From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id t36ItaQR025542 for ; Mon, 6 Apr 2015 14:55:36 -0400 Message-ID: <5522D6A2.7090804@redhat.com> Date: Mon, 06 Apr 2015 14:55:30 -0400 From: Daniel J Walsh Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=_Boundary-2884-1428346503-0001-2" To: Aleksey Chudov , selinux@tycho.nsa.gov Subject: Re: Reset SELinux booleans References: In-Reply-To: List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_Boundary-2884-1428346503-0001-2 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit semanage booleans -D Should do what you want On 03/23/2015 06:55 AM, Aleksey Chudov wrote: > Hi, > > After some experiments I'm trying to reset booleans to the boot-time > defaults. Just deleting > /etc/selinux/targeted/modules/active/booleans.local and executing > semodule -B does not help. > > According to man booleans(8) the load_policy program can reset > booleans to the boot-time defaults via the -b option. But executing > load_policy -b produces the following warning on CentOS 7: > > # load_policy -b > load_policy: Warning! The -b option is no longer supported, booleans > are always preserved across reloads. Continuing... > > Currently I'm setting up servers including SELinux policy using > configuration management system. File > /etc/selinux/targeted/modules/active/booleans.local is managed > automatically. But if someone manually executes setsebool to set some > boolean this boolean becomes unmanageable till the next reboot and > itcould be a very long time in the case of a production server. > > Is there some way to reset booleans to the boot-time defaults? > > > Regards, > Aleksey > > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. --=_Boundary-2884-1428346503-0001-2 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable X-Mime-Autoconverted: from 8bit to quoted-printable by mime827
semanage booleans -D

Should do what you want

On 03/23/2015 06:55 AM, Aleksey Chudo= v wrote:

Hi,

After some experiments I'm trying to reset booleans to the boot-time defaults. Just deleting /etc/selinux/targeted/modules/active/booleans.local and executing semodule -B does not help.

According to man booleans(8) the load_policy program can reset booleans to the boot-time defaults via the -b option. But executing load_policy -b produces the following warning on CentOS 7:

# load_policy -b
load_policy:=A0 Warning! The -b option is no longer supported, booleans are always preserved across reloads.=A0 Continuing...
Currently I'm setting up servers including SELinux policy using configuration management system. File /etc/selinux/targeted/modules/active/booleans.local is managed automatically. But if someone manually executes setsebool to set some boolean this boolean becomes unmanageable till the next reboot and it could be a very long time in the case of a production server.

Is there some way to reset booleans to the boot-time defaults?

Regards,
Aleksey
_______________________________________________
Selinux mailing list
Selinux@tycho.nsa.gov
To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
To get help, send an email containing "help" to Selinux-requ=
est@tycho.nsa.gov.

--=_Boundary-2884-1428346503-0001-2--