RHCE SELinux Administration 2 — Questions and Answers
Question 1: Which command sets a permanent SELinux file context so it survives `restorecon`?
- chcon -t httpd_sys_content_t /mydir
- semanage fcontext -a -t httpd_sys_content_t '/mydir(/.*)?' (Correct answer)
- restorecon -t httpd_sys_content_t /mydir
- setsebool httpd_sys_content_t /mydir
Correct answer: semanage fcontext -a -t httpd_sys_content_t '/mydir(/.*)?'
`semanage fcontext -a` adds a persistent file context rule to the SELinux policy database.
Question 2: What command enables the SELinux boolean `httpd_can_network_connect` persistently?
- setsebool httpd_can_network_connect on
- setsebool -P httpd_can_network_connect on (Correct answer)
- semanage boolean httpd_can_network_connect 1
- togglesebool -P httpd_can_network_connect
Correct answer: setsebool -P httpd_can_network_connect on
`setsebool -P` sets the SELinux boolean persistently, surviving reboots by writing to the policy.
Question 3: Which command lists all SELinux booleans and their current state?
- semanage boolean -l
- getsebool -a
- seinfo -b
- Both A and B (Correct answer)
Correct answer: Both A and B
Both `semanage boolean -l` and `getsebool -a` list all SELinux booleans with their current and default states.
Question 4: What log file contains SELinux denial messages (AVC denials)?
- /var/log/messages
- /var/log/secure
- /var/log/audit/audit.log (Correct answer)
- /var/log/selinux.log
Correct answer: /var/log/audit/audit.log
SELinux AVC (Access Vector Cache) denial messages are written to `/var/log/audit/audit.log` by the auditd daemon.
Question 5: Which command analyzes SELinux denials and suggests fixes using audit2why?
- ausearch -m avc | audit2why (Correct answer)
- seinfo | audit2why
- sestatus | audit2why
- sealert | audit2why
Correct answer: ausearch -m avc | audit2why
`ausearch -m avc` extracts AVC denial messages which are then piped to `audit2why` for human-readable explanations.
Question 6: What does the `z` option do when used with `cp` (e.g., `cp -Z`)?
- Compresses the file during copy
- Preserves SELinux context
- Sets the context to default policy (Correct answer)
- Skips SELinux context entirely
Correct answer: Sets the context to default policy
`cp -Z` sets the SELinux context of copied files to the default policy context for the destination.
RHCE SELinux Administration 2
Which command sets a permanent SELinux file context so it survives `restorecon`?