LFCS 142 🐧 SELinux — Booleans - KandZ

⏱️ Estimated read: 10 min | |

The previous chapter covered security contexts and labels: the data that the SELinux policy uses to identify files and processes. This chapter covers the switches that adjust the policy without recompiling it. A SELinux boolean is a named toggle that the policy checks at runtime. When the toggle is on, a specific rule or set of rules is enabled. When it is off, the rule is disabled. The LFCS exam tests the commands that list, inspect, and change the booleans, the difference between a runtime change and a persistent change, and the specific booleans that solve the most common SELinux problems (e.g., httpd_can_network_connect for a web server that needs to connect to a database). The critical trap is that a boolean change made with setsebool is not persistent unless the -P flag is used.

Key point: The getsebool -a command lists all booleans and their current values. The semanage boolean -l command lists the booleans with their descriptions and their default and current states. The setsebool boolean_name on|off command changes the boolean at runtime. The setsebool -P boolean_name on command changes it persistently. The persistent change is written to the policy’s file, and it survives a reboot and a relabel.

Why SELinux booleans require a specific mental model

The policy recompilation problem. A SELinux policy is compiled from the source .te files into a binary policy that the kernel loads. Changing a rule in the source requires recompiling the policy module and loading it into the kernel. For an administrator who needs to enable a feature, that is a heavy process. The boolean is the alternative: the policy author decides which rules are toggleable and assigns them a boolean name. The administrator flips the switch, and the policy behaves differently without a recompile.

The runtime versus persistent problem. The setsebool boolean_name on command changes the boolean in the running kernel. The change is immediate. The application starts working. But the change is lost on reboot. The setsebool -P boolean_name on command writes the change to the policy’s persistent store, and the boolean is set to that value when the system boots. The -P flag is the difference between a fix that lasts an hour and a fix that lasts until the administrator changes their mind.

The predefined boolean problem. The booleans are not created by the administrator. They are defined by the policy authors. The names follow a naming convention: _can_ for a permission, _use_ for a resource, and the service name as a prefix. The httpd_can_network_connect boolean, for example, controls whether the Apache web server can make outbound network connections. The httpd_can_network_connect_db boolean controls whether it can connect to a database. The samba_enable_home_dirs boolean controls whether Samba can share user home directories. The names are self-documenting, but the exact list is defined by the policy, not by the administrator.

The listing problem. The getsebool -a command lists every boolean and its current value. The output is hundreds of lines. The semanage boolean -l command shows the booleans with the short description and the default and current values, which is more useful for understanding what each boolean does. The grep filter narrows the output to the relevant service.

The trade-off. The boolean is the recommended way to adjust the policy. It is less precise than a custom policy module, but it is the supported mechanism that survives policy updates. The custom module is the fallback for the cases that the booleans do not cover. The exam tests the boolean commands and the specific booleans for the common services.

a. Listing and inspecting the booleans

The getsebool -a command lists every boolean and its current value. The semanage boolean -l command shows the booleans with the descriptions and the default state.

# List all booleans
getsebool -a

# List with descriptions
semanage boolean -l

# Filter by service
getsebool -a | grep httpd
semanage boolean -l | grep httpd

The getsebool output is a simple name on or name off line. The semanage boolean -l output has columns: the boolean name, the current state, the default state, the description, and an indicator of whether the state has been changed from the default.

httpd_can_network_connect     (off, off)  Allow httpd to connect to network
httpd_can_network_connect_db  (off, off)  Allow httpd to connect to databases
httpd_enable_homedirs         (off, off)  Allow httpd to read home directories

The semanage boolean -l -C command lists only the booleans that have been changed from their default values. This is the audit view: it shows what the administrator has modified.

# Show only modified booleans
semanage boolean -l -C

b. Changing the boolean at runtime and persistently

The setsebool command changes the boolean. Without the -P flag, the change is runtime only.

# Runtime change
setsebool httpd_can_network_connect on

# Verify
getsebool httpd_can_network_connect
# httpd_can_network_connect --> on

The runtime change is immediate. The Apache process can now make outbound connections. But if the system reboots, the boolean reverts to its previous value (usually off). The -P flag makes the change persistent.

