Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

3.3. Booleans

SELinux is based on the least level of access required for a service to run. Services can be run in a variety of ways; therefore, you need to specify how you run your services. Use the following Booleans to set up SELinux:
allow_smbd_anon_write
Having this Boolean enabled allows smbd to write to a public directory, such as an area reserved for common files that otherwise has no special access restrictions.
samba_create_home_dirs
Having this Boolean enabled allows Samba to create new home directories independently. This is often done by mechanisms such as PAM.
samba_domain_controller
When enabled, this Boolean allows Samba to act as a domain controller, as well as giving it permission to execute related commands such as useradd, groupadd and passwd.
samba_enable_home_dirs
Enabling this Boolean allows Samba to share users' home directories.
samba_export_all_ro
Export any file or directory, allowing read-only permissions. This allows files and directories that are not labeled with the samba_share_t type to be shared through Samba. When the samba_export_all_ro Boolean is on, but the samba_export_all_rw Boolean is off, write access to Samba shares is denied, even if write access is configured in /etc/samba/smb.conf, as well as Linux permissions allowing write access.
samba_export_all_rw
Export any file or directory, allowing read and write permissions. This allows files and directories that are not labeled with the samba_share_t type to be exported through Samba. Permissions in /etc/samba/smb.conf and Linux permissions must be configured to allow write access.
samba_run_unconfined
Having this Boolean enabled allows Samba to run unconfined scripts in the /var/lib/samba/scripts/ directory.
samba_share_fusefs
This Boolean must be enabled for Samba to share fusefs file systems.
samba_share_nfs
Disabling this Boolean prevents smbd from having full access to NFS shares via Samba. Enabling this Boolean will allow Samba to share NFS volumes.
use_samba_home_dirs
Enable this Boolean to use a remote server for Samba home directories.
virt_use_samba
Allow virtual machine access to CIFS files.

Note

Due to the continuous development of the SELinux policy, the list above might not contain all Booleans related to the service at all times. To list them, run the following command as root: 
~]# semanage boolean -l | grep service_name