Targeted vs Minimum Targeted SELinux Policy for Web Hosting on AlmaLinux 9: Boolean Management Trade-offs

Short Answer

Keep the default targeted policy on AlmaLinux 9. For a fleet that must run standard HTTP/HTTPS plus custom applications needing outbound network access, targeted minimizes ongoing boolean work: the booleans those workloads depend on are already enabled, and changes made with semanage boolean -m are stored per policy type, so they survive semodule -R reloads and ordinary minor package upgrades. The minimum targeted policy does not reduce maintenance — it moves the whole burden onto you, and it does not share your boolean store.

Confirmed Behavior vs. Things to Verify Locally

Well-established across RHEL-family 9 systems:

• Boolean modifications are written to /etc/selinux/<policytype>/modules/active/booleans.local. That path is keyed to the active policy type, so targeted and minimum keep separate files.
• Reloading policy modules (semodule -R) does not clear that file; the values are re-applied when policy loads.
• Changing SELINUXTYPE= in /etc/selinux/config is a policy type change. It requires a relabel and does not carry boolean values across; they must be reapplied.
• Under targeted, network-connectivity booleans such as httpd_can_network_connect are on by default; under minimum they are off, and a denied capability tends to surface as an AVC denial rather than a clear application error.

Marked for review: the exact number of booleans enabled by default in each policy varies by release and by installed policy modules. Treat any specific count as approximate and confirm it on a representative host instead of trusting a number from a blog post.

Minimal Steps for This Case

1. Confirm the active policy: sestatus | grep 'Loaded policy name'
2. List what your applications actually need: getsebool -a | grep httpd and semanage boolean -l -C (shows only locally modified booleans).
3. Set the ones you require persistently, for example semanage boolean -m --on httpd_can_network_connect.
4. Confirm the persistent store: cat /etc/selinux/targeted/modules/active/booleans.local — the file may not exist until the first change.
5. Prove persistence: run semodule -R, then getsebool httpd_can_network_connect; it should still read on.
6. After any dnf update selinux-policy-targeted, repeat steps 1 and 5, and check ausearch -m avc -ts recent after deploying a custom app.

Targeted vs. Minimum Targeted at a Glance

Make Defaults Irrelevant

The durable answer is not "pick the policy with more booleans on" but "declare the booleans you need." Manage them with a configuration management module — for example Ansible's seboolean with persistent: yes — so every node converges to the same state regardless of what the policy package ships. That removes the upgrade-time surprise where a rebuilt policy module changes a default, and it turns a future policy type change into one auditable edit rather than a fleet-wide manual pass.

The One Detail That Would Change This Recommendation

If your environment has an external mandate — a compliance baseline, a hardening profile, or a customer contract — requiring the minimum policy regardless of operational cost, the recommendation flips: use minimum targeted, but pair it with a relabel plan, a declarative boolean manifest, and AVC monitoring from day one. Whether such a mandate exists is the one detail worth confirming before you standardize.