read, write, and delete alsa home files.

Manage writable Alsa config files.

Read Alsa home files.

Read Alsa lib files.

Read writable Alsa configuration content.

Relabel alsa home files.

Execute a domain transition to run Alsa, and allow the specified role the Alsa domain.

Read and write Alsa semaphores.

Read and write Alsa shared memory.

Execute alsa server in the alsa domain.

Write Alsa lib files.

Read and append amanda log files.

Execute a domain transition to run Amanda recover.

Do not audit attempts to read /etc/dumpdates.

Search Amanda library directories.

Execute a domain transition to run Amanda recover, and allow the specified role the Amanda recover domain.

Read and write /etc/dumpdates.

Search Amanda library directories.

Search Amanda var library directories.

All of the rules required to administrate an amavis environment.

Create amavis pid files.

Execute a domain transition to run amavis.

Execute amavis server in the amavis domain.

Create, read, write, and delete amavis lib files.

Create, read, write, and delete amavis spool files.

Read amavis lib files.

Read amavis spool files.

Read and write amavis lib files.

Search amavis lib directories.

Set attributes of amavis pid files.

Create objects in the amavis spool directories with a private type.

All of the rules required to administrate an amtu environment.

Execute a domain transition to run Amtu.

Execute a domain transition to run Amtu, and allow the specified role the Amtu domain.

Execute a domain transition to run install.

Execute a domain transition to run preupgrade.

Execute preupgrade in the caller domain.

Manage preupgrade lib files

Read preupgrade lib files

Execute install in the install domain, and allow the specified role the install domain.

All of the rules required to administrate an antivirus programs environment

Allow the specified domain to append to antivirus log files.

Creates types and rules for a basic antivirus domain.

Execute a domain transition to run antivirus program.

Execute antivirus program without a transition.

Manage antivirus db content directories.

Manage antivirus pid content.

Read antivirus configuration files.

Read antivirus db content directories.

Read antivirus state files.

Read and write antivirus db content directories.

Search antivirus db content directories.

Connect to run antivirus program.

Execute antivirus server in the antivirus domain.

All of the rules required to administrate an apache environment

Allow the specified domain to append to apache log files.

Allow the specified domain to append apache squirrelmail data.

Execute CGI in the specified domain.

Send and receive messages from httpd over dbus.

Allow the specified domain to delete Apache cache dirs.

Allow the specified domain to delete Apache cache.

Allow the specified domain to delete apache system content rw files.

Transition to apache.

Execute all user scripts in the user script domain.

Execute the Apache helper program with a domain transition.

Execute a domain transition to run httpd_rotatelogs.

Execute all web scripts in the system script domain.

Do not audit attempts to append to the Apache logs.

dontaudit read and write an leaked file descriptors

dontaudit attempts to read apache log files.

Do not audit attempts to read and write Apache unnamed pipes.

Do not audit attempts to read and write Apache unix domain stream sockets.

Do not audit attempts to read and write Apache system script unix domain stream sockets.

Do not audit attempts to read and write Apache TCP sockets.

Dontaudit attempts to read and write apache tmp files.

Do not audit attempts to search Apache module directories.

Dontaudit attempts to write apache tmp files.

Allow any httpd_exec_t to be an entrypoint of this domain

Allow the specified domain to execute apache in the caller domain.

Execute a httpd_exec_t in the specified domain.

Allow the specified domain to execute apache modules.

Execute httpd_rotatelogs in the caller domain.

Allow the specified domain to execute apache suexec in the caller domain.

Execute httpd system scripts in the caller domain.

Transition to apache home content

Transition to apache named content

Allow the specified domain to list Apache cache.

Allow the specified domain to list the contents of the apache modules directory.

Allow the specified domain to list apache system content files.

Create, read, write, and delete all web content.

Create, read, write, and delete all user web content.

Allow the specified domain to manage apache configuration files.

Allow the specified domain to manage to apache var lib files.

Allow the specified domain to manage to apache log files.

Allow the specified domain to manage apache system content files.

Allow the specified domain to manage apache system content rw files.

Manage user web content.

Allow the specified domain to read apache configuration files.

Allow the specified domain to read apache log files.

Allow the specified domain to read the apache module directories.

Read apache pid files.

Allow the specified domain to read apache squirrelmail data.

Read apache system content.

Allow the specified domain to read apache system content rw dirs.

Allow the specified domain to read apache system content rw files.

