SELinux booleans and port labels

Booleans: switches for optional behaviour

The policy authors knew some setups need extra access that most servers should not have. Instead of making you write policy, they added booleans: named switches, off by default for safety. For example, a web app that connects to a remote database needs httpd_can_network_connect_db on.

$ getsebool -a | grep httpd_can_network
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
# semanage boolean -l | grep httpd_enable_homedirs
httpd_enable_homedirs          (off  ,  off)  Allow httpd to read home directories
# setsebool -P httpd_enable_homedirs on
# getsebool httpd_enable_homedirs
httpd_enable_homedirs --> on

Read the list with semanage boolean -l | grep <service>. The descriptions are short and clear. The man pages named after services (for example man httpd_selinux, after installing selinux-policy-doc) explain each one.

Port labels

Network ports have SELinux types too. The policy allows httpd_t to listen only on ports labelled http_port_t; sshd_t only on ssh_port_t. So if you move a web server to port 82, SELinux blocks it even with the firewall open.

$ semanage port -l | grep -w http_port_t
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
# (Listen 82 in httpd.conf)
# systemctl restart httpd
Job for httpd.service failed because the control process exited with error code.
# journalctl -u httpd -n 3 --no-pager
... (13)Permission denied: AH00072: make_sock: could not bind to address [::]:82
# semanage port -a -t http_port_t -p tcp 82
# systemctl restart httpd     # works now
# firewall-cmd --add-port=82/tcp --permanent && firewall-cmd --reload

If the port already has another label (for example 8080 is http_cache_port_t), semanage port -a says it is already defined; use -m (modify) instead of -a. semanage port -d removes a custom entry.

Common mistakes

• Forgetting -P with setsebool.
• Opening the firewall for a new port but forgetting the SELinux port label, or the reverse.
• Turning on broad booleans like httpd_can_network_connect when a narrower one (httpd_can_network_connect_db) is enough.
• Guessing boolean names. Search with getsebool -a | grep word.