Hands-on Lab·Red Hat Certified System Administrator
SELinux Booleans
One objective, and the easiest SELinux fix when it applies: policy already contains the rule you need and it is switched off. The only trap is -P - without it the change is lost at the next reboot, which on a graded exam means it never happened.
Security and SELinux Guide 59 of 67 Beginner
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 10 min
setsebool without -P is runtime only. With -P it is written to policy and survives a reboot. This is the same started-versus-enabled distinction as services, and it costs marks for the same reason.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this for the easiest SELinux fix, when it applies. This matters because the policy already contains the permission - it is simply switched off, and one flag decides whether your change survives a reboot.
- finding what booleans are, and reading their current state
- setting one, and watching it take effect
- using the flag that makes it stick
Before you start
- A sudo-capable account.
- The session toggles one boolean and sets it back.
-
What they are
-
The flag that makes it stick