Allow the specified domain to read apache tmp files.

Read user web content.

Read httpd user scripts executables.

Role access for apache

Execute all user scripts in the user script domain. Add user script domains to the specified role.

Execute the Apache helper program with a domain transition, and allow the specified role the Apache helper domain.

Allow the specified domain to read and write Apache cache files.

Allow attempts to read and write Apache unix domain stream sockets.

Allow the specified domain to search apache configuration dirs.

Search apache system content.

Search system script state directory.

Search apache system CGI directories.

Allow domain to set the attributes of the APACHE cache directory.

Send a SIGCHLD signal to apache.

Send a generic signal to apache.

Send a null signal to apache.

Execute httpd server in the httpd domain.

Inherit and use file descriptors from Apache.

Allow the specified domain to write to apache log files.

All of the rules required to administrate an apcupsd environment.

Append apcupsd log files.

Execute a domain transition to run apcupsd_cgi_script.

Execute a domain transition to run apcupsd.

Create configuration files in /var/lock with a named file type transition.

Execute apcupsd server in the apcupsd domain.

Read apcupsd log files.

Read apcupsd PID files.

Execute apcupsd server in the apcupsd domain.

All of the rules required to administrate an apm environment.

Append apmd log files.

Execute apm in the apm domain.

Execute apm in the apm domain and allow the specified role the apm domain.

Read and write to apmd unix stream sockets.

Connect to apmd over an unix stream socket.

Use apmd file descriptors.

Write apmd unnamed pipes.

Execute apmd server in the apmd domain.

Create a domain for applications.

Dontaudit execute all executable files.

Do not audit attempts to send kill signals to all application domains.

Do not audit attempts to send general signals to all application domains.

Do not audit attempts to send null signals to all application domains.

Execute application executables in the caller domain.

Execute all executable files.

Make the specified type usable for files that are exectuables, such as binary programs. This does not include shared libraries.

Make the specified type usable for files that are exectuables, such as binary programs. This does not include shared libraries.

Getattr all application sockets.

Send kill signals to all application domains.

Send general signals to all application domains.

Send null signals to all application domains.

Make the specified type usable as an application domain.

Execute apt programs in the apt domain.

Do not audit attempts to create, read, write, and delete apt package database content.

Do not audit attempts to use apt file descriptors.

Execute the apt in the caller domain.

Create, read, write, and delete apt package database content.

Read apt package cache content.

Read apt package database content.

Read apt unnamed pipes.

Execute apt programs in the apt domain.

Read and write apt unnamed pipes.

Use apt file descriptors.

Read and write apt ptys.

All of the rules required to administrate an arpwatch environment.

Do not audit attempts to read and write arpwatch packet sockets.

Execute arpwatch server in the arpwatch domain.

Create, read, write, and delete arpwatch data files.

Create, read, write, and delete arpwatch temporary files.

Read and write arpwatch temporary files.

Search arpwatch data file directories.

Execute arpwatch server in the arpwatch domain.

All of the rules required to administrate an asterisk environment.

Execute asterisk in the asterisk domain.

Execute asterisk in the caller domain.

Set attributes of asterisk log files and directories.

Set attributes of the asterisk PID content.

Connect to asterisk over a unix domain. stream socket.

Change to the audit administrator role.

Change from the audit administrator role.

Append to the login failure log.

Append only to the last logins log.

Append to login records (wtmp).

Pass shadow assertion for reading.

Create authentication cache

Manage create logins log.

Create pam var console pid directories.

Delete pam_console data.

Delete pam PID files.

Run unix_chkpwd to check a password.

Run unix_chkpwd to check a password. Stripped down version to be called within boolean

Execute a login_program in the target domain.

Execute pam timestamp programs in the pam timestamp domain.

Execute pam_console with a domain transition.

Execute pam timestamp programs in the pam timestamp domain.

Execute a domain transition to run unix_update.

Execute utempter programs in the utempter domain.

Do not audit attemps to execute utempter executable.

Do not audit attempts to get the attributes of the passwd passwords file.

Do not audit attempts to get the attributes of the shadow passwords file.

Do not audit attempts to read login records files (/var/log/wtmp).

Do not audit attemps to read PAM PID files.

Do not audit attempts to read the passwd password file (/etc/passwd).

Do not audit attempts to read the shadow password file (/etc/shadow).

Do not audit attempts to write to login records files.

