Using SELinux Boolean settings to enable services

Many services have a wide range of configuration options for many common cases, but not always the same. For example, the http server should not access user files, but at the same time, it's a common way of operation to enable personal websites from the www or public_html folders in each user's home directory.

To overcome that use case and, at the same time, provide enhanced security, the SELinux policy makes use of Booleans.

A Boolean is a tunable that can be set by the administrator that can enable or disable conditionals in the policy code. Let's see, for example, a list of Booleans available for httpd by executing getsebol -a|grep ^http (list reduced):

httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_sendmail --> off
httpd_enable_homedirs --> off
httpd_use_nfs --> off

This list is a reduced subset of the Booleans available, but it does give us an idea of what...