RHCSA SELinux Contexts and Booleans Questions and Answers

Question 1

A web administrator moves a new website's content from their home directory to `/srv/www/content` using the `mv` command. Standard file permissions are correct, but the website is returning '403 Forbidden' errors. An `ls -Z` on the content reveals the context `unconfined_u:object_r:user_home_t:s0`. Which command will fix the context issue for the existing files and ensure new files created in that directory get the correct context?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t "/srv/www/content(/.*)?" && restorecon -Rv /srv/www/content

Answer

Moving files (`mv`) preserves the original SELinux context (`user_home_t`), which httpd cannot read by default. The `semanage fcontext` command permanently adds a rule for the `/srv/www/content` directory and its contents to have the `httpd_sys_content_t` type. The subsequent `restorecon -Rv` command applies this newly defined rule to the existing files and directories. `chcon` would only provide a temporary fix that would not survive a system relabel. `setenforce 0` disables SELinux, which is a security risk and not the proper solution. `chmod` only affects standard Linux permissions, not the SELinux context.

Question 2

What is the primary difference between SELinux's 'enforcing' and 'permissive' modes?

Accepted Answer

Enforcing mode blocks and logs policy violations, while permissive mode only logs them without blocking.

Answer

In 'enforcing' mode, SELinux actively enforces the security policy, meaning it will both log the AVC denial and block the disallowed action. In 'permissive' mode, SELinux does not enforce the policy; it allows the action to proceed but still logs the AVC denial message. This makes permissive mode a useful tool for troubleshooting and policy development.

Question 3

A system administrator needs to allow the Apache web server (httpd) to serve content from user home directories. After verifying file permissions are correct, access is still denied by SELinux. Which of the following commands is the most appropriate and secure way to grant this specific capability?

Accepted Answer

setsebool -P httpd_enable_homedirs on

Answer

SELinux uses booleans as on/off switches for specific policies. The `httpd_enable_homedirs` boolean is designed specifically to allow the httpd process to access user home directories. Using `setsebool -P` enables this boolean and makes the change persistent across reboots. Changing the context of the entire `/home` directory is incorrect and would cause significant system-wide problems. Setting SELinux to permissive mode or disabling it would solve the immediate issue but would weaken the overall security of the system.

Question 4

Which command is used to make a temporary, non-persistent change to an SELinux boolean value?

Accepted Answer

setsebool httpd_can_sendmail on

Answer

The `setsebool` command is used to change the value of an SELinux boolean. When used without the `-P` flag, the change is temporary and will revert to the default setting upon reboot. The `-P` flag makes the change persistent. `getsebool` is used to view booleans, not set them. `semanage boolean` is an alternative for persistent changes.

Question 5

An SELinux AVC denial has been logged in `/var/log/audit/audit.log`. A system administrator wants to see a human-readable translation of the denial, including a potential solution. Which of the following tools is best suited for this purpose?

Accepted Answer

sealert -a /var/log/audit/audit.log

Answer

The `sealert` tool, part of the `setroubleshoot-server` package, is specifically designed to analyze audit logs, find AVC denials, and provide clear, human-readable explanations and suggested solutions, such as relabeling a file or enabling a boolean. While `ausearch` and `grep` can find the denial messages, they do not interpret them or provide solutions.

RHCSA Exam Practice Test

RHCSA Exam Practice Test

RHCSA SELinux Contexts and Booleans Questions and Answers