RHCSA RHCSA SELinux Contexts and Booleans 2

Question 1

Which command permanently changes the SELinux context of a file so it survives a relabel?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/var/www/html/index.html'

Answer

chcon -t httpd_sys_content_t /var/www/html/index.html

Answer

restorecon -v /var/www/html/index.html

Answer

setfattr -n security.selinux /var/www/html/index.html

Question 2

A web server cannot read files copied from /root/docs/ to /var/www/html/. Audit2allow suggests allowing the access. What should you check FIRST?

Accepted Answer

Verify the file context with ls -Z and run restorecon

Answer

Run audit2allow -M and load the custom module

Answer

Disable SELinux temporarily and test

Answer

Add the httpd_t domain to the permissive list

Question 3

What is the effect of running 'touch /.autorelabel' and rebooting?

Accepted Answer

All filesystem objects are relabeled according to the current policy on next boot

Answer

SELinux is disabled on the next boot

Answer

Only /etc and /var are relabeled

Answer

SELinux booleans are reset to their defaults

Question 4

Which SELinux boolean allows Apache to connect to a network database like MariaDB?

Accepted Answer

httpd_can_network_connect

Answer

httpd_enable_cgi

Answer

httpd_use_nfs

Answer

httpd_can_network_relay

Question 5

You need to allow the FTP daemon to read files in home directories. Which boolean should you enable?

Accepted Answer

ftp_home_dir

Answer

allow_ftpd_full_access

Answer

ftpd_use_passive_mode

Answer

use_samba_home_dirs

Question 6

Which command lists all currently active SELinux boolean values along with their descriptions?

Accepted Answer

semanage boolean -l

Answer

getsebool -a

Answer

sestatus -b

Answer

seinfo --bool

Question 7

A custom application writes logs to /opt/myapp/logs/. After setting the correct SELinux context with semanage fcontext, what command applies the new context to existing files?

Accepted Answer

restorecon -Rv /opt/myapp/logs/

Answer

chcon -R --reference /var/log /opt/myapp/logs/

Answer

semanage fcontext -R /opt/myapp/logs/

Answer

fixfiles relabel /opt/myapp/logs/