Advice for my SELinux configuration

Hi *,

I’m not sure if I should impose on you to check my ZFS and SELinux configuration, but I’ll give it a try.
If this is too much to ask, simply ignore this post.

So here we go:

On my main Linux server, I use ext4 for the system partitions; ZFS is used for everything else.

The following zfs datasets exist:

# pool_apps_users
# pool_apps_users/apps
# -> dovecot
# pool_apps_users/apps/mail
# pool_apps_users/apps/mail/vmail
# -> vmware
# pool_apps_users/apps/vmware
# pool_apps_users/apps/vmware/aqua
# pool_apps_users/apps/vmware/winclient001
# pool_apps_users/apps/vmware/winclientvm001
# -> home directories
# pool_apps_users/users

# -> mariadb, gerbera, ...
# pool_database

# pool_archiv
# -> all documents, also for Nextcloud
# pool_archiv/archiv
# -> backups sent by remote machines via rsync
# pool_archiv/backup_remote

# -> zfs replication targets
# pool_bkupdup_Month[Odd|Even]
# pool_bkupdup_Month[Odd|Even]/adelaide.<mydomain>
# pool_bkupdup_Month[Odd|Even]/adelaide.<mydomain>/pool_apps_users
# ...

I have configured selinux as follows:

semanage fcontext -a -t var_t "/home/apps"
semanage fcontext -a -t var_t "/home/apps(/.*)?"
semanage fcontext -a -t mail_spool_t "/home/apps/mail/vmail(/.*)?"
semanage fcontext -a -t mail_spool_t "/home/apps/mail/vmail/mailboxes(/.*)?"
semanage fcontext -a -t dovecot_var_lib_t "/home/apps/mail/vmail/bin(/.*)?"
semanage fcontext -a -t virt_image_t "/home/apps/vmware(/.*)?"
semanage fcontext -a -t httpd_sys_content_t "/home/apps/websites(/.*)?"

semanage fcontext -a -t httpd_sys_rw_content_t "/home/apps/websites/nextcloud(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/home/database/nextcloud-data(/.*)?"

setsebool -P httpd_unified off
setsebool -P httpd_can_sendmail on

semanage fcontext -a -e /home /home/users
semanage fcontext -a -t bin_t "/home/<myuser>\.base\.local/entw(/.*)?"

semanage fcontext -a -t antivirus_db_t "/var/spool/amavis(/.*)?"

semanage fcontext -a -t httpd_sys_rw_content_t "/home/archiv(/.*)?"
semanage fcontext -a -t var_t "/var/backup(/.*)?"
semanage fcontext -a -t var_t "/var/backup/machines(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/backup/appsettings/smartphones(/.*)?"
semanage fcontext -a -t public_content_rw_t "/var/backup/appsettings/clients(/.*)?"

semanage fcontext -a -t var_t "/home/database"
semanage fcontext -a -t var_t "/home/database(/.*)?"
semanage fcontext -a -t mysqld_db_t "/home/database/mysql1(/.*)?"
semanage fcontext -a -t mysqld_db_t "/home/database/mysql2(/.*)?"

semanage fcontext -a -t mnt_t "/mnt_bkup"
semanage fcontext -a -t mnt_t "/mnt_bkup(/.*)?"
semanage fcontext -a -t file_t "/mnt_bkup/pool_bkupdup_Month(Odd|Even)(/.*)?"

semanage fcontext -a -t httpd_log_t "/var/log/nextcloud(/.*)?"

restorecon -RFv /home/apps
restorecon -RFv /home/database
restorecon -RFv /home/users
restorecon -RFv /home/archiv
restorecon -RFv /var/backup
restorecon -RFv /mnt_bkup
restorecon -RFv /var/spool/amavis
restorecon -RFv /var/log/nextcloud

semanage port -a -t mysqld_port_t -p tcp 3307

setsebool -P httpd_execmem on

setsebool -P httpd_can_network_connect on
setsebool -P httpd_can_network_connect_db on

setsebool -P samba_export_all_rw 1
setsebool -P samba_enable_home_dirs 1

setsebool -P virt_use_samba on


Does that make sense? Can I do it better?

TIA.

Bye.
Michael.