TOMOYO Linux functionality comparison table
| TOMOYO Linux version | 1.7 | 1.8 | 2.2 | 2.3 | 2.4 | 2.5 | 2.6 | ||||
| Supported kernel version | 2.4.37 2.6.27-2.6.37 | 2.4.37 2.6.27-2.6.39 3.0-3.19 4.0-4.20 5.0-5.19 6.0- | 2.6.30-2.6.32 | 2.6.33 | 2.6.34 | 2.6.35 | 2.6.36-2.6.39 3.0 | 3.1 | 3.2-3.19 4.0-4.20 5.0 | 5.1-5.19 6.0- | |
| Type | Function | ||||||||||
| Accuracy of pathnames | |||||||||||
| Restrict accessing information to only self process? (/proc/self/) | Y | Y | Y | Y | Y | ||||||
| Allow accessing deleted files? | Y | Y | Y | Y | Y | Y | |||||
| Allow accessing pathnames longer than 4000 bytes? | Y | Y | Y | Y | Y | Y | |||||
| Features for assisting specifying string values | |||||||||||
| Allow recursive directory matching? (/\{dir\}/) | Y | Y | Y | Y | Y | Y | Y | Y | Y | ||
| Allow grouping pathnames? (path_group) | Y | Y | Y | Y | Y | Y | Y | ||||
| Features for assisting specifying numeric values | |||||||||||
| Allow grouping numbers? (number_group) | Y | Y | Y | Y | Y | Y | |||||
| Allow grouping IP addresses? (address_group) | Y | Y | Y | Y | |||||||
| Features for reducing reboots | |||||||||||
| Memory reclaimed by garbage collection? | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Features for supporting more fine grained domain transitions | |||||||||||
| Allow domain transitions without program execution? | Y | Y | Y | Y | |||||||
| Automatically perform domain transitions upon condition match? | Y | ||||||||||
| Features for specifying more fine grained permissions | |||||||||||
| Restrict based on process's credentials (e.g. user ID)? | Y | Y | Y | Y | Y | ||||||
| Restrict based on file's credentials (e.g. owner ID)? | Y | Y | Y | Y | Y | ||||||
| Restrict access using process's state variables? | Y | (*2) | |||||||||
| Allow including grouped permissions? (acl_group) | Y | Y | Y | Y | |||||||
| Allow using policy namespace? | Y | Y | Y | Y | |||||||
| Features for reducing damage by runaway | |||||||||||
| Sleep penalty | Y | Y | |||||||||
| execute handler | Y | Y | |||||||||
| Features for obtaining access logs | |||||||||||
| Notify of policy violation using mail? | Y | Y | Y | Y | Y | Y | |||||
| Generate access granted logs/rejected logs? | Y | Y | Y | Y | Y | ||||||
| Features for assisting software updates | |||||||||||
| Handle policy violation interactively? | Y | Y | Y | Y | Y | Y | |||||
| Access control for Files | |||||||||||
| Restrict opening files for reading? (read) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Restrict opening files for writing? (write) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Tell opening files for appending from writing? (append) | (*1) | Y | (*1) | (*1) | (*1) | (*1) | (*1) | Y | Y | Y | |
| Restrict executing programs? (execute) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Allow execution of programs with temporary names? | Y | Y | Y | Y | Y | Y | |||||
| Check dereferenced pathname when executing programs? | Y | Y | Y | Y | Y | ||||||
| Check invocation name (argv[0]) when executing programs? | Y | Y | Y | Y | Y | ||||||
| Check arguments (argv[]) and environment variables (envp[]) when executing programs? | Y | Y | Y | Y | Y | ||||||
| Restrict permitted environment variables names? | Y | Y | Y | Y | |||||||
| Restrict permitted binary loader (e.g. /lib/ld-linux.so.2) programs? | Y | Y | |||||||||
| Specify domain transition preference? | Y | Y | Y | ||||||||
| Restrict creating files? (create) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Check DAC's permission when creating files? | Y | Y | Y | Y | Y | Y | |||||
| Restrict creating directories? (mkdir) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Check DAC's permission when creating directories? | Y | Y | Y | Y | Y | Y | |||||
| Restrict creating FIFOs? (mkfifo) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Check DAC's permission when creating FIFOs? | Y | Y | Y | Y | Y | Y | |||||
| Restrict creating Unix domain sockets? (mksock) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Check DAC's permission when creating Unix domain sockets? | Y | Y | Y | Y | Y | Y | |||||
| Restrict creating symbolic links? (symlink) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Check symbolic link's target when creating symbolic links? | Y | Y | Y | Y | Y | ||||||
| Restrict creating device files? (mkblock/mkchar) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Check device major/minor numbers and DAC's permission when creating device files? | Y | Y | Y | Y | Y | Y | |||||
| Restrict use of IOCTL requests? (ioctl) | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Check IOCTL's command number? | Y | Y | Y | Y | Y | Y | |||||
| Restrict change of owner (chown) / group (chgrp) / DAC's permissions (chmod)? | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Restrict owner ID / group ID / DAC's permissions? | Y | Y | Y | Y | Y | Y | |||||
| Restrict deleting files? (unlink) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Restrict truncating files? (truncate) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Restrict overwriting files? (rewrite) | Y | (*1) | Y | Y | Y | Y | Y | (*1) | (*1) | (*1) | |
| Restrict renaming files? (rename) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Restrict creating hard links? (link) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Restrict deleting directories? (rmdir) | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | |
| Restrict mounting filesystems? (mount) | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Check filesystem's type and mount options when mounting filesystems? | Y | Y | Y | Y | Y | Y | |||||
| Restrict unmounting filesystems? (unmount) | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Restrict change of root directories (chroot) / exchange of root directories (pivot_root)? | Y | Y | Y | Y | Y | Y | Y | Y | |||
| Access control for Networks | |||||||||||
| Restrict remote IP addresses and port numbers for outgoing connections? | Y | Y | Y | Y | |||||||
| Restrict remote IP addresses and port numbers for outgoing packets? | Y | Y | Y | Y | |||||||
| Restrict remote IP addresses and port numbers for incoming connections? | Y | Y | |||||||||
| Restrict remote IP addresses and port numbers for incoming packets? | Y | Y | |||||||||
| Restrict local IP addresses and port numbers? | Y | Y | Y | Y | |||||||
| Reserve specific local port numbers for applications that need them? | Y | Y | |||||||||
| Restrict remote UNIX addresses for outgoing connections? | Y | Y | Y | ||||||||
| Restrict remote UNIX addresses for outgoing packets? | Y | Y | Y | ||||||||
| Restrict remote UNIX addresses for incoming connections? | Y | ||||||||||
| Restrict remote UNIX addresses for incoming packets? | Y | ||||||||||
| Restrict local UNIX addresses? | Y | Y | Y | ||||||||
| Access control for Capabilities | |||||||||||
| Restrict original capabilities? | Y | Y | |||||||||
| Do not check capabilities that overwrap other permissions? | Y | ||||||||||
| Access control for IPC | |||||||||||
| Restrict destination domains for signal transmission? | Y | Y | |||||||||
| Misc | |||||||||||
| Allow enabling TOMOYO Linux with SELinux / AppArmor? | Y | Y | Y | ||||||||
| Allow enabling functionalities the administrator wants to enable? | Y | Y | Y | Y | Y | Y | |||||
| Quick initialization of configuration? | Y | Y | Y | Y | Y | Y | |||||