SELinux booleans.
Before you write a custom SELinux policy, check if there's already a switch for it. Booleans are named on/off toggles that enable or disable whole pre-written chunks of policy — like 'let Apache talk to the network' — at runtime, no recompile needed.
SELinux booleans animated tutorial. Runtime policy switches, getsebool, setsebool, persistent changes with -P, semanage boolean -l, common booleans like httpd_can_network_connect, and the denial-troubleshooting workflow. RHCSA EX200 ready.SELinux ships with rules for hundreds of common situations, turned off by default. A boolean is the switch that turns one of those rule sets on — no custom policy required.
- ·The SELinux contexts lesson (what type enforcement is)
- ·Comfortable running commands as root / with sudo
- ·Know that SELinux can block a working-looking service
Read a boolean's state, flip it persistently with setsebool -P, discover the right boolean for a service, and use audit2why to find which one a denial needs.
pace: 8 minutes
httpd_can_network_connectoffhttpd_enable_homedirsoffftpd_anon_writeoffnfs_export_all_rwoffsamba_enable_home_dirsoffA boolean is a switch over pre-written policy
The SELinux policy that ships with RHEL already contains rules for hundreds of common situations — they're just turned OFF by default for safety. A boolean is a named on/off switch that flips one of those rule sets on or off at runtime, no policy recompile, no custom modules. Before writing any custom policy, always ask: is there already a boolean for this?
The SELinux fix hierarchy: boolean → label → custom module, in that order. Most "SELinux is blocking my service" problems are solved by a single setsebool -P. And never forget the -P — a runtime-only flip is a time bomb that detonates at the next reboot.
$getsebool BOOL$getsebool -a$getsebool -a | grep httpd$setsebool BOOL on$setsebool -P BOOL on$semanage boolean -l$semanage boolean -l -C$ausearch -m AVC -ts recent$audit2why -al$httpd_can_network_connect$httpd_enable_homedirs$httpd_can_sendmail$ftpd_anon_write$nfs_export_all_rw$samba_enable_home_dirs$ssh_sysadm_loginApache (httpd) needs to connect to a database on another server, but SELinux is blocking it. What should you try FIRST?
You run `setsebool httpd_can_network_connect on` (no -P) and it works. Three weeks later after a reboot, Apache breaks again. Why?
Which command shows every boolean WITH its current state, default state, and a description?
What's the advantage of a boolean over writing a custom SELinux policy module?
These aren't graded — they're just for active recall, which is what actually makes the lesson stick.
SELinux contexts
Booleans toggle policy; contexts (labels) decide what can touch what. When a boolean isn't the fix, a wrong file label usually is — learn to read and restore them.
Read this lesson as text6 chapters · quiz answers
01A boolean is a switch over pre-written policy
The SELinux policy that ships with RHEL already contains rules for hundreds of common situations — they're just turned OFF by default for safety. A boolean is a named on/off switch that flips one of those rule sets on or off at runtime, no policy recompile, no custom modules. Before writing any custom policy, always ask: is there already a boolean for this?
02getsebool — read the current state
getsebool <name>shows whether one boolean is on or off.getsebool -alists every boolean on the system (there are hundreds).semanage boolean -lis even better — it shows the current state, the default state, AND a human description of what each one does.$ getsebool httpd_can_network_connect— → ...off$ getsebool -a— list all booleans$ getsebool -a | grep httpd— just the httpd ones
03setsebool — flip it (runtime only)
setsebool httpd_can_network_connect onflips the switch immediately — Apache can now make outbound connections (e.g. to a database or an API on another host). BUT this change lives only in memory: it reverts on the next reboot. Useful for testing, dangerous if you forget it isn't permanent.$ setsebool httpd_can_network_connect on— flip ON (this boot only)$ setsebool httpd_can_network_connect off— flip back OFF
04Make it stick — the -P flag
Add -P (Persistent) and the change is written to disk so it survives reboots:
setsebool -P httpd_can_network_connect on. -P is a little slower because it rebuilds the policy, but for any real configuration you ALWAYS want it. The classic production bug: someone runs setsebool without -P, it works, then the service breaks weeks later after a reboot.$ setsebool -P httpd_can_network_connect on— ON, survives reboot$ semanage boolean -l | grep httpd_can_net— verify current vs default
05Finding the right boolean
You rarely memorize boolean names. Discover them:
getsebool -a | grep <keyword>orsemanage boolean -l | grep <keyword>. Searching for the service name (httpd, ftpd, nfs, samba) usually surfaces the switch you need. The descriptions insemanage boolean -ltell you exactly what each does.$ semanage boolean -l— all booleans + state + description$ semanage boolean -l | grep ftp— FTP-related switches$ sepolicy booleans -a— richer descriptions
06The denial → boolean workflow
When a service is denied by SELinux: (1) confirm it's SELinux with
ausearch -m AVC -ts recent; (2) runaudit2why -al— for many denials it literally says 'this can be allowed by setting the X boolean'; (3) flip that boolean withsetsebool -P. Booleans are the FIRST thing to try — far safer than relabeling files or writing a custom module.$ ausearch -m AVC -ts recent— find the denial$ audit2why -al— often names the boolean to set$ setsebool -P <boolean> on— apply the fix permanently
Quiz — answers
- Apache (httpd) needs to connect to a database on another server, but SELinux is blocking it. What should you try FIRST?
- →Check for and enable a boolean: setsebool -P httpd_can_network_connect on.There's almost always a boolean for common needs. httpd_can_network_connect is exactly this case. Booleans are the safest, simplest fix — reach for them before relabeling, custom modules, or (never) disabling SELinux.
- You run
setsebool httpd_can_network_connect on(no -P) and it works. Three weeks later after a reboot, Apache breaks again. Why? - →Without -P, setsebool changes only the in-memory value — it reverts to the default on reboot. You needed setsebool -P to persist it.-P (Persistent) writes the change to disk so it survives reboots. Without it, the change is runtime-only. This is one of the most common 'it worked then mysteriously broke' SELinux bugs.
- Which command shows every boolean WITH its current state, default state, and a description?
- →semanage boolean -l
getsebool -alists names and on/off only.semanage boolean -ladds the default state and a human-readable description — the best tool for discovering what a boolean actually does. - What's the advantage of a boolean over writing a custom SELinux policy module?
- →A boolean toggles pre-written, vendor-tested policy at runtime with no recompile — it's simpler, safer, and survives policy updates, whereas a custom module is more to maintain and can drift.Booleans are maintained by the distro and cover the common cases. They're a one-command, well-understood change. Custom modules are powerful but a last resort — more surface area to maintain and easier to get subtly wrong.
keep going — these pair well with what you just learned.
How SSH key auth works
The six-step handshake — key offer, challenge, signature, verification, channel open. Watch an animated client/server diagram light up each arrow.
TLS handshake, deep
Open every TLS 1.3 message — ClientHello, ServerHello, Certificate, CertificateVerify, Finished. Cipher suites, HKDF key derivation, SNI, ALPN, and why TLS 1.3 has built-in perfect forward secrecy.