How to use the command `semanage boolean` (with examples)

The semanage boolean command is an essential tool for managing persistent SELinux boolean settings. SELinux (Security-Enhanced Linux) is a powerful security mechanism integrated into the Linux kernel. It uses policies to enforce mandatory access control. Booleans in SELinux provide a way to dynamically adjust the security policies without having to load new policy modules, offering an easy mechanism to enable or disable specific security checks or behaviors.

Use case 1: Listing all boolean settings

Code:

sudo semanage boolean -l

Motivation:

Listing all boolean settings using sudo semanage boolean -l provides a complete overview of the tunable parameters in your system’s security policies. This information is crucial for system administrators who need to understand the security posture of their system, identify which SELinux settings are available, and determine their current status, i.e., whether they are enabled or disabled. This helps admins make informed decisions about changes required for the specific needs of their applications or environment.

Explanation:

• sudo: Executes the command with administrative privileges necessary for viewing SELinux settings.
• semanage: The command-line tool used to manage SELinux policies, in this case, the boolean settings.
• boolean: A specific type of SELinux policy element that can be turned on or off.
• -l (or --list): This option lists all SELinux booleans, displaying their current state (on or off) and description.

Example output:

SELinux boolean                State  Default Description
ftp_home_dir                  (off   ,  off)  Allow ftp to read and write files in the user home directory
httpd_enable_cgi              (on    ,  on)   Allow all cgi scripts to run
httpd_enable_homedirs         (off   ,  off)  Allow httpd to read home directories

Use case 2: Listing all user-defined boolean settings without headings

Code:

sudo semanage boolean -l -C -n

Motivation:

The necessity to quickly identify booleans modified from their default settings can be fulfilled with this command. By displaying only those settings that have been altered (also called “user-defined” settings) without headers, the output is concise and easier to parse. This use case is useful in scenarios where an administrator needs to verify changes or audit the security state after deploying updates or new applications.

Explanation:

• sudo: Required to perform operations with superuser privileges.
• semanage boolean: Manages the SELinux boolean settings.
• -l (or --list): Lists SELinux booleans that have been set by users, not just default ones.
• -C (or --locallist): Filters the list to only show settings modified locally by the user.
• -n (or --noheading): Suppresses the heading from the output, facilitating easier parsing for scripts or further processing.

Example output:

httpd_can_network_connect     (on    ,  on)
mysql_connect_any             (on    ,  on)

Use case 3: Set or unset a boolean persistently

Code:

sudo semanage boolean -m --on haproxy_connect_any

Motivation:

Modifying a SELinux boolean setting persistently is often required when configuring services to allow or deny specific operations across system reboots. For instance, an administrator configuring haproxy may need it to connect to any network address. The modification needs to be persistent to sustain after a reboot, ensuring that the configuration retains security guarantees and operational continuity without requiring manual intervention after each system restart.

Explanation:

• sudo: Grants the necessary permissions to modify SELinux settings.
• semanage boolean: Targets SELinux boolean settings for modification.
• -m (or --modify): Indicates an intention to change or modify an existing boolean setting.
• --on (or -1): Represents enabling the specified boolean persistently across reboots.
• haproxy_connect_any: This is the specific SELinux boolean to modify, which when enabled, allows HAProxy to establish network connections.

Example output:

There is typically no output when running the command successfully. To verify the change, you would list the booleans again to see if haproxy_connect_any is set to “on.”

Conclusion:

The semanage boolean command provides critical functionality for managing SELinux security settings efficiently, giving system administrators control over enabling and disabling policy toggles. Each use case showcases a vital aspect of ensuring the system’s security configuration aligns with operational needs while maintaining the integrity of enforced policies.