SELinux Game

Mission Briefing

A developer reports that the company's internal web application works perfectly in permissive mode but throws 500 errors in enforcing mode. The application needs to send email, connect to a PostgreSQL database on a remote host, and serve content from user home directories. You need to find the right combination of booleans to make it work - without opening any access that is not strictly required.

What Booleans Actually Are

SELinux booleans are not just on/off switches. Each boolean controls conditional policy rules compiled into the loaded policy. When you toggle a boolean, the kernel activates or deactivates those rules in real time without reloading the entire policy. The rules already exist in memory, gated behind the boolean's state.

Examine the conditional rules tied to a specific boolean:

Those rules exist in the policy at all times. When httpd_can_sendmail is off, the kernel skips them. Set it to on and they become active - no policy reload, no relabeling.

Querying Boolean State

The basic commands are straightforward, but each gives you different information:

The semanage boolean -l output shows two values in parentheses. The first is the current runtime state. The second is the persistent (on-disk) default. When these differ, it means someone used setsebool without the -P flag - the change will revert on reboot.

Setting Booleans

Always use the -P flag to make changes persistent:

Without -P, the change is runtime-only and disappears after reboot. This is a frequent source of "it worked yesterday" tickets.

Auditing Boolean Changes

Every boolean change is logged in the audit trail. You can search for them:

This log entry shows exactly which boolean changed, its old and new values, and which user (auid 1000) made the change. In a compliance environment, these audit records prove that policy changes were intentional and traceable.

Creating Custom Booleans

You can define booleans in your own policy modules. In the .te file, declare the boolean and wrap rules in a conditional block:

After loading the module, your custom boolean appears in getsebool -a and works like any built-in boolean. Ship the policy with rules present but gated - administrators enable features as needed.

Common Boolean Misconfigurations

Some booleans are dangerously broad. Knowing which ones to avoid is as important as knowing which ones to enable:

• httpd_unified - Allows httpd to access all httpd-labeled content types uniformly. Sounds harmless, but it collapses the separation between httpd_sys_content_t (read-only) and httpd_sys_rw_content_t (read-write). If an attacker compromises httpd, they can now modify files that should be read-only.
• httpd_can_network_connect - Allows httpd to make outbound TCP connections to any port. This is often enabled because the more specific httpd_can_network_connect_db was not known to exist. Always look for the narrowest boolean first.
• selinuxuser_execmod - Allows users to execute modified memory regions. Enabling this for convenience undermines a key exploit mitigation.

Key Commands Reference