Automatic transition from etc to shadow.

Execute chkpwd in the caller domain.

Execute a login_program in the caller domain.

Execute the pam program.

Make the specified type usable as a login file.

Create auth directory in the /root directory with an correct label.

Create auth directory in the user home directory with an correct label.

Transition to authlogin named content

Get the attributes of the passwd passwords file.

Get the attributes of the shadow passwords file.

List the contents of the pam_console data directory.

Create a login records in the log directory using a type transition.

Use the login program as an entry point program.

Manage the keyrings of all login programs

Make the specified domain used for a login program.

Send a SIGCHLD signal to login programs.

Manage all files on the filesystem, except login files passwords and listed exceptions.

Manage all files on the filesystem, except the shadow passwords and listed exceptions.

Manage authentication cache

Manage the login failure log.

Read the authorization data in the user home directory

Create, read, write, and delete login records files.

Create, read, write, and delete pam_console data files.

Manage pam PID files.

Create, read, write, and delete the passwd password file.

Create, read, write, and delete the shadow password file.

Manage var auth files. Used by various other applications and pam applets etc.

Create specified objects in pid directories with the pam var console pid file type using a file type transition.

Execute a login_program in the target domain, with a range transition.

Read all directories on the filesystem, except login files and listed exceptions.

Read all directories on the filesystem, except the shadow passwords and listed exceptions.

Read all files on the filesystem, except login files and listed exceptions.

Read all files on the filesystem, except the shadow passwords and listed exceptions.

Read all symbolic links on the filesystem, except login files and listed exceptions.

Read all symbolic links on the filesystem, except the shadow passwords and listed exceptions.

Read authentication cache

Read the authorization data in the user home directory

Read the last logins log.

Read login records files (/var/log/wtmp).

Read pam_console data files.

Read PAM PID files.

Read the passwd passwords file (/etc/passwd)

Read the shadow passwords file (/etc/shadow)

Read var auth files. Used by various other applications and pam applets etc.

Read access to the authlogin module.

Relabel all files on the filesystem, except login files and listed exceptions.

Relabel all files on the filesystem, except the shadow passwords and listed exceptions.

Relabel the login failure log.

Relabel login record files.

Relabel pam_console data directories.

Relabel from and to the shadow password file type.

Relabel all var auth files. Used by various other applications and pam applets etc.

Relabel to the shadow password file type.

Role access for password authentication.

Execute chkpwd programs in the chkpwd domain.

Execute pam_timestamp programs in the PAM timestamp domain.

Execute pam_timestamp programs in the PAM timestamp domain.

Execute updpwd programs in the updpwd domain.

Execute utempter programs in the utempter domain.

Read and write all files on the filesystem, except login files and listed exceptions.

Read and write all files on the filesystem, except the shadow passwords and listed exceptions.

Read/Write authentication cache

Read and write the login failure log.

Read and write to the last logins log.

Read and write login records.

Read and write the shadow password file (/etc/shadow).

Read and write var auth files. Used by various other applications and pam applets etc.

Search authentication cache

Search the contents of the pam_console data directory.

Set the attributes of login record files.

Send generic signals to chkpwd processes.

Send generic signals to pam processes.

Read the shadow password file.

Unconfined access to the authlogin module.

Use nsswitch to look up user, password, group, or host information.

Use PAM for authentication.

Automatic transition from cache_t to cache.

Write to login records (wtmp).

Write access to the authlogin module.

Execute authbind in the authbind domain.

Execute authbind in the authbind domain, and allow the specified role the authbind domain.

All of the rules required to administrate an authconfig environment

Execute TEMPLATE in the authconfig domin.

Manage authconfig lib directories.

Manage authconfig lib files.

Read authconfig lib files.

Search authconfig lib directories.

Read authlogin state files.

Read and write a authlogin unnamed pipe.

All of the rules required to administrate an automount environment.

Execute automount in the automount domain.

Do not audit attempts to get attributes of automount temporary directories.

Do not audit attempts to use automount file descriptors.

Do not audit attempts to write automount unnamed pipes.

Execute automount in the caller domain.

Read automount process state.

Allow domain to search of automount temporary directories.

Send generic signals to automount.

Execute automount server in the automount domain.

All of the rules required to administrate an avahi environment.

Create avahi pid directories.

Send and receive messages from avahi over dbus.

Execute avahi server in the avahi domain.

Do not audit attempts to search avahi pid directories.

