SELinux Administration Flashcards

Which SELinux context type must files under `/var/www/html` have for Apache to serve them?

Answer: httpd_sys_content_t

Files must have the `httpd_sys_content_t` type for the Apache httpd process to read and serve them under SELinux.

What command generates an SELinux policy module from audit denials to allow a previously blocked action?

Answer: audit2allow -M mypolicy

`audit2allow -M mypolicy` reads AVC denials and creates a compiled `.pp` policy module that can be loaded with `semodule -i`.

Which command loads a compiled SELinux policy module named `mypolicy.pp`?

Answer: semodule -i mypolicy.pp

`semodule -i` installs/loads a compiled SELinux policy module (`.pp` file) into the kernel.

What is the SELinux context label for the standard SSH port (22) in the SELinux policy?

Answer: ssh_port_t

Port 22 is labeled `ssh_port_t` in the SELinux policy, allowing the `sshd` process to bind to it.

Which command adds port 8080 as an HTTP port in SELinux so Apache can bind to it?

Answer: semanage port -a -t http_port_t -p tcp 8080

`semanage port -a -t http_port_t -p tcp 8080` permanently adds port 8080 to the `http_port_t` SELinux type.

What does `ausearch -m AVC -ts recent` do?

Answer: Displays recent SELinux AVC denial messages

`ausearch -m AVC -ts recent` searches the audit log for recent AVC (SELinux denial) messages from the last 10 minutes.