SELinux booleans are switches that let you toggle specific policy rules on or off without writing, compiling, or loading a custom policy module. They exist because the SELinux policy authors recognized that some access patterns are legitimate in some environments but not in others. Instead of forcing every admin to write custom modules for common variations, they built toggles into the policy itself.
On RHEL 9 and compatible distributions like CentOS Stream 9, AlmaLinux 9, and Rocky Linux 9, the targeted policy includes hundreds of booleans. This guide covers the commands you need to manage them and the specific booleans you are most likely to encounter.
The getsebool -a command lists every boolean and its current state:
On a default RHEL 9 install, there are over 300 booleans. Piping through grep is the practical way to find what you need:
To check one boolean by name:
For a detailed description of what the boolean controls, use semanage boolean -l:
The two values in parentheses are (current state, default state). If they differ, someone changed the boolean at runtime without making it persistent.
Use setsebool to change a boolean at runtime:
This change takes effect immediately but does not survive a reboot. To make it persistent, add the -P flag:
The -P flag writes the value to the policy store on disk, so it persists across reboots. This is almost always what you want in production. The command may take a few seconds because it recompiles the policy module.
If you run Apache or Nginx on RHEL 9, these are the booleans you will encounter most often:
| Boolean | Default | Purpose |
|---|---|---|
httpd_can_network_connect | off | Allow httpd to make outbound TCP connections to any port. Required for reverse proxy setups where Apache connects to a backend application server. |
httpd_can_network_connect_db | off | Allow httpd to connect to database ports (MySQL, PostgreSQL, etc.). Needed when a PHP or Python web app connects directly to a database. |
httpd_enable_homedirs | off | Allow httpd to read user home directories. Used for the classic ~user/public_html feature. |
httpd_can_sendmail | off | Allow httpd to send email. Required for web apps that send mail via sendmail or a local SMTP relay. |
httpd_use_nfs | off | Allow httpd to serve files from NFS mounts. Without this, Apache gets permission denied on any NFS-mounted document root. |
httpd_enable_cgi | on | Allow httpd to execute CGI scripts. Enabled by default, but you can disable it to harden a server that does not need CGI. |
Samba:
samba_enable_home_dirs - Allow Samba to share user home directoriessamba_export_all_ro - Allow Samba to share any file on the system as read-onlysamba_export_all_rw - Allow Samba to share any file as read-write (dangerous in most cases)NFS:
nfs_export_all_ro - Allow NFS to export any file as read-onlynfs_export_all_rw - Allow NFS to export any file as read-writeuse_nfs_home_dirs - Allow processes to use NFS-mounted home directoriesSSH and login:
ssh_sysadm_login - Allow SSH users to log in directly to the sysadm_r roleauthlogin_nsswitch_use_ldap - Allow authentication to use LDAP for name resolutionYou have Apache configured as a reverse proxy to a Node.js application running on port 3000. After enabling the proxy config and restarting httpd, the proxy returns 503 errors. The audit log shows:
The name_connect denial tells you httpd tried to establish an outbound TCP connection and was blocked. The fix:
One command, persistent across reboots, and the proxy works. No custom policy module needed.
Booleans are the first thing to check when you hit an SELinux denial. They cover the most common variations in how services are deployed. Only write a custom policy module when no existing boolean addresses your specific use case. The order of operations should be:
restoreconsetsebool -Paudit2allowMost SELinux problems on RHEL 9 are solved at step 1 or step 2. Custom modules are rarely needed unless you are running non-standard software.