Create specified objects in generic pid directories with the avahi pid file type.

Execute avahi init scripts in the init script domain.

Send kill signals to avahi.

Create, read, and write avahi pid files.

Set attributes of avahi pid directories.

Send generic signals to avahi.

Send null signals to avahi.

Connect to avahi using a unix stream socket.

Execute avahi server in the avahi domain.

Execute awstats cgi scripts in the caller domain. (Deprecated)

Execute the awstats program in the awstats domain.

Read and write awstats unnamed pipes. (Deprecated)

Execute backup in the backup domain.

Create, read, and write backup store files.

Execute backup in the backup domain, and allow the specified role the backup domain.

All of the rules required to administrate an bacula environment.

Execute bacula admin bacula admin domain.

Execute user interfaces in the bacula admin domain, and allow the specified role the bacula admin domain.

All of the rules required to administrate an bcfg2 environment.

Execute bcfg2 in the bcfg2 domain.

Execute bcfg2 server in the bcfg2 domain.

Create, read, write, and delete bcfg2 lib directories.

Create, read, write, and delete bcfg2 lib files.

Read bcfg2 lib files.

Search bcfg2 lib directories.

Execute bcfg2 server in the bcfg2 domain.

All of the rules required to administrate an bind environment.

Execute bind in the named domain.

Execute ndc in the ndc domain.

Execute bind server in the bind domain.

Send kill signals to bind.

Create, read, write, and delete bind cache files.

Create, read, write, and delete BIND configuration files.

Create, read, write, and delete bind configuration directories.

Create, read, write, and delete bind zone files.

Create, read, write, and delete bind zone files.

Read bind named configuration files.

Read dnssec key files.

Read BIND zone files.

Allow the domain to read bind state files in /proc.

Read bind zone files.

Execute ndc in the ndc domain, and allow the specified role the ndc domain.

Search bind cache directories.

Set attributes of bind pid directories.

Set attributes of bind zone directories.

Send generic signals to bind.

Send null signals to bind.

Execute bind server in the bind domain.

Send and receive datagrams to and from named. (Deprecated)

Write bind named configuration files.

All of the rules required to administrate an bird environment.

All of the rules required to administrate an bitlbee environment.

Read bitlbee configuration files.

All of the rules required to administrate an blkmapd environment

Execute blkmapd_exec_t in the blkmapd domain.

Execute blkmapd in the caller domain.

Execute blkmapd server in the blkmapd domain.

Read blkmapd PID files.

Send and receive messages from blueman over dbus.

Execute blueman in the blueman domain.

Create, read, write, and delete blueman lib files.

Read blueman lib files.

Search blueman lib directories.

All of the rules required to administrate an bluetooth environment.

Send and receive messages from bluetooth over dbus.

Execute bluetooth in the bluetooth domain.

Execute bluetooth_helper in the bluetooth_helper domain. (Deprecated)

dontaudit Send and receive messages from bluetooth over dbus.

Do not audit attempts to read bluetooth process state files.

Read bluetooth configuration files.

Role access for bluetooth.

Execute bluetooth_helper in the bluetooth_helper domain, and allow the specified role the bluetooth_helper domain. (Deprecated)

Connect to bluetooth over a unix domain stream socket.

Execute bluetooth server in the bluetooth domain.

All of the rules required to administrate an boinc environment.

Execute a domain transition to run boinc.

Dontaudit getattr on boinc lib files.

Execute boinc server in the boinc domain.

Create, read, write, and delete boinc lib files.

Manage boinc var_lib files.

Read boinc lib files.

Search boinc lib directories.

Execute boinc server in the boinc domain.

Read and write the bootloader temporary data in /tmp.

Execute bootloader in the bootloader domain.

Execute bootloader in the caller domain.

Type transition files created in /etc

Manage the bootloader configuration file.

Read the bootloader configuration file.

Execute bootloader interactively and do a domain transition to the bootloader domain.

Read and write the bootloader configuration file.

Read and write the bootloader temporary data in /tmp.

Execute a domain transition to run brctl.

Execute brctl in the brctl domain, and allow the specified role the brctl domain.

All of the rules required to administrate an brltty environment

Execute brltty in the brltty domin.

Execute brltty server in the brltty domain.

All of the rules required to administrate an bugzilla environment.

Do not audit attempts to read and write bugzilla script unix domain stream sockets.

Search bugzilla directories.

