🔘 SELinux Booleans

See what booleans exist and what state they are currently in:

# List ALL booleans and their current state
getsebool -a

# Check a specific boolean
getsebool httpd_can_network_connect
getsebool httpd_can_network_connect_db

# Filter — find all httpd-related booleans
getsebool -a | grep httpd

# Find all booleans that are currently ON
getsebool -a | grep " on$"

# Find all booleans that are currently OFF
getsebool -a | grep " off$"

# Count total booleans on the system
getsebool -a | wc -l

Two forms — runtime only, or persistent across reboots:

# Runtime only — takes effect immediately, lost on reboot
sudo setsebool httpd_can_network_connect on
sudo setsebool httpd_can_network_connect off

# Persistent — survives reboots (-P flag)
sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_can_network_connect off

# Set multiple booleans at once
sudo setsebool -P httpd_can_network_connect on \
                  httpd_can_network_connect_db on \
                  httpd_can_sendmail on

# Verify
getsebool httpd_can_network_connect

semanage boolean -l gives you the human-readable description of each boolean — far more useful than the name alone:

# List all booleans with descriptions
sudo semanage boolean -l

# Filter to a service
sudo semanage boolean -l | grep -i httpd
sudo semanage boolean -l | grep -i ftp
sudo semanage boolean -l | grep -i samba
sudo semanage boolean -l | grep -i nfs

# Show only booleans that differ from default
sudo semanage boolean -l -C

# Set persistent boolean via semanage (alternative to setsebool -P)
sudo semanage boolean -m --on httpd_can_network_connect

The most commonly needed httpd booleans for web server administration:

# Allow Apache to make outbound network connections (APIs, proxying)
sudo setsebool -P httpd_can_network_connect on

# Allow Apache to connect to databases (MySQL, PostgreSQL, etc.)
sudo setsebool -P httpd_can_network_connect_db on

# Allow Apache to send email (contact forms, notifications)
sudo setsebool -P httpd_can_sendmail on

# Allow Apache to serve content from user home directories (~user/public_html)
sudo setsebool -P httpd_enable_homedirs on

# Allow Apache to read user home directory content
sudo setsebool -P httpd_read_user_content on

# Allow Apache to use NFS-mounted content
sudo setsebool -P httpd_use_nfs on

# Allow Apache to use Samba/CIFS-mounted content
sudo setsebool -P httpd_use_cifs on

# Allow CGI scripts to be executed
sudo setsebool -P httpd_enable_cgi on

# Allow Apache to connect to FTP servers
sudo setsebool -P httpd_can_connect_ftp on

# FTP — allow users to access home directories via FTP
sudo setsebool -P ftp_home_dir on

# FTP — allow anonymous FTP write access
sudo setsebool -P allow_ftpd_anon_write on

# FTP — allow FTP to read/write files on CIFS/Samba shares
sudo setsebool -P allow_ftpd_use_cifs on

# FTP — allow FTP to use NFS mounts
sudo setsebool -P allow_ftpd_use_nfs on

# Samba — allow Samba to share home directories
sudo setsebool -P samba_enable_home_dirs on

# Samba — allow Samba to export any file/directory
sudo setsebool -P samba_export_all_rw on

# NFS — allow NFS to export home directories
sudo setsebool -P use_nfs_home_dirs on

# Verify all Samba booleans
getsebool -a | grep samba

# Allow SSH to use SSH keys for authentication (usually already on)
getsebool ssh_sysadm_login

# Allow cron jobs to use NFS home directories
sudo setsebool -P cron_can_relabel on

# Allow staff/sysadm roles to run in unconfined mode (for admin work)
sudo setsebool -P ssh_sysadm_login on

# Allow rsync to read/write samba content
sudo setsebool -P rsync_use_cifs on

# Allow system mail daemon to use LDAP
sudo setsebool -P allow_postfix_local_write_mail_spool on

# Allow virt (KVM/QEMU) to use NFS
sudo setsebool -P virt_use_nfs on

# Allow containers to use all network ports
sudo setsebool -P container_use_devices on

# List all booleans that are currently ON (non-default)
sudo semanage boolean -l -C | grep "on  ,"

When something is blocked and you suspect a boolean is needed, here is the diagnostic workflow:

# Step 1 — Check audit log for the denial
sudo ausearch -m avc -ts recent | tail -20

# Step 2 — Use audit2why to get a plain-English explanation
sudo ausearch -m avc -ts recent | audit2why

# Step 3 — audit2why will often suggest the exact boolean needed
# Example output from audit2why:
#   Was caused by:
#   The boolean httpd_can_network_connect was set incorrectly.
#   Description: Allow httpd to make any network connection
#   Allow access by executing: setsebool -P httpd_can_network_connect 1

# Step 4 — Search booleans by keyword if audit2why doesn't suggest one
sudo semanage boolean -l | grep -i "network connect"
sudo semanage boolean -l | grep -i "mail"
sudo semanage boolean -l | grep -i "home"

# Step 5 — Test with runtime change first (no -P)
sudo setsebool httpd_can_network_connect on

# Step 6 — If that fixes it, make it permanent
sudo setsebool -P httpd_can_network_connect on

Good practice — document what booleans have been changed from default and why:

#!/bin/bash
# selinux-boolean-audit.sh
# Report all non-default boolean settings on this system

echo "========================================"
echo " SELinux Boolean Audit — $(hostname)"
echo " $(date)"
echo "========================================"
echo ""
echo "Booleans changed from default:"
echo ""

sudo semanage boolean -l -C | \
    awk 'NR>1 {printf "  %-45s Current: %s  Default: %s\n", $1, $2, $3}'

echo ""
echo "Total non-default booleans: $(sudo semanage boolean -l -C | tail -n +2 | wc -l)"
echo ""

# Save to file for documentation
sudo semanage boolean -l -C > /root/selinux-booleans-$(date +%Y%m%d).txt
echo "Saved to /root/selinux-booleans-$(date +%Y%m%d).txt"