How to Retrieve SELinux Boolean Values Using 'getsebool' (with examples)

SELinux, or Security-Enhanced Linux, is an advanced security mechanism integrated into certain Linux distributions. It works as a set of kernel modifications and supporting tools to ensure enhanced security policies are enforced across the system. SELinux uses booleans to allow users to toggle features that can alter the security policy. The getsebool command is a tool used to retrieve the current status of these SELinux boolean values. It helps administrators understand and manage the intricate SELinux security settings more effectively.

Use case 1: Show the current setting of a boolean

Code:

getsebool httpd_can_connect_ftp

Motivation: In a heavily regulated environment where SELinux is enforced, it’s essential for system administrators to verify the current security policies of individual services. Suppose you need to ensure that the Apache HTTP Server (httpd) on your system can securely connect to an FTP server. The boolean httpd_can_connect_ftp controls this capability in SELinux. By checking its status using getsebool, one can confirm whether outgoing FTP connections from HTTP are possible, aiding both compliance checks and troubleshooting efforts.

Explanation:

• getsebool: The base command used to retrieve the SELinux boolean value.
• httpd_can_connect_ftp: This is the specific SELinux boolean you are querying. It relates to whether the HTTP server is allowed to make FTP connections from the web server, which is crucial to validate for systems that might need to interact with external FTP resources.

Example Output:

httpd_can_connect_ftp --> off

This output indicates that the boolean value is set to ‘off’, meaning the HTTP server is currently not permitted to establish FTP connections.

Use case 2: Show the current setting of all booleans

Code:

getsebool -a

Motivation: Administrators and security professionals might require a comprehensive overview of all existing SELinux booleans to audit system-wide SELinux security policies. By invoking getsebool -a, one can conveniently list the current state of all SELinux policy booleans. This comprehensive visibility is fundamental for system review, policy planning, and preparing consistency with security baselines.

Explanation:

• getsebool: The command to fetch SELinux boolean values.
• -a: This flag tells getsebool to list all SELinux booleans, together with their current on/off status. This option provides a complete picture, useful for auditing and ensuring systemic security compliance.

Example Output:

allow_console_login --> off
allow_cvs_read_shadow --> off
allow_daemons_dump_core --> on
...

This output lists various boolean settings on your system, indicating whether functionalities are enabled (‘on’) or disabled (‘off’).

Use case 3: Show the current setting of all booleans with explanations

Code:

sudo semanage boolean --list

Motivation: While the getsebool -a command provides a comprehensive list of SELinux boolean states, it does not provide context as to what each boolean controls. The semanage boolean --list command, executed with elevated privileges, enhances this list by including explanations. This allows administrators to not only know the status but also understand the purpose and implications of each boolean. This is especially useful for crafting or explaining a detailed security policy.

Explanation:

• sudo: Using sudo grants the necessary privilege to run semanage, which might otherwise be restricted to the root user.
• semanage: A tool provided by SELinux to manage various policy settings such as booleans, ports, users, etc.
• boolean: Sub-command specifically used to manage SELinux boolean settings.
• --list: This option directs semanage to list all booleans, along with their status and a description of their function.

Example Output:

SELinux boolean                State  Description
allow_console_login        (off  ,   allow login from console)
allow_cvs_read_shadow   (off  ,   allow cvs to read shadow)
allow_daemons_dump_core (on   ,   allow all daemons to dump core)
...

The output gives a thorough insight into each boolean, providing both the state and a short description, which aids understanding and policy development.

Conclusion:

The getsebool command, alongside its companion commands, is crucial for managing and understanding SELinux policies. By providing insight into the status of SELinux booleans and their implications for system security, getsebool helps in maintaining robust security configurations, ensuring that administrators can both audit and optimize their security settings effectively.