All of the rules required to administrate an bumblebee environment

Execute bumblebee in the bumblebee domin.

Read bumblebee PID files.

Connect to bumblebee over a unix stream socket.

Execute bumblebee server in the bumblebee domain.

Execute a domain transition to run cachefilesd.

All of the rules required to administrate an calamaris environment.

Execute the calamaris in the calamaris domain.

Read calamaris www files.

Execute calamaris in the calamaris domain, and allow the specified role the calamaris domain.

All of the rules required to administrate an callweaver environment.

Execute callweaver in the caller domain.

Connect to callweaver over a unix stream socket.

All of the rules required to administrate an canna environment.

Connect to Canna using a unix domain stream socket.

All of the rules required to administrate an ccs environment.

Execute a domain transition to run ccs.

Create, read, write, and delete cluster configuration files.

Read cluster configuration files.

Connect to ccs over an unix stream socket.

Role access for cdrecord.

All of the rules required to administrate an certmaster environment.

Append certmaster log files.

Execute a domain transition to run certmaster.

Execute certmaster in the caller domain.

Create, read, write, and delete certmaster log content.

read certmaster logs.

All of the rules required to administrate an certmonger environment.

Send and receive messages from certmonger over dbus.

Execute a domain transition to run certmonger.

Execute certmonger server in the certmonger domain.

Create, read, write, and delete certmonger lib files.

Read certmonger lib files.

Read certmonger PID files.

Search certmonger lib directories.

Execute certwatch in the certwatch domain, and allow the specified role the certwatch domain, and use the caller's terminal. Has a sigchld backchannel. (Deprecated)

Domain transition to certwatch.

Execute certwatch in the certwatch domain, and allow the specified role the certwatch domain. backchannel.

All of the rules required to administrate an cfengine environment.

Allow the specified domain to append cfengine's log files.

Dontaudit the specified domain to write cfengine's log files.

Do not audit attempts to write cfengine log files.

Read cfengine lib files.

Search cfengine lib files.

All of the rules required to administrate an cgdcbxd environment

Execute TEMPLATE in the cgdcbxd domin.

Read cgdcbxd PID files.

Execute cgdcbxd server in the cgdcbxd domain.

All of the rules required to administrate an cgroup environment.

Execute a domain transition to run CG Clear.

Execute a domain transition to run CG config parser.

Execute a domain transition to run CG rules engine daemon.

Execute a domain transition to run CG config parser.

Execute a domain transition to run CG rules engine daemon. domain.

Execute a domain transition to run CG Clear and allow the specified role the CG Clear domain.

Connect to CG rules engine daemon over unix stream sockets.

Execute a domain transition to run chrome_sandbox.

Dontaudit read/write to a chrome_sandbox leaks

Role access for chrome sandbox

Role access for chrome sandbox

Execute chrome_sandbox in the chrome_sandbox domain, and allow the specified role the chrome_sandbox domain.

All of the rules required to administrate an chronyd environment.

Append chronyd keys files.

Send to chronyd using a unix domain datagram socket.

Execute chronyd in the chronyd domain.

Execute chronyd in the caller domain.

Execute chronyd server in the chronyd domain.

Manage pid files used by chronyd

Read chronyd keys files.

Read chronyd log files.

Read and write chronyd shared memory.

Send generic signals to chronyd.

Connect to chronyd using a unix domain stream socket.

Execute chronyd server in the chronyd domain.

Manage cinder lib files.

All of the rules required to administrate an cipe environment.

All of the rules required to administrate an clamav environment

Allow the specified domain to append to clamav log files.

Execute a domain transition to run clamd.

Execute a domain transition to run clamscan.

Execute clamscan without a transition.

Manage clamd pid content.

Read clamav configuration files.

Read clamd state files.

Search clamav libraries directories.

Connect to run clamd.

Execute clamd server in the clamd domain.

Execute hwclock in the clock domain.

Do not audit attempts to write clock drift adjustments.

Execute hwclock in the caller domain.

Transition to systemd clock content

Manage clock drift adjustments.

Read clock drift adjustments.

Execute hwclock in the clock domain, and allow the specified role the hwclock domain.

Read and write clock drift adjustments.

Execute clockspeed utilities in the clockspeed_cli domain.

Execute clockspeed utilities in the clockspeed cli domain, and allow the specified role the clockspeed cli domain.

Execute a domain transition to run clogd.

