An application or service developer writes an SELinux targeted policy to define the allowed

behavior of the targeted application. A developer can include optional application behavior

in the SELinux policy that can be enabled when the behavior is allowed on a specific system.

SELinux Booleans enable or disable the SELinux policy’s optional behavior. With Booleans,
you

can selectively tune the behavior of an application.

These optional behaviors are application-specific, and must be discovered and selected for

each targeted application. Service-specific Booleans are documented in that service’s

man page. For example, the web server httpd service has its httpd(8) man page, and an

httpd_selinux(8) man page to document its SELinux policy, including the supported process

types, file contexts, and the available Boolean-enabled behaviors. The SELinux man pages
are

provided in the selinux-policy-doc package.

Use the getsebool command to list available Booleans for the targeted policies on this
system,

and the current Boolean status. Use the setsebool command to enable or disable the
running

state of these behaviors. The setsebool -P command option makes the setting persistent by

writing to the policy file. Only privileged users can set SELinux Booleans.

[root@host ~]# getsebool -a

abrt_anon_write --> off

abrt_handle_event --> off

abrt_upload_watch_anon_write --> on

...output omitted...

Example httpd Policy Boolean

The httpd service policy includes the httpd_enable_homedirs Boolean, which enables the

sharing of home directories with httpd. Typically, a user’s local home directory is accessible
to
the user only when logged in to the local system. Alternatively, home directories are shared
and

accessed by using a remote file sharing protocol, such as NFS. In both scenarios, home
directories

are not shared by using https, by default, and are not available to the user through a
browser.

[root@host ~]# getsebool httpd_enable_homedirs

httpd_enable_homedirs --> off

You can enable sharing and allow users to access their home directories with a browser.
When

enabled, the httpd service shares home directories that are labeled with the
user_home_dir_t

file context. Users can then access and manage their home directory files from a browser.

158 RH199-RHEL9.0-en-4-20221003

Chapter 5 | Manage SELinux Security

Manage the Policy Boolean

Setting SELinux Booleans with the setsebool command without the -P option is temporary,

and settings will return to the persistent values after rebooting. View additional information
with

the semanage boolean -l command, which lists the Booleans from the policy files, including

whether a Boolean is persistent, the default and current values, and a short description.

[root@host ~]# semanage boolean -l | grep httpd_enable_homedirs

httpd_enable_homedirs (off , off) Allow httpd to enable homedirs

[root@host ~]# setsebool httpd_enable_homedirs on

[root@host ~]# semanage boolean -l | grep httpd_enable_homedirs

httpd_enable_homedirs (on , off) Allow httpd to enable homedirs

[root@host ~]# getsebool httpd_enable_homedirs

httpd_enable_homedirs --> on

To list only Booleans with a current setting that is different from the default setting at boot,
use
the semanage boolean -l -C command. This example has the same result as the previous

example, without requiring the grep filtering.

[root@host ~]# semanage boolean -l -C

SELinux boolean State Default Description

httpd_enable_homedirs (on , off) Allow httpd to enable homedirs

The previous example temporarily set the current value for the httpd_enable_homedirs

Boolean to on, until the system reboots. To change the default setting, use the setsebool -P

command to make the setting persistent. The following example sets a persistent value, and
then

views the Boolean’s information from the policy file.

[root@host ~]# setsebool -P httpd_enable_homedirs on

[root@host ~]# semanage boolean -l | grep httpd_enable_homedirs

httpd_enable_homedirs (on , on) Allow httpd to enable homedirs

Use the semanage boolean -l -C command again. The Boolean is displayed despite

the appearance that the current and default settings are the same. However, the -C option

matches when the current setting is different from the default setting from the last boot. For
this

httpd_enable_homedirs example, the original default boot setting was off.

[root@host ~]# semanage boolean -l -C

SELinux boolean State Default Description

httpd_enable_homedirs (on , on) Allow httpd to enable homedirs

References

booleans(8), getsebool(8), setsebool(8), semanage(8), and semanageboolean(

8) man pages

RH199-RHEL9.0-en-4-20221003 159

Chapter 5 | Manage SELinux Security

Guided Exercise

Adjust SELinux Policy with Booleans

In this exercise, you configure Apache to publish web content from users' home directories.
Outcomes

• Configure Apache web service to publish web content from the user’s home directory.

Before You Begin

As the student user on the workstation machine, use the lab command to prepare your

system for this exercise.

This command prepares your environment and ensures that all required resources are

available.

[student@workstation ~]$ lab start selinux-booleans

Instructions

1. On the workstation machine, use the ssh command to log in to the servera machine

as the student user and then switch to the root user.

[student@workstation ~]$ ssh student@servera

...output omitted...

[student@servera ~]$ sudo -i

[sudo] password for student: student

[root@servera ~]#

2. Edit the /etc/httpd/conf.d/[Link] configuration file to enable the Apache

feature so that users can publish web content from their home directory. Comment out the

line in the IfModule section that sets the UserDir variable to the disabled value, and

uncomment the line that sets the UserDir variable to the public_html value.

[root@servera ~]# vim /etc/httpd/conf.d/[Link]

<IfModule mod_userdir.c>

...output omitted...

# UserDir disabled

...output omitted...

UserDir public_html

...output omitted...

</IfModule>
3. Start and enable the Apache web service.

160 RH199-RHEL9.0-en-4-20221003

Chapter 5 | Manage SELinux Security

[root@servera ~]# systemctl enable --now httpd

4. Open another terminal window, and use the ssh command to log in to the servera

machine as the student user. Create the [Link] web content file in the

~/public_html directory.

4.1. In another terminal window, use the ssh command to log in to the servera machine

as the student user.

[student@workstation ~]$ ssh student@servera

...output omitted...

[student@servera ~]$

4.2. Use the mkdir command to create the ~/public_html directory.

[student@servera ~]$ mkdir ~/public_html

4.3. Create the [Link] file with the following content:

[student@servera ~]$ echo 'This is student content on SERVERA.' > \

~/public_html/[Link]

4.4. For the Apache web service to serve the contents of the

/home/student/public_html directory, it must be allowed to share files

and subdirectories in the /home/student directory. When you created the

/home/student/public_html directory, it was automatically configured with

permissions that allow anyone with home directory permission to access its contents.

Change the /home/student directory permissions to allow the Apache web service

to access the public_html subdirectory.

[student@servera ~]$ chmod 711 ~

[student@servera ~]$ ls -ld ~

drwx--x--x. 16 student student 4096 Nov 3 09:28 /home/student

5. Open a web browser on the workstation machine and enter the

permission to access the file.

6. Switch to the other terminal and use the getsebool command to see if any Booleans

restrict access to home directories for the httpd service.

[root@servera ~]# getsebool -a | grep home

...output omitted...

httpd_enable_homedirs --> off

...output omitted...

7. Use the setsebool command to enable persistent access to the home directory for the

httpd service.

RH199-RHEL9.0-en-4-20221003 161

Chapter 5 | Manage SELinux Security

[root@servera ~]# setsebool -P httpd_enable_homedirs on

8. Verify that you can now see the This is student content on SERVERA. message in

the web browser after entering the [Link] address.

9. Return to the workstation machine as the student user.

[root@servera ~]# exit

logout

[student@servera ~]$ exit

logout

Connection to servera closed.

[student@workstation ~]$

Finish

On the workstation machine, change to the student user home directory and use the lab

command to complete this exercise. This step is important to ensure that resources from
previous

exercises do not impact upcoming exercises.

[student@workstation ~]$ lab finish selinux-booleans

162 RH199-RHEL9.0-en-4-20221003

Chapter 5 | Manage SELinux Security

Investigate