Targeted vs Minimum Targeted SELinux Policy for Web Hosting on AlmaLinux 9: Boolean Management Trade-offs

Policy Selection Context

AlmaLinux 9 ships with the targeted SELinux policy enabled by default, which permits common network services while confining processes to their domains. The alternative minimum targeted policy reduces the set of active booleans, providing a stricter sandbox at the cost of requiring manual enablement for each service capability.

Migration Constraint

When moving workloads from CentOS 8 to AlmaLinux 9, SELinux booleans such as httpd_can_network_connect may revert to their default states. The targeted policy enables many of these booleans out of the box, while the minimum targeted policy leaves them disabled. Administrators using semanage boolean -m to set persistent values find that those settings do not automatically carry over if the policy type is changed between targeted and minimum targeted; a policy reload is required and existing boolean values are not migrated.

Third‑Party Dependency Uncertainty

Third‑party web applications often depend on specific booleans being active. Under the minimum targeted policy, those booleans are off by default, potentially causing service failures unless pre‑configured. The targeted policy reduces this risk but expands the attack surface by enabling a broader set of permissions.

Which policy choice minimizes ongoing boolean maintenance for a fleet of web servers that must support both standard HTTP/HTTPS services and custom applications requiring network connectivity, while ensuring boolean persistence survives policy reloads and minor version upgrades?