RHCSA SELinux Contexts and Booleans Questions and Answers

Question 1

A web administrator moves a new website's content from their home directory to `/srv/www/content` using the `mv` command.
Standard file permissions are correct, but the website is returning '403 Forbidden' errors.
An `ls -Z` on the content reveals the context `unconfined_u:object_r:user_home_t:s0`.
Which command will fix the context issue for the existing files and ensure new files created in that directory get the correct context?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t "/srv/www/content(/.*)?" && restorecon -Rv /srv/www/content

Answer

chcon -R -t httpd_sys_content_t /srv/www/content

Answer

setenforce 0

Answer

chmod -R 755 /srv/www/content

Question 2

What is the primary difference between SELinux's 'enforcing' and 'permissive' modes?

Accepted Answer

Enforcing mode blocks and logs policy violations, while permissive mode only logs them without blocking.

Answer

Enforcing mode logs denials but allows actions, while permissive mode blocks and logs actions.

Answer

There is no functional difference; permissive is just an alias for enforcing.

Answer

Permissive mode completely disables SELinux, while enforcing mode enables it.

Question 3

A system administrator needs to allow the Apache web server (httpd) to serve content from user home directories. After verifying file permissions are correct, access is still denied by SELinux. Which of the following commands is the most appropriate and secure way to grant this specific capability?

Accepted Answer

setsebool -P httpd_enable_homedirs on

Answer

semanage fcontext -a -t httpd_sys_content_t "/home(/.*)?"

Answer

setenforce Permissive

Answer

chcon -R httpd_sys_content_t /home

Question 4

Which command is used to make a temporary, non-persistent change to an SELinux boolean value?

Accepted Answer

setsebool httpd_can_sendmail on

Answer

getsebool httpd_can_sendmail on

Answer

semanage boolean -m --on httpd_can_sendmail

Answer

setsebool -P httpd_can_sendmail on

Question 5

An SELinux AVC denial has been logged in `/var/log/audit/audit.log`. A system administrator wants to see a human-readable translation of the denial, including a potential solution. Which of the following tools is best suited for this purpose?

Accepted Answer

sealert -a /var/log/audit/audit.log

Answer

ausearch -m AVC

Answer

journalctl -t audit

Answer

cat /var/log/audit/audit.log | grep 'denied'

Question 6

After using `semanage fcontext` to define a new default context for the `/data/mysql` directory, the administrator runs `ls -Z /data/mysql` and sees the old context is still applied. What command must be run next to apply the newly defined default context to the existing directory and its contents?

Accepted Answer

restorecon -Rv /data/mysql

Answer

chcon -R -t new_context_t /data/mysql

Answer

semodule -B

Answer

touch /.autorelabel && reboot