Using SELinux Boolean settings to enable services
Many services have a wide range of configuration options for many common cases, but not always the same. For example, the http server should not access user files, but at the same time, it's a common way of operation to enable personal websites from the www or public_html folders in each user's home directory.
To overcome that use case and, at the same time, provide enhanced security, the SELinux policy makes use of Booleans.
A Boolean is a tunable that can be set by the administrator that can enable or disable conditionals in the policy code. Let's see, for example, a list of Booleans available for httpd by executing getsebol -a|grep ^http (list reduced):
httpd_can_network_connect --> off httpd_can_network_connect_db --> off httpd_can_sendmail --> off httpd_enable_homedirs --> off httpd_use_nfs --> off
This list is a reduced subset of the Booleans available, but it does give us an idea of what...