21.2 Use Boolean Settings to Modify SELinux Settings

21.2 Use Boolean Settings to Modify SELinux Settings

Quick Answer: Query with getsebool -a / getsebool NAME. Enable or disable with setsebool NAME on|off. Persist across reboot with setsebool -P NAME on|off. Find candidates via getsebool -a | grep http (or the service name). Use ausearch/sealert when unsure which boolean applies. Leave the system Enforcing.

Why booleans are an EX200 skill

Under Manage security, Red Hat expects you to use Boolean settings to modify SELinux settings. Lab language looks like:

• “Allow the web server to make outbound network connections (for example to a database or API).”
• “Enable SELinux so Apache can serve users’ public_html content.”
• “Allow NFS export behavior required by the lab without disabling SELinux.”
• “Make the boolean change persistent across reboot.”

Booleans are named switches shipped with the distribution policy. Turning one on expands what a confined domain may do; turning it off tightens behavior. You do not hand-write .te policy modules on RHCSA—you flip the boolean the policy author already provided.

Contrast with Section 21.1:

Many real failures need both a context fix and a boolean—read denials carefully.

getsebool: list and query

getsebool -a                    # all booleans and current values
getsebool httpd_can_network_connect
getsebool -a | grep httpd
getsebool -a | grep nfs
getsebool -a | grep ftp

Output shape:

httpd_can_network_connect --> off
httpd_enable_homedirs --> off
nfs_export_all_rw --> on

Do not memorize hundreds of names. Memorize the workflow: reproduce under Enforcing → read denial / sealert → grep booleans → setsebool -P → retest.

# How many booleans exist? (curiosity; not needed on exam)
getsebool -a | wc -l

setsebool: change values

# Runtime only (until reboot) — good for testing
sudo setsebool httpd_can_network_connect on

# Persistent (survives reboot) — what EX200 almost always wants
sudo setsebool -P httpd_can_network_connect on

# Turn off persistently
sudo setsebool -P httpd_enable_homedirs off

# Multiple persistent changes
sudo setsebool -P httpd_can_network_connect=on httpd_can_network_relay=on
getsebool httpd_can_network_connect httpd_can_network_relay

Exam trap: Forgetting -P. The boolean looks correct now, fails after reboot, and EX200 grades persistent configuration. Always prefer setsebool -P unless you are deliberately testing.

getsebool httpd_can_network_connect
sudo setsebool -P httpd_can_network_connect on
getsebool httpd_can_network_connect

semanage boolean (alternate interface)

sudo semanage boolean -l
sudo semanage boolean -l | grep httpd_can_network
sudo semanage boolean -m --on httpd_can_network_connect
sudo semanage boolean -m --off httpd_can_network_connect

semanage boolean -l shows default vs current in some output formats—handy when verifying local overrides. setsebool -P remains the most common training path for RHCSA speed; either persistent method is fine if the end state is correct.

sudo semanage boolean -l -C    # customized booleans when supported

High-frequency booleans (examples to know by pattern)

Exact availability can depend on installed policy modules; always confirm with getsebool on the exam host. These names appear constantly in RHEL web/NFS/FTP labs:

HTTP / Apache family

getsebool -a | grep httpd
sudo setsebool -P httpd_can_network_connect on
sudo setsebool -P httpd_enable_homedirs on
sudo systemctl restart httpd    # when testing behavior

Classic scenario: PHP/app on httpd must reach MariaDB on another host. DocumentRoot context may already be correct; the missing piece is often httpd_can_network_connect (or the DB-specific boolean if the denial names it).

NFS / file sharing family

getsebool -a | grep -i nfs
sudo setsebool -P nfs_export_all_rw on

FTP / SSH / misc patterns

getsebool -a | grep ftp
getsebool -a | grep ssh
# Examples often seen in training materials:
# ftpd_full_access, ssh_chroot_rw_homedirs, etc.—verify names on the system

Rule: The boolean name is usually service_capability in snake_case. Grep the service prefix first.

When to use a boolean vs a port label vs a file context

Service won't BIND a non-default port     → semanage port (21.1)
Service can't READ/WRITE a path           → fcontext + restorecon (20.x)
Service can't perform OPTIONAL behavior   → setsebool -P (this section)
  e.g. connect out, use NFS, serve homedirs

If you enable random booleans without evidence, you widen policy more than needed. Prefer the narrow fix sealert or the denial suggests.

Troubleshooting with ausearch and sealert

getenforce
sudo ausearch -m avc -ts recent
sudo ausearch -m avc -ts recent | less

# setroubleshoot / sealert path (when installed)
sudo sealert -a /var/log/audit/audit.log

sealert often prints a suggested boolean and a ready-to-run setsebool -P ... line. That is gold under time pressure—verify the suggestion matches the task, then apply it.

# Workflow
# 1) Trigger the failing action (curl page, mount, export, etc.)
# 2) Read denials
sudo ausearch -m avc -ts recent
# 3) If sealert available, follow its boolean advice
# 4) Apply persistently
sudo setsebool -P suggested_boolean on
# 5) Retest under Enforcing
getenforce
getsebool suggested_boolean

Also check service logs:

sudo journalctl -u httpd -e --no-pager
sudo tail -n 50 /var/log/httpd/error_log

Permission denied / connection refused mixed with AVC lines usually means stack the fixes: network/firewall, file context, port type, and boolean as indicated.

setroubleshoot awareness

On full GUI or richly installed systems, setroubleshoot may log friendly messages in the journal pointing at sealert. Minimal exam images might have thinner tooling—ausearch always remains the core skill; sealert when present accelerates boolean discovery.

rpm -q setroubleshoot-server setroubleshoot-plugins 2>/dev/null

Persistence verification mindset

sudo setsebool -P httpd_can_network_connect on
getsebool httpd_can_network_connect
sudo semanage boolean -l | grep httpd_can_network_connect

After practice reboots in a lab:

getenforce
getsebool httpd_can_network_connect
# must still be on if -P was used

If a boolean reverts, you likely used setsebool without -P.

Exam workflows

Workflow A — Allow httpd outbound connects (persistent)

getsebool httpd_can_network_connect
sudo setsebool -P httpd_can_network_connect on
getsebool httpd_can_network_connect
# exercise the app feature that opens a backend TCP connection

Workflow B — Serve public_html / home content

getsebool httpd_enable_homedirs
sudo setsebool -P httpd_enable_homedirs on
# ensure home public_html exists, permissions, and correct SELinux file contexts
sudo systemctl reload httpd

File contexts for user content may still need httpd_user_content_t (or related) via restorecon/fcontext—boolean alone is not always sufficient.

Workflow C — Web content on NFS

getsebool httpd_use_nfs
sudo setsebool -P httpd_use_nfs on
getsebool httpd_use_nfs
# mount NFS export; fix fcontext if content types still wrong

Workflow D — Denial → boolean

sudo ausearch -m avc -ts recent
# note denied capability / suggested bool
getsebool -a | grep httpd
sudo setsebool -P httpd_can_network_connect on
getenforce

Workflow E — Turn something off if the task requires hardening

sudo setsebool -P httpd_enable_homedirs off
getsebool httpd_enable_homedirs

Most tasks enable features; read carefully if the requirement is to disable a boolean.

Common traps

1. setsebool without -P — works until reboot, then fails grading.
2. Enabling a boolean but leaving file contexts or port types wrong.
3. Guessing boolean names without getsebool -a | grep.
4. Setting Permissive or disabled instead of the boolean.
5. Fixing firewalld only when the denial is clearly SELinux.
6. Applying unrelated booleans broadly “just in case.”
7. Forgetting to retest the application after the change.
8. Confusing httpd_can_network_connect (outbound) with port labels (bind).
9. Ignoring sealert suggestions when available.
10. Assuming boolean changes require editing /etc/selinux/config — they do not.

Relationship to other sections

Section checkpoint

You should discover booleans with getsebool -a | grep, read values with getsebool NAME, enable or disable with setsebool, make exam-grade lasting changes with setsebool -P, recognize common httpd_* and NFS-related toggles (especially httpd_can_network_connect), and use ausearch/sealert to pick the right switch—while keeping SELinux Enforcing. That meets the EX200 objective to use Boolean settings to modify SELinux settings on RHEL 10.