SELinux boolean modification vs persistence: semanage boolean and setsebool -P

Question

Goal
Determine how to reliably toggle an SELinux boolean on CentOS and ensure the change survives a reboot, while also understanding the impact on already-running containers.
Current behavior
The semanage boolean tool updates the active boolean file, but the kernel does not reload the value until a reboot or a setsebool -P command is issued.  On CentOS 8 and later, setsebool -P writes the value to the persistent configuration directory, making it survive reboots.  When a boolean that influences container runtimes (e.g., container_manage_cgroup) is changed, containers that were started before the change may not observe the new policy until they are restarted.
Unresolved decision
It remains unclear whether the semanage boolean command alone can be used to persist changes across reboots, or if setsebool -P is always required.  Additionally, the boundary at which container workloads become aware of boolean changes is not well documented.
Specific questions

Can semanage boolean -m  --on alone guarantee persistence after a reboot on CentOS 8 and later, or is setsebool -P mandatory?
What is the exact point at which running containers detect a change to a boolean that affects container management?
Is there a documented mechanism to force immediate reloading of boolean changes without rebooting or restarting containers?

Tasadduq Burney · Answer

Answer the exact question first

On CentOS 8 and newer, semanage boolean -m --on only edits the policy definition file. The running kernel does not pick up the new value until you either reboot or run setsebool -P. Therefore setsebool -P is mandatory for persistence.

When running containers see the change

Containers that are started after the setsebool -P command observe the new boolean immediately.
Containers that were already running before the change keep the old policy until they are stopped and started again.

Is there a way to force immediate reload without rebooting or restarting containers?

No supported command exists that will make the kernel re‑evaluate existing container processes for a boolean change. The only reliable method is to restart the affected containers (or the container runtime itself).

Steps you need for this case

Verify the boolean exists:
```
semanage boolean -l | grep <name>
```
Enable it and make it persistent:
```
setsebool -P <name> --on
```
Confirm the change is active:
```
sestatus -b | grep <name>
```
Restart containers that were running before the change (or restart the runtime). For Docker you can use docker restart $(docker ps -q) or restart the systemd unit docker.service.

What you still need to know

To be certain that the boolean is defined in the current policy, run semanage boolean -l and confirm the name appears. If it does not, setsebool will return an error.

Verification checklist

After setsebool -P, sestatus -b shows the new value.
Reboot the host; sestatus -b still shows the new value.
Start a new container after the change; it behaves according to the new policy.
Stop and start an existing container; it now follows the new policy.

SELinux boolean modification vs persistence: semanage boolean and setsebool -P

Goal

Current behavior

Unresolved decision

Specific questions

1 answer