CME-303
SELinux Booleans (Restrictive)
Description
Fine-grained SELinux policy toggles that disable risky inter-domain interactions. Examples: httpd_can_network_connect=off prevents web servers from making outbound connections; container_manage_cgroup=off restricts container cgroup access.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Scope (S) | C → U | Disables specific cross-domain access paths |
CWE Relationships
Verification
Check key SELinux booleans are set to restrictive values
$ getsebool httpd_can_network_connect
# Expected: httpd_can_network_connect --> off
# Expected: httpd_can_network_connect --> off
Platform: rhel
$ getsebool -a | grep -E 'httpd_can_network_connect|httpd_execmem|allow_user_exec_content|selinuxuser_execmod' | grep -c ' off$'
# Expected: >=3
# Expected: >=3
Platform: rhel
$ getsebool virt_sandbox_use_all_caps
# Expected: virt_sandbox_use_all_caps --> off
# Expected: virt_sandbox_use_all_caps --> off
Platform: rhel
$ semanage boolean -l | grep httpd_can_network_connect
# Expected: (off , off)
# Expected: (off , off)
Platform: rhel
Remediation
rhel
Set security-relevant SELinux booleans to restrictive (off) values
setsebool -P httpd_can_network_connect off
setsebool -P httpd_execmem off
setsebool -P allow_user_exec_content off
setsebool -P virt_sandbox_use_all_caps off