getsebool

Wat het doet

Zo schrijf je het

getsebool -a | BOOLEAN...
setsebool [-PNV] BOOLEAN on|off|1|0 | BOOL1=VAL1 …

Meest gebruikt

Niets past bij dit filter.

$ als gewone gebruiker# als root (of met sudo)

1. 1All web booleans

   $getsebool -a | grep httpd

   on/off per boolean.

2. 2One boolean

   $getsebool httpd_enable_homedirs
   httpd_enable_homedirs --> off

   Off by default.

3. 3Switch on permanently

   #setsebool -P httpd_enable_homedirs on

   Survives a reboot.

4. 4Only until reboot

   #setsebool httpd_can_network_connect on

   For a quick test.

5. 5Several at once

   #setsebool -P httpd_can_network_connect_db=1 httpd_can_sendmail=1

   Name=value pairs.

6. 6Descriptions

   #semanage boolean -l | grep httpd_can_network_connect

   What the boolean allows.

7. 7Only your changes

   #semanage boolean -l -C

   Booleans that differ from the default.

8. 8Find a boolean from the man page

   $man httpd_selinux | grep -A2 httpd_use_nfs

   Needs selinux-policy-doc.

9. 9NFS home folders

   #setsebool -P use_nfs_home_dirs on

   Users with NFS homes can log in.

10. 10Audit risky booleans (security)

    $getsebool -a | grep -E 'httpd_execmem|httpd_unified|allow_execstack|selinuxuser_execstack' 

    Booleans that weaken protection should stay off unless needed.

Niets past bij dit filter.

Exitcodes