What are SELinux booleans and how do you manage them?

Booleans are named on/off toggles that flip pre-written chunks of policy without recompiling it — e.g. setsebool -P httpd_enable_homedirs on lets Apache serve files from users' home directories. The -P makes the change survive reboot.

They exist so admins can adjust common policy decisions safely: the policy author ships an optional rule guarded by a boolean, and you decide whether to enable it. Without -P, setsebool changes only the running kernel and reverts on reboot; -P writes it to disk too. Inspect with getsebool -a (all) or getsebool name; the name usually hints at what it unlocks, and man <service>_selinux (e.g. man httpd_selinux) documents each one.

List all booleans:

getsebool -a

Check specific boolean:

getsebool httpd_enable_homedirs

Set boolean (temporary - until reboot):

setsebool httpd_enable_homedirs on

Set boolean (permanent):

setsebool -P httpd_enable_homedirs on

Find service-specific booleans:

# List SELinux man pages
man -k '_selinux'
# Apache-specific SELinux info
man httpd_selinux

Example output:

[root@host ~]# getsebool -a
abrt_anon_write --> off
abrt_handle_event --> off
httpd_enable_homedirs --> off
...

Tip: Boolean names often indicate their purpose (e.g., httpd_enable_homedirs allows Apache to access home directories).

Go deeper:

• setsebool(8) — booleans and the -P persist flag — -P writes booleans to the on-disk policy so they survive reboot.