Managing SELinux Booleans Using setsebool

Security-Enhanced Linux (SELinux) booleans act as dynamic switches that enable or disable specific policy rules at runtime without requiring custom policy compilation. The Linux operating system manages these toggles primarily through the setsebool utility, allowing administrators to modify system behavior—such as permitting a web server to connect to a remote database or access user home directories. This guide explains how SELinux booleans work, how to view their current states, and how to use setsebool to apply both temporary and persistent policy modifications.

Understanding SELinux Booleans

In SELinux, a boolean is a simple conditional rule represented as either on (1, true) or off (0, false). Booleans provide a modular way to tune access controls. Instead of writing and compiling a new policy module to allow a service to perform an uncommon action, administrators can simply flip a predefined boolean flag.

Checking Current Boolean States

Before modifying a boolean, administrators use the getsebool command to inspect its current status:

# View the state of a specific boolean
getsebool httpd_can_network_connect_db

# View all available booleans and their states
getsebool -a

To view descriptions of what each boolean controls, the semanage boolean -l command provides detailed documentation along with the current and default states.

Applying Temporary Changes with setsebool

When troubleshooting or testing, changes can be made strictly in system memory. These changes take effect immediately but revert to their previous configuration when the system reboots.

To temporarily change a boolean value, pass the boolean name and the desired state (on, off, 1, or 0) to setsebool:

sudo setsebool httpd_can_network_connect_db on

In this mode, the Linux kernel updates the active SELinux policy loaded in RAM. The policy files stored on the disk remain untouched.

Applying Persistent Changes with the -P Flag

To ensure that a boolean setting survives a system reboot, the -P (persistent) flag must be included.

sudo setsebool -P httpd_can_network_connect_db on

When the -P flag is supplied:

  1. Memory Update: The kernel updates the active policy immediately, just as it does in temporary mode.
  2. Policy Store Update: The command updates the SELinux policy store located on the disk (typically under /etc/selinux/targeted/active/ or /var/lib/selinux/).
  3. Recompilation: The system rebuilds the policy binary to ensure the new default state is loaded automatically during subsequent system boots.

Because rebuilding the policy store requires disk I/O and cryptographic validation, executing setsebool -P takes a few seconds longer than a non-persistent command.

Verifying Changes

After executing the command, verify that the new state is active:

getsebool httpd_can_network_connect_db

If the change was persistent, semanage boolean -l | grep httpd_can_network_connect_db will show the updated value in both the "Current" and "Default" columns.