allow_guest_exec_content boolean controls whether user in
guest_t can execute files in home or temporary directories. User is otherwise still allowed to run other executables as policy permits.
SELinux reference policy provides interfaces to allow specific access. These interfaces are listed in SELinux policy documentation (your distribution likely provides them in
To allow guest user to use ping, you could use
Then create a module for your custom policy, for example
and compile it with:
make -f /usr/share/selinux/devel/Makefile my_guest.pp
Depending on what kind of network access you want to allow, you can look for suitable interface and use it in same way to extend