RHCSA RHCSA SELinux Contexts and Booleans 3 — Questions and Answers
Question 1: An SELinux denial appears in /var/log/audit/audit.log. Which tool converts that denial into a human-readable explanation with suggested fixes?
- audit2allow
- sealert -a /var/log/audit/audit.log (Correct answer)
- ausearch -m AVC
- seinfo -t
Correct answer: sealert -a /var/log/audit/audit.log
sealert analyzes audit log AVC messages and provides plain-English explanations and prioritized remediation steps.
Question 2: What does the SELinux type 'httpd_sys_rw_content_t' allow that 'httpd_sys_content_t' does not?
- Apache to execute the file as a script
- Apache to both read and write the file (Correct answer)
- Apache to serve the file over HTTPS only
- Apache to cache the file in memory
Correct answer: Apache to both read and write the file