SELinux Booleans

This lesson explains SELinux booleans and how to use them to adjust SELinux policy behavior without rewriting or rebuilding policies. SELinux booleans let administrators toggle specific policy rules on or off so services can be granted additional capabilities when needed — without disabling SELinux entirely. For example, a web server that is normally prevented from initiating outbound network connections can be allowed to do so by enabling the appropriate boolean.

Use SELinux booleans to grant controlled exceptions for services rather than turning off SELinux.

Quick overview

SELinux booleans toggle parts of the policy at runtime.
Runtime-only changes apply immediately but are lost at reboot unless persisted.
Two common tools:
- setsebool — change runtime state (optionally persist with -P).
- semanage boolean — view and change persistent settings with descriptions.

Checking SELinux mode

Confirm SELinux is running and in enforcing mode:

root@control:~# getenforce
Enforcing
root@control:~#

Listing all booleans

List all SELinux booleans and their current runtime state with getsebool -a:

root@control:~# getsebool -a
virt_use_rawip --> off
virt_use_samba --> off
virt_use_sanlock --> off
virt_use_usb --> on
virt_use_xserver --> off
virtqemud_use_execmem --> on
webadm_manage_user_files --> off
webadm_read_user_files --> off
wine_mmap_zero_ignore --> off
xdm_bind_vnc_tcp_port --> off
xdm_exec_bootloader --> off
xdm_manage_bootloader --> on
xdm_sysadm_login --> off
xdm_write_home --> off
xen_use_nfs --> off
xend_run_blktap --> on
xend_run_qemu --> on
xguest_connect_network --> on
xguest_exec_content --> on
xguest_mount_media --> on
xguest_use_bluetooth --> on
xserver_clients_write_xshm --> off
xserver_execmem --> off
xserver_object_manager --> off
zarafa_setrlimit --> off
zoneminder_anon_write --> off
zoneminder_run_sudo --> off
root@control:~#

To find booleans related to a specific service (for example, HTTPD), filter the output with grep:

root@control:~# getsebool -a | grep httpd
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_graceful_shutdown --> off
httpd_manage_ipa --> off
httpd_mod_auth_ntlm_winbind --> off
httpd_mod_auth_pam --> off
httpd_read_user_content --> off
httpd_run_ipa --> off
httpd_run_preupgrade --> off
httpd_run_stickshift --> off
httpd_serve_cobbler_files --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_sys_script_anon_write --> off
httpd_tmp_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_fusefs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
httpd_use_opencryptoki --> off
httpd_use_openstack --> off
httpd_use_sasl --> off
httpd_verify_dns --> off
root@control:~#

Changing booleans with setsebool

To change a boolean at runtime, use setsebool followed by the boolean name and on or off. By default, this affects only the running system and will be lost after a reboot. Examples (runtime-only):

root@control:~# setsebool httpd_enable_homedirs on
root@control:~# setsebool httpd_enable_homedirs off
root@control:~#

To make the change persistent across reboots when using setsebool, add the -P (uppercase P) option:

root@control:~# setsebool -P httpd_enable_homedirs on
root@control:~# setsebool -P httpd_enable_homedirs off
root@control:~#

Validate the current runtime state with:

root@control:~# getsebool -a | grep httpd_enable_homedirs
httpd_enable_homedirs --> on
root@control:~#

Remember: setsebool without -P changes only the current runtime state. Use -P to persist changes across reboots.

Inspecting booleans and descriptions with semanage

If you prefer a more descriptive listing that includes a short description and both runtime and persistent states, use:

root@control:~# semanage boolean -l
virt_use_rawip (off , off) Allow virt to use rawip
virt_use_samba (off , off) Allow virt to use samba
virt_use_sanlock (off , off) Allow virt to use sanlock
virt_use_usb (on , on) Allow virt to use usb
virt_use_xserver (off , off) Allow virt to use xserver
virtqemud_use_execmem (on , on) Allow virtqemud to use execmem
webadm_manage_user_files (off , off) Allow webadm to manage user files
webadm_read_user_files (off , off) Allow webadm to read user files
wine_mmap_zero_ignore (off , off) Allow wine to mmap zero ignore
xdm_bind_vnc_tcp_port (off , off) Allow xdm to bind vnc tcp port
xdm_exec_bootloader (off , off) Allow xdm to exec bootloader
xdm_manage_bootloader (on , on) Allow xdm to manage bootloader
xdm_sysadm_login (off , off) Allow xdm to sysadm login
xdm_write_home (off , off) Allow xdm to write home
xen_use_nfs (off , off) Allow xen to use nfs
xend_run_blktap (on , on) Allow xend to run blktap
xend_run_qemu (on , on) Allow xend to run qemu
xguest_connect_network (on , on) Allow xguest to connect network
xguest_exec_content (on , on) Allow xguest to exec content
xguest_mount_media (on , on) Allow xguest to mount media
xguest_use_bluetooth (on , on) Allow xguest to use bluetooth
xserver_clients_write_xshm (off , off) Allow xserver to clients write xshm
xserver_execmem (off , off) Allow xserver to execmem
xserver_object_manager (off , off) Allow xserver to object manager
zarafa_setrlimit (off , off) Allow zarafa to setrlimit
zoneminder_anon_write (off , off) Allow zoneminder to anon write
zoneminder_run_sudo (off , off) Allow zoneminder to run sudo
root@control:~#

In the semanage output, the first value in parentheses is the runtime state and the second is the persistent state (what will be applied after a reboot). You can filter semanage output the same way as getsebool:

root@control:~# semanage boolean -l | grep httpd
# (shows httpd-related booleans with runtime and persistent states and descriptions)

Changing booleans persistently with semanage

To modify a boolean persistently using semanage, use the -m option together with --on or --off. For example, to enable httpd_enable_homedirs persistently:

root@control:~# semanage boolean -m --on httpd_enable_homedirs

To disable it persistently:

root@control:~# semanage boolean -m --off httpd_enable_homedirs

Validate with semanage boolean -l | grep httpd_enable_homedirs or getsebool -a | grep httpd_enable_homedirs to confirm both runtime and persistent states.

Common commands (cheatsheet)

Purpose	Command
Check SELinux mode	`getenforce`
List runtime booleans	`getsebool -a`
Filter booleans	`getsebool -a \| grep <term>`
Change runtime boolean	`setsebool <boolean> on\|off`
Persist change with setsebool	`setsebool -P <boolean> on\|off`
List booleans with descriptions and persistent state	`semanage boolean -l`
Change persistent boolean with semanage	`semanage boolean -m --on\|--off <boolean>`

Summary

SELinux booleans let you toggle policy behavior without editing policies.
Use getsebool -a to list runtime boolean states and getsebool -a | grep <term> to filter.
Use setsebool <boolean> on|off to change the runtime state; add -P to persist with setsebool.
Use semanage boolean -l to list booleans with descriptions and both runtime and persistent values.
Use semanage boolean -m --on|--off <boolean> to change the persistent state via semanage.

You now know how to view and modify SELinux booleans to adjust service behavior safely, without disabling SELinux.

Introduction

Working with the Command Line

File Management

Working with Text Files

Output Redirection

User Management

Linux Permissions

Enhanced Command Line

Storage Management

Managing Services

Controlling the Boot Process

Scheduling Future Tasks

Working with Logs

Installing Software

Process Management & Tuning

Managing Network Configuration and Security

SELinux

Configuring SSH

Quick overview

Checking SELinux mode

Listing all booleans

Changing booleans with setsebool

Inspecting booleans and descriptions with semanage

Changing booleans persistently with semanage

Common commands (cheatsheet)

Summary

Links and references

Watch Video

​Quick overview

​Checking SELinux mode

​Listing all booleans

​Changing booleans with setsebool

​Inspecting booleans and descriptions with semanage

​Changing booleans persistently with semanage

​Common commands (cheatsheet)

​Summary

​Links and references

Watch Video

Quick overview

Checking SELinux mode

Listing all booleans

Changing booleans with setsebool

Inspecting booleans and descriptions with semanage

Changing booleans persistently with semanage

Common commands (cheatsheet)

Summary

Links and references