Chapter 12

1. When SELinux Booleans are changed through the /sys/fs/selinux/booleans filesystem, the changes are not automatically committed. For that to occur, you also need to write the value 1 into /sys/fs/selinux/commit_pending_bools.
2. The sesearch command is used to query the active policy, and can be used to query the impact of SELinux Booleans as well. Add the -b <boolean> argument to limit the query to rules that are influenced by the SELinux Boolean.
3. When an SELinux policy module is loaded, it is assigned a priority that tells the system whether it should be the active module. Administrators can load new modules at a higher priority to test them out, and remove them again, without risking that no proper SELinux rules are active on the system at all.

   Likewise, administrators can load a policy at a lower priority, ensuring that it is not yet active, and later on remove the module at the higher priority so that the newly loaded policy becomes active.

   This is unlike...