Read and write clogd semaphores.

Read and write clogd shared memory.

Connect to clogd over a unix domain stream socket. (Deprecated)

Execute mongod in the caller domain.

Execute mongod in the caller domain.

Execute a domain transition to run cloud_init.

Allow read to cloud lib files.

Allow read to cloud lib files.

All of the rules required to administrate an cmirrord environment.

Execute a domain transition to run cmirrord.

Execute cmirrord server in the cmirrord domain.

Read cmirrord PID files.

Read and write cmirrord shared memory.

All of the rules required to administrate an cobbler environment.

Do not audit attempts to read and write cobbler log files.

Read cobbler configuration dirs.

Create, read, write, and delete cobbler lib files.

Read cobbler configuration files.

Read cobbler lib files.

Search cobbler lib directories.

All of the rules required to administrate an cobbler environment.

Execute a domain transition to run cobblerd.

Execute cobblerd init scripts in the init script domain.

All of the rules required to administrate an cockpit environment

Manage cockpit lib directories.

Manage cockpit lib files.

Read cockpit lib files.

Search cockpit lib directories.

Execute TEMPLATE in the cockpit domin.

Execute cockpit server in the cockpit domain.

Execute TEMPLATE in the cockpit domin.

All of the rules required to administrate an collectd environment

Transition to collectd.

Execute collectd server in the collectd domain.

Manage collectd lib directories.

Manage collectd lib files.

Read collectd lib files.

Search collectd lib directories.

Execute collectd server in the collectd domain.

Send and receive messages from colord over dbus.

Execute a domain transition to run colord.

Read colord lib files.

Execute colord server in the colord domain.

All of the rules required to administrate an condor environment

Append to condor log files.

Transition to condor.

Manage condor lib directories.

Manage condor lib files.

Manage condor log files

Read condor lib files.

Read condor's log files.

Read condor PID files.

Read and write condor lib files.

Read and write condor_schedd server TCP sockets.

Read and write condor_startd server TCP sockets.

Search condor lib directories.

Allows to start userlandprocesses by transitioning to the specified domain.

Allows to start userland processes by transitioning to the specified domain, with a range transition.

Execute condor server in the condor domain.

All of the rules required to administrate an conman environment

Append to conman log files.

Execute conman in the conman domin.

Manage conman log files

Read conman's log files.

Execute conman server in the conman domain.

Send and receive messages from consolekit over dbus.

Execute a domain transition to run consolekit.

dontaudit Send and receive messages from consolekit over dbus.

Dontaudit attempts to read consolekit log files.

List consolekit PID files.

Create, read, write, and delete consolekit log files.

Read consolekit log files.

Read consolekit PID files.

Allow the domain to read consolekit state files in /proc.

Execute consolekit server in the consolekit domain.

Execute consoletype in the consoletype domain.

Execute consoletype in the caller domain.

Execute consoletype in the consoletype domain, and allow the specified role the consoletype domain.

All of the rules required to administrate an container environment

Execute container_auth_exec_t in the container_auth domain.

Execute container_auth in the caller domain.

Connect to container_auth over a unix stream socket.

Execute container lib directories.

Allow the specified domain to execute container shared files in the caller domain.

Allow domain to create container content

Create objects in a container var lib directory with an automatic type transition to a specified private type.

Manage container lib directories.

Manage container lib files.

Read container lib files.

Read container PID files.

Read container share files.

Execute container in the container domain.

Allow any container_runtime_exec_t to be an entrypoint of this domain

Execute container in the caller domain.

container domain typebounds calling domain.

Read and write container shared memory.

Search container lib directories.

Read the process state of spc containers

Connect to SPC containers over a unix stream socket.

Connect to container over a unix stream socket.

Execute container server in the container domain.

Read and write the container pty type.

Create a aliased type to generic bin files. (Deprecated)

Execute a file in a bin directory in the specified domain.

Make general progams in bin an entrypoint for the specified domain.

Create objects in the /bin directory

Execute a file in a bin directory in the specified domain but do not do it automatically. This is an explicit transition, requiring the caller to use setexeccon().

Check if a shell is executable (DAC-wise).

Do not audit attempts to access check executable files.

Do not audit attempts to access check bin files.

Do not audit attempts to execute all executables.

Get the attributes of files in bin directories.

Do not audit attempts to get the attibutes of sbin files. (Deprecated)

Do not audit attempts to search the contents of bin directories.