RHCE SELinux Administration 2

Question 1

Which command sets a permanent SELinux file context so it survives `restorecon`?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/mydir(/.*)?'

Answer

`semanage fcontext -a` adds a persistent file context rule to the SELinux policy database.

Question 2

What command enables the SELinux boolean `httpd_can_network_connect` persistently?

Accepted Answer

setsebool -P httpd_can_network_connect on

Answer

`setsebool -P` sets the SELinux boolean persistently, surviving reboots by writing to the policy.

Question 3

Which command lists all SELinux booleans and their current state?

Accepted Answer

Both A and B

Answer

Both `semanage boolean -l` and `getsebool -a` list all SELinux booleans with their current and default states.

Question 4

What log file contains SELinux denial messages (AVC denials)?

Accepted Answer

/var/log/audit/audit.log

Answer

SELinux AVC (Access Vector Cache) denial messages are written to `/var/log/audit/audit.log` by the auditd daemon.

Question 5

Which command analyzes SELinux denials and suggests fixes using audit2why?

Accepted Answer

ausearch -m avc | audit2why

Answer

`ausearch -m avc` extracts AVC denial messages which are then piped to `audit2why` for human-readable explanations.

RHCE - Red Hat Certified Engineer Practice Test