CompTIA Linux+ (XK0-006)SecurityEasy
A web server running SELinux in enforcing mode needs to send outbound mail notifications from PHP scripts, but SELinux is blocking the connection. The administrator wants to permanently allow this behavior without disabling SELinux or relabeling files. Which command should be used?
- Asetsebool -P httpd_can_sendmail on
- Bchcon -t httpd_sendmail_t /usr/sbin/sendmail
- Csemanage fcontext -a -t httpd_sys_content_t /var/www/html
- Drestorecon -Rv /var/www/html
Show answer & explanationAnswer & explanation
Correct answer: A. setsebool -P httpd_can_sendmail on
SELinux booleans are switches that toggle predefined policy behavior without editing the policy itself. The -P flag makes the change persistent across reboots by writing it to the policy store.
Why the other options are wrong
- B. chcon manually sets a context but is not persistent and not the correct approach for this boolean-controlled behavior.
- C. semanage fcontext changes file context mappings, not runtime booleans.
- D. restorecon reapplies existing contexts; it does not enable new behavior.
SELinux Booleans
Booleans are runtime on/off switches that let administrators enable or disable specific SELinux policy behaviors without writing custom policy.
- getsebool -a lists all booleans
- setsebool -P makes a change persistent
- Booleans avoid the need for custom SELinux policy modules
Memory trick: Booleans are 'policy light switches' you flip with setsebool.