RHCSA RHCSA SELinux Contexts and Booleans 2

Question 1

Which command permanently changes the SELinux context of a file so it survives a relabel?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/var/www/html/index.html'

Answer

semanage fcontext writes a persistent policy rule; chcon only sets the label temporarily and it is lost on relabel.

Question 2

A web server cannot read files copied from /root/docs/ to /var/www/html/. Audit2allow suggests allowing the access. What should you check FIRST?

Accepted Answer

Verify the file context with ls -Z and run restorecon

Answer

Files copied from /root retain the user_home_t context; restorecon resets them to the correct httpd_sys_content_t label before writing any new policy.

Question 3

What is the effect of running 'touch /.autorelabel' and rebooting?

Accepted Answer

All filesystem objects are relabeled according to the current policy on next boot

Answer

The presence of /.autorelabel triggers a full filesystem relabel during the next boot using the active policy.

Question 4

Which SELinux boolean allows Apache to connect to a network database like MariaDB?

Accepted Answer

httpd_can_network_connect

Answer

httpd_can_network_connect permits Apache to initiate outbound TCP connections, including to database ports.

Question 5

You need to allow the FTP daemon to read files in home directories. Which boolean should you enable?

Accepted Answer

ftp_home_dir

Answer

The ftp_home_dir boolean grants vsftpd read access to user home directories under SELinux.

RHCSA Exam Practice Test

RHCSA Exam Practice Test

RHCSA RHCSA SELinux Contexts and Booleans 2