22.3. Booleans
SELinux is based on the least level of access required for a service to run. Services can be run in a variety of ways; therefore, you need to specify how you run your services. Use the following Booleans to set up SELinux:
rsync_anon_write- Having this Boolean enabled allows
rsyncin thersync_tdomain to manage files, links and directories that have a type ofpublic_content_rw_t. Often these are public files used for public file transfer services. Files and directories must be labeled this type. rsync_client- Having this Boolean enabled allows
rsyncto initiate connections to ports defined asrsync_port_t, as well as allowing the daemon to manage files, links, and directories that have a type ofrsync_data_t. Note thatrsyncmust be in thersync_tdomain in order for SELinux to enact its control over it. The configuration example in this chapter demonstratesrsyncrunning in thersync_tdomain. rsync_export_all_ro- Having this Boolean enabled allows
rsyncin thersync_tdomain to export NFS and CIFS volumes with read-only access to clients.
Note
Due to the continuous development of the SELinux policy, the list above might not contain all Booleans related to the service at all times. To list them, enter the following command:
~]$ getsebool -a | grep service_name
Enter the following command to view description of a particular Boolean:
~]$ sepolicy booleans -b boolean_name
Note that the additional policycoreutils-devel package providing the sepolicy utility is required for this command to work.
