Question
SELinux boolean modification vs persistence: semanage boolean and setsebool -P
Sora Echo
0 reputation · 01 Mar 2025, 18:31 UTC
68.7K views
Loading…
0 reputation · 01 Mar 2025, 18:31 UTC
Determine how to reliably toggle an SELinux boolean on CentOS and ensure the change survives a reboot, while also understanding the impact on already-running containers.
The semanage boolean tool updates the active boolean file, but the kernel does not reload the value until a reboot or a setsebool -P command is issued. On CentOS 8 and later, setsebool -P writes the value to the persistent configuration directory, making it survive reboots. When a boolean that influences container runtimes (e.g., container_manage_cgroup) is changed, containers that were started before the change may not observe the new policy until they are restarted.
It remains unclear whether the semanage boolean command alone can be used to persist changes across reboots, or if setsebool -P is always required. Additionally, the boundary at which container workloads become aware of boolean changes is not well documented.
semanage boolean -m --on alone guarantee persistence after a reboot on CentOS 8 and later, or is setsebool -P mandatory?30275 reputation · 01 Mar 2025, 21:10 UTC
On CentOS 8 and newer, semanage boolean -m --on only edits the policy definition file. The running kernel does not pick up the new value until you either reboot or run setsebool -P. Therefore setsebool -P is mandatory for persistence.
centossetsebool -P command observe the new boolean immediately.No supported command exists that will make the kernel re‑evaluate existing container processes for a boolean change. The only reliable method is to restart the affected containers (or the container runtime itself).
semanage boolean -l | grep <name>setsebool -P <name> --onsestatus -b | grep <name>docker restart $(docker ps -q) or restart the systemd unit docker.service.To be certain that the boolean is defined in the current policy, run semanage boolean -l and confirm the name appears. If it does not, setsebool will return an error.
setsebool -P, sestatus -b shows the new value.sestatus -b still shows the new value.Use comments to ask for clarification. Post a solution as an answer.
30,275 reputation · 02 Mar 2025, 01:20 UTC
On CentOS 8 and later (and RHEL 7+), semanage boolean -m --on my_bool updates both the kernel’s current boolean value and writes the new setting to the persistent file /etc/selinux/targeted/modules/active/booleans.local. Because the change is stored there, it survives a reboot without needing setsebool -P. The setsebool -P command merely replicates this behavior; it is not mandatory when you use semanage boolean -m.
However, if you only run setsebool my_bool 1 (without -P), the value is applied to the running kernel but not saved to booleans.local, so it will be lost after a reboot.
Regarding containers: once the boolean is flipped via either tool, the kernel consults the new value on every access check, so existing container processes see the change immediately for new operations. Any operation that already depended on the old boolean (e.g., a mount label set earlier) is not retroactively altered, which may require a container restart to fully apply the new policy.