3.7 Integrated permissions in allowpriv rule

Table 76: Option:audit_read

Object class	Permission	Domain	Type
netlink_audit_socket	nlmsg_read	domain	self
	nlmsg_readpriv

Table 77: Option:audit_write

Object class	Permission	Domain	Type
netlink_audit_socket	nlmsg_relay	domain	self

Table 78: Option:audit_adm

Object class	Permission	Domain	Type
netlink_audit_socket	nlmsg_write	domain	self

Table 79: Option:klog_read

Object class	Permission	Domain	Type
system	syslog_read	domain	kernel_t

Table 80: Option:klog_adm

Object class	Permission	Domain	Type
system	syslog_console	domain	kernel_t
	syslog_mod

Table 81: Option:cap_sys_pacct

Object class	Permission	Domain	Type
capability	sys_pacct	domain	self

Table 82: Option:cap_sys_module

Object class	Permission	Domain	Type
capability	sys_module	domain	self

Table 83: Option:netlink

Object class	Permission	Domain	Type
netlink_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_route_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	nlmsg_read
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_firewall_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_firewall_socket	nlmsg_write	domain	self
netlink_tcpdiag_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_tcpdiag_socket	nlmsg_read	domain	self
netlink_nflog_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_xfrm_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_xfrm_socket	nlmsg_read	domain	self
	nlmsg_write
netlink_selinux_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_audit_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_dnrt_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write
netlink_kobject_uevent_socket	accept	domain	self
	append
	bind
	connect
	create
	getattr
	getopt
	ioctl
	listen
	lock
	name_bind
	read
	recv_msg
	recvfrom
	relabelfrom
	relabelto
	send_msg
	sendto
	setattr
	setopt
	shutdown
	write

Table 84: Option:relabel

Object class	Permission	Domain	Type
blk_file	relabelfrom	domain	file_type
chr_file	relabelto		fs_type
dir	setattr
fifo_file
file
lnk_file
sock_file

Table 85: Option:part_relabel

Object class	Permission	Domain	Type
blk_file	relabelfrom	domain	writable_type
chr_file	relabelto
dir
fifo_file
file
lnk_file
sock_file
process	setfscreate	domain	self

Table 86: Option:getsecurity

Object class	Permission	Domain	Type
dir	getattr	domain	security_t
	read
	search
file	getattr	domain	security_t
	read
security	check_context	domain	security_t
	compute_av
	compute_create
	compute_relabel
	compute_user

Table 87: Option:setsecurity

Object class	Permission	Domain	Type
file	write	domain	security_t

Table 88: Option:setenforce

Object class	Permission	Domain	Type
security	setenforce	domain	security_t

Table 89: Option:setbool

Object class	Permission	Domain	Type
security	setbool	domain	security_t

Table 90: Option:load_policy

Object class	Permission	Domain	Type
security	load_policy	domain	security_t

Table 91: Option:getsecattr

Object class	Permission	Domain	Type
process	getattr	domain	global

Table 92: Option:setsecparam

Object class	Permission	Domain	Type
security	setsecparam	domain	security_t

Table 93: Option:devcreate,In addition, allow_file_devcrete is used in file write

Object class	Permission	Domain	Type
capability	mknod	domain	self
blk_file	create	domain	writable_type
chr_file	link
	rename
	unlink

Table 94: Option:search

Object class	Permission	Domain	Type
dir	getattr	domain	file_type
	read
	search
blk_file	getattr	domain	file_type
chr_file
dir
fifo_file
file
lnk_file
sock_file
lnk_file	read	domain	file_type

Table 95: Option:read

Object class	Permission	Domain	Type
blk_file	getattr	domain	file_type
chr_file	ioctl
dir	lock
fifo_file	read
file
lnk_file
sock_file

Table 96: Option:write

Object class	Permission	Domain	Type
blk_file	append	domain	file_type
chr_file	create
dir	link
fifo_file	rename
file	setattr
lnk_file	unlink
sock_file	write
dir	reparent	domain	file_type
	rmdir

Table 97: Option:cap_net_admin

Object class	Permission	Domain	Type
capability	net_admin	domain	self
netlink_route_socket	nlmsg_write	domain	self

Table 98: Option:cap_sys_boot

Object class	Permission	Domain	Type
capability	sys_boot	domain	self

Table 99: Option:cap_dac_override

Object class	Permission	Domain	Type
capability	dac_override	domain	self

Table 100: Option:cap_dac_read_search

Object class	Permission	Domain	Type
capability	dac_read_search	domain	self

Table 101: Option:cap_setuid

Object class	Permission	Domain	Type
capability	setuid	domain	self

Table 102: Option:cap_setgid

Object class	Permission	Domain	Type
capability	setgid	domain	self

Table 103: Option:cap_chown

Object class	Permission	Domain	Type
capability	chown	domain	self

Table 104: Option:cap_setpcap

Object class	Permission	Domain	Type
capability	setpcap	domain	self

Table 105: Option:cap_fowner

Object class	Permission	Domain	Type
capability	fowner	domain	self

Table 106: Option:cap_fsetid

Object class	Permission	Domain	Type
capability	fsetid	domain	self

Table 107: Option:cap_linux_immutable

Object class	Permission	Domain	Type
capability	linux_immutable	domain	self

Table 108: Option:quotaon

Object class	Permission	Domain	Type
file	quotaon	domain	file_type
filesystem	quotamod	domain	fs_type

Table 109: Option:mount

Object class	Permission	Domain	Type
dir	mounton	domain	file_type
filesystem	mount	domain	fs_type
	remount
	unmount

Table 110: Option:cap_sys_rawio

Object class	Permission	Domain	Type
capability	sys_rawio	domain	self

Table 111: Option:cap_sys_chroot

Object class	Permission	Domain	Type
capability	sys_chroot	domain	self

Table 112: Option:unlabel

Object class	Permission	Domain	Type
dir	add_name	domain	file_t
	getattr		unlabeled_t
	ioctl
	lock
	read
	remove_name
	reparent
	rmdir
	search
blk_file	append	domain	file_t
chr_file	create		unlabeled_t
dir	getattr
fifo_file	ioctl
file	link
lnk_file	lock
sock_file	read
	rename
	setattr
	unlink
	write
file	execute	domain	file_t
	execute_no_trans		unlabeled_t

Table 113: Option:cap_ipc_lock

Object class	Permission	Domain	Type
capability	ipc_lock	domain	self

Table 114: Option:cap_sys_nice

Object class	Permission	Domain	Type
capability	sys_nice	domain	self

Table 115: Option:cap_sys_resource

Object class	Permission	Domain	Type
capability	sys_resource	domain	self

Table 116: Option:cap_sys_time

Object class	Permission	Domain	Type
capability	sys_time	domain	self

Table 117: Option:cap_sys_admin

Object class	Permission	Domain	Type
capability	sys_admin	domain	self

Table 118: Option:cap_sys_tty_config

Object class	Permission	Domain	Type
capability	sys_tty_config	domain	self

Table 119: Option:ptrace

Object class	Permission	Domain	Type
process	ptrace	domain	global