> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # SELinux Booleans > Explains SELinux booleans and how to view, change, and persist them to adjust policy behavior for services without disabling SELinux. This lesson explains SELinux booleans and how to use them to adjust SELinux policy behavior without rewriting or rebuilding policies. SELinux booleans let administrators toggle specific policy rules on or off so services can be granted additional capabilities when needed — without disabling SELinux entirely. For example, a web server that is normally prevented from initiating outbound network connections can be allowed to do so by enabling the appropriate boolean. Use SELinux booleans to grant controlled exceptions for services rather than turning off SELinux. ## Quick overview * SELinux booleans toggle parts of the policy at runtime. * Runtime-only changes apply immediately but are lost at reboot unless persisted. * Two common tools: * `setsebool` — change runtime state (optionally persist with `-P`). * `semanage boolean` — view and change persistent settings with descriptions. ## Checking SELinux mode Confirm SELinux is running and in enforcing mode: ```bash theme={null} root@control:~# getenforce Enforcing root@control:~# ``` ## Listing all booleans List all SELinux booleans and their current runtime state with `getsebool -a`: ```bash theme={null} root@control:~# getsebool -a virt_use_rawip --> off virt_use_samba --> off virt_use_sanlock --> off virt_use_usb --> on virt_use_xserver --> off virtqemud_use_execmem --> on webadm_manage_user_files --> off webadm_read_user_files --> off wine_mmap_zero_ignore --> off xdm_bind_vnc_tcp_port --> off xdm_exec_bootloader --> off xdm_manage_bootloader --> on xdm_sysadm_login --> off xdm_write_home --> off xen_use_nfs --> off xend_run_blktap --> on xend_run_qemu --> on xguest_connect_network --> on xguest_exec_content --> on xguest_mount_media --> on xguest_use_bluetooth --> on xserver_clients_write_xshm --> off xserver_execmem --> off xserver_object_manager --> off zarafa_setrlimit --> off zoneminder_anon_write --> off zoneminder_run_sudo --> off root@control:~# ``` To find booleans related to a specific service (for example, HTTPD), filter the output with `grep`: ```bash theme={null} root@control:~# getsebool -a | grep httpd httpd_enable_cgi --> on httpd_enable_ftp_server --> off httpd_enable_homedirs --> off httpd_execmem --> off httpd_graceful_shutdown --> off httpd_manage_ipa --> off httpd_mod_auth_ntlm_winbind --> off httpd_mod_auth_pam --> off httpd_read_user_content --> off httpd_run_ipa --> off httpd_run_preupgrade --> off httpd_run_stickshift --> off httpd_serve_cobbler_files --> off httpd_setrlimit --> off httpd_ssi_exec --> off httpd_sys_script_anon_write --> off httpd_tmp_exec --> off httpd_tty_comm --> off httpd_unified --> off httpd_use_cifs --> off httpd_use_fusefs --> off httpd_use_gpg --> off httpd_use_nfs --> off httpd_use_opencryptoki --> off httpd_use_openstack --> off httpd_use_sasl --> off httpd_verify_dns --> off root@control:~# ``` ## Changing booleans with setsebool To change a boolean at runtime, use `setsebool` followed by the boolean name and `on` or `off`. By default, this affects only the running system and will be lost after a reboot. Examples (runtime-only): ```bash theme={null} root@control:~# setsebool httpd_enable_homedirs on root@control:~# setsebool httpd_enable_homedirs off root@control:~# ``` To make the change persistent across reboots when using `setsebool`, add the `-P` (uppercase P) option: ```bash theme={null} root@control:~# setsebool -P httpd_enable_homedirs on root@control:~# setsebool -P httpd_enable_homedirs off root@control:~# ``` Validate the current runtime state with: ```bash theme={null} root@control:~# getsebool -a | grep httpd_enable_homedirs httpd_enable_homedirs --> on root@control:~# ``` Remember: `setsebool` without `-P` changes only the current runtime state. Use `-P` to persist changes across reboots. ## Inspecting booleans and descriptions with semanage If you prefer a more