8.16 allowkernel

Configures priviledges to communicate and administrate kernel. For detail of what is granted see allow_admin_xxxx in macros/seedit_macros.te. For example, to analyze what is allowed in allowkernel klog_adm see allow_admin_klog_adm macro.

• Syntax
  allowkernel netlink$\mid$klog_read$\mid$klog_write$\mid$klog_adm$\mid$insmod;
• Meaning
  
  1. netlink
     Allows to communicate with kernel by netlink socket.
  2. klog_read
     Allows to read kernel messages by syslog(2) call. Usually it is required to use dmesg command.
  3. klog_write
     Allows to send log message to audit subsystem in kernel.This is the same as capability audit_write.
  4. klog_adm
     Allows to change configuration of audit in kernel. The same as capability audit_control,sys_pacct.
  5. insmod
     Allows to install kernel module.