# Persistent change
setsebool -P httpd_can_network_connect on

The -P flag writes the change to the policy’s persistent store. The write takes a few seconds because the policy file is rewritten. The change survives a reboot and a relabel.

The -N flag on setsebool -P skips the policy reload, which is faster but does not apply the change to the running kernel. The -N flag is used when the change is written to the persistent store but the running kernel is updated by a later reload.

c. The common booleans for the standard services

The booleans that the exam tests are the ones that solve the common service problems. The httpd_can_network_connect and httpd_can_network_connect_db are the two for the web server. The samba_enable_home_dirs and samba_export_all_rw are the two for Samba. The ftpd_full_access is the one for FTP. The ssh_chroot_rw_homedirs is the one for SSH chroot.

# Apache can make outbound connections
setsebool -P httpd_can_network_connect on

# Apache can connect to a database
setsebool -P httpd_can_network_connect_db on

# Apache can read user home directories
setsebool -P httpd_enable_homedirs on

# Samba can share home directories
setsebool -P samba_enable_home_dirs on

# FTP can access files
setsebool -P ftpd_full_access on

The httpd_can_network_connect boolean is the one that fixes the “connection refused” error when a PHP application tries to connect to a remote API. The httpd_can_network_connect_db is the one that fixes the same error when the application tries to connect to a MySQL or PostgreSQL database. The httpd_enable_homedirs is the one that fixes the “permission denied” error when the web server tries to read a file in /home/user/.

The setsebool -P command is the correct one for the exam. The -P flag is the persistence. The runtime change is for testing.

Complete Example Session

# ============================================
# PART 1: LIST BOOLEANS
# ============================================

getsebool -a | grep httpd
# httpd_can_network_connect --> off
# httpd_can_network_connect_db --> off
# httpd_enable_homedirs --> off

# ============================================
# PART 2: INSPECT WITH DESCRIPTIONS
# ============================================

semanage boolean -l | grep httpd_can_network_connect
# httpd_can_network_connect (off, off) Allow httpd to connect to network

# ============================================
# PART 3: RUNTIME CHANGE
# ============================================

setsebool httpd_can_network_connect on
getsebool httpd_can_network_connect
# httpd_can_network_connect --> on

# ============================================
# PART 4: OBSERVE REVERT AFTER REBOOT
# ============================================

reboot
getsebool httpd_can_network_connect
# httpd_can_network_connect --> off

# ============================================
# PART 5: PERSISTENT CHANGE
# ============================================

setsebool -P httpd_can_network_connect on
getsebool httpd_can_network_connect
# httpd_can_network_connect --> on

# ============================================
# PART 6: VERIFY AFTER REBOOT
# ============================================

reboot
getsebool httpd_can_network_connect
# httpd_can_network_connect --> on

# ============================================
# PART 7: ENABLE DATABASE CONNECTION
# ============================================

setsebool -P httpd_can_network_connect_db on

# ============================================
# PART 8: LIST MODIFIED BOOLEANS
# ============================================

semanage boolean -l -C
# httpd_can_network_connect (on, off)
# httpd_can_network_connect_db (on, off)

# ============================================
# PART 9: DISABLE A BOOLEAN
# ============================================

setsebool -P httpd_can_network_connect off

The nine parts trace the boolean workflow: listing, inspection, runtime change, revert, persistent change, verification, database connection, modified list, and disabling.

Quick Reference

Commands

Command	Purpose
`getsebool -a`	List all booleans
`getsebool <name>`	Show a specific boolean
`semanage boolean -l`	List with descriptions
`semanage boolean -l -C`	List modified booleans
`setsebool <name> on`	Runtime change
`setsebool -P <name> on`	Persistent change

Common Booleans

Boolean	Purpose
`httpd_can_network_connect`	HTTP outbound connections
`httpd_can_network_connect_db`	HTTP database connection
`httpd_enable_homedirs`	HTTP read home directories
`samba_enable_home_dirs`	Samba share home directories
`samba_export_all_rw`	Samba export any directory
`ftpd_full_access`	FTP full access
`ssh_chroot_rw_homedirs`	SSH chroot read/write home

Persistence

Command	Survives Reboot
`setsebool <name> on`	No
`setsebool -P <name> on`	Yes
`semanage boolean --modify`	Yes

Best Practices

✅ Do This:

setsebool -P httpd_can_network_connect on
<!-- Persistent change for production -->            # ✅

semanage boolean -l | grep httpd
<!-- Inspect with descriptions -->                    # ✅

semanage boolean -l -C
<!-- Audit modified booleans -->                      # ✅

❌ Don’t Do This:

setsebool httpd_can_network_connect on
<!-- Lost on reboot -->                              # ❌

# Disable SELinux to fix a connection error
<!-- Use the boolean instead -->                     # ❌

# Assume the boolean name is arbitrary
<!-- It is defined by the policy authors -->         # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Boolean lost after reboot	Used `setsebool` without `-P`	Use `-P`
Apache cannot connect out	`httpd_can_network_connect` off	`setsebool -P ... on`
Apache cannot connect DB	`httpd_can_network_connect_db` off	`setsebool -P ... on`
Apache cannot read home	`httpd_enable_homedirs` off	`setsebool -P ... on`
`setsebool` not found	Package not installed	Install `policycoreutils`

Real-World Examples

1. List All

getsebool -a

2. Specific Boolean

getsebool httpd_can_network_connect

3. With Description

semanage boolean -l | grep httpd

4. Enable Runtime

setsebool httpd_can_network_connect on

5. Enable Persistent

setsebool -P httpd_can_network_connect on

6. Enable DB

setsebool -P httpd_can_network_connect_db on

7. Enable Home

setsebool -P httpd_enable_homedirs on

8. Enable Samba Home

setsebool -P samba_enable_home_dirs on

9. List Modified

semanage boolean -l -C

10. Disable

setsebool -P httpd_can_network_connect off

Visual

Runtime vs Persistent

┌──────────────────────────────────────────────┐
│  setsebool httpd_can_network_connect on      │
│  → Immediate change                          │
│  → Lost on reboot                            │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  setsebool -P httpd_can_network_connect on   │
│  → Written to policy store                   │
│  → Survives reboot                           │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  semanage boolean -l -C                      │
│  → Lists modified booleans                   │
└──────────────────────────────────────────────┘

Boolean Naming Convention

┌──────────────────────────────────────────────┐
│  <service>_<action>_<resource>               │
│                                              │
│  httpd_can_network_connect                   │
│  │      │   │       │                        │
│  │      │   │       └─ what                  │
│  │      │   └───────── how                   │
│  │      └───────────── permission            │
│  └──────────────────── service               │
└──────────────────────────────────────────────┘

Summary

Item	Value
List booleans	`getsebool -a`
Descriptions	`semanage boolean -l`
Modified only	`semanage boolean -l -C`
Runtime change	`setsebool <name> on`
Persistent change	`setsebool -P <name> on`
HTTP outbound	`httpd_can_network_connect`
HTTP database	`httpd_can_network_connect_db`
HTTP home dirs	`httpd_enable_homedirs`
Samba home dirs	`samba_enable_home_dirs`

Key takeaways:

A boolean is a policy switch. It enables or disables a specific set of rules without recompiling the policy. The names are defined by the policy authors and follow the <service>_<action>_<resource> convention .
setsebool is runtime; setsebool -P is persistent. Without the -P flag, the change is lost on reboot. The -P flag writes the change to the policy’s persistent store.
The semanage boolean -l shows the descriptions. The getsebool -a only shows the names and values. The semanage output includes the default state and the description.
The -C flag shows only modified booleans. The semanage boolean -l -C is the audit view: it shows which booleans the administrator has changed from their defaults.
The common booleans solve the common problems. The httpd_can_network_connect for outbound connections. The httpd_can_network_connect_db for database connections. The httpd_enable_homedirs for reading user home directories. The samba_enable_home_dirs for Samba sharing.

Remember: The boolean is the switch. The getsebool is the view. The setsebool is the change. The -P is the persistence. The semanage is the description. The common booleans are the common fixes. The exam tests the -P flag and the boolean names.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!