descriptive listing that includes a short description and both runtime and persistent states, use: ```bash theme={null} root@control:~# semanage boolean -l virt_use_rawip (off , off) Allow virt to use rawip virt_use_samba (off , off) Allow virt to use samba virt_use_sanlock (off , off) Allow virt to use sanlock virt_use_usb (on , on) Allow virt to use usb virt_use_xserver (off , off) Allow virt to use xserver virtqemud_use_execmem (on , on) Allow virtqemud to use execmem webadm_manage_user_files (off , off) Allow webadm to manage user files webadm_read_user_files (off , off) Allow webadm to read user files wine_mmap_zero_ignore (off , off) Allow wine to mmap zero ignore xdm_bind_vnc_tcp_port (off , off) Allow xdm to bind vnc tcp port xdm_exec_bootloader (off , off) Allow xdm to exec bootloader xdm_manage_bootloader (on , on) Allow xdm to manage bootloader xdm_sysadm_login (off , off) Allow xdm to sysadm login xdm_write_home (off , off) Allow xdm to write home xen_use_nfs (off , off) Allow xen to use nfs xend_run_blktap (on , on) Allow xend to run blktap xend_run_qemu (on , on) Allow xend to run qemu xguest_connect_network (on , on) Allow xguest to connect network xguest_exec_content (on , on) Allow xguest to exec content xguest_mount_media (on , on) Allow xguest to mount media xguest_use_bluetooth (on , on) Allow xguest to use bluetooth xserver_clients_write_xshm (off , off) Allow xserver to clients write xshm xserver_execmem (off , off) Allow xserver to execmem xserver_object_manager (off , off) Allow xserver to object manager zarafa_setrlimit (off , off) Allow zarafa to setrlimit zoneminder_anon_write (off , off) Allow zoneminder to anon write zoneminder_run_sudo (off , off) Allow zoneminder to run sudo root@control:~# ``` In the `semanage` output, the first value in parentheses is the runtime state and the second is the persistent state (what will be applied after a reboot). You can filter `semanage` output the same way as `getsebool`: ```bash theme={null} root@control:~# semanage boolean -l | grep httpd # (shows httpd-related booleans with runtime and persistent states and descriptions) ``` ## Changing booleans persistently with semanage To modify a boolean persistently using `semanage`, use the `-m` option together with `--on` or `--off`. For example, to enable `httpd_enable_homedirs` persistently: ```bash theme={null} root@control:~# semanage boolean -m --on httpd_enable_homedirs ``` To disable it persistently: ```bash theme={null} root@control:~# semanage boolean -m --off httpd_enable_homedirs ``` Validate with `semanage boolean -l | grep httpd_enable_homedirs` or `getsebool -a | grep httpd_enable_homedirs` to confirm both runtime and persistent states. ## Common commands (cheatsheet) | Purpose | Command | | - | - | | Check SELinux mode | `getenforce` | | List runtime booleans | `getsebool -a` | | Filter booleans | `getsebool -a \| grep ` | | Change runtime boolean | `setsebool on\|off` | | Persist change with setsebool | `setsebool -P on\|off` | | List booleans with descriptions and persistent state | `semanage boolean -l` | | Change persistent boolean with semanage | `semanage boolean -m --on\|--off ` | ## Summary * SELinux booleans let you toggle policy behavior without editing policies. * Use `getsebool -a` to list runtime boolean states and `getsebool -a | grep ` to filter. * Use `setsebool on|off` to change the runtime state; add `-P` to persist with `setsebool`. * Use `semanage boolean -l` to list booleans with descriptions and both runtime and persistent values. * Use `semanage boolean -m --on|--off ` to change the persistent state via `semanage`. You now know how to view and modify SELinux booleans to adjust service behavior safely, without disabling SELinux. ## Links and references * [SELinux Project — booleans](https://selinuxproject.org/page/Booleans) * [Red Hat SELinux User Guide — Booleans](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/) * [Fedora SELinux User Guide](https://docs.fedoraproject.org/) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.