booleans(8)

💖 booleans — the SELinux glow-up page 💖

okay bestie, you found the booleans page in section 8 of the SELinux Command Line documentation, and honestly? this one is a bop. let's get into it. 🦋

✨ NAME ✨

booleans — policy booleans let you customize SELinux policy at runtime, no reboot required. periodt. 💅

🌸 DESCRIPTION 🌸

so here's the tea. the SELinux policy can have conditional rules in it, and those rules flip on or off depending on whatever the current values of a set of policy booleans happen to be. which means you can mod the security policy while the system is running without loading a whole new policy. no cap, that's the whole point. ✨

for example — and this is the example the original gives so we're keeping it — the boolean httpd_enable_cgi lets the httpd daemon run cgi scripts if it's enabled. and if the admin does not want cgi scripts executing? they just disable this boolean value. simple as. 🙈

the policy defines a default value for each boolean, typically false. those defaults can be overridden through local settings made with the setsebool(8) utility, and you use -P to make that setting persistent across reboots (yes bestie, -P is the one that actually sticks around 💀). the system-config-securitylevel tool gives you a whole graphical interface for changing the settings if clicking is more your vibe. and the load_policy(8) program will preserve your current boolean settings when it reloads a policy, by default — or it can optionally reset booleans back to the boot-time defaults via the -b option. your call, main character. 👑

you can list out all the boolean values with the getsebool(8) utility, just hand it the -a option. easy. ⭐

and you can also change boolean values at runtime via setsebool(8) or togglesebool(8). but lowkey important: by default these utilities only change the current boolean value and do not touch the persistent settings — unless you use the -P option with setsebool. so if you want it to survive a reboot, you know what to do. 🫶

ngl, forgetting -P and then wondering why your setting ghosted you after a reboot is a rite of passage. don't be that girl. 💀

👑 AUTHOR 👑

this manual page was written by Dan Walsh <dwalsh@redhat.com>. and the SELinux conditional policy support was developed by Tresys Technology. icons, both of them. 🎀

🔥 SEE ALSO 🔥

• getsebool(8)
• setsebool(8)
• selinux(8)
• togglesebool(8)

and that's the whole page, bestie, you ate it. 🍓 this little beauty is signed off by <dwalsh@redhat.com> and it's been iconic since 11 Aug 2004 — yeah, this page is older than most of us and still serving booleans(8) energy. slay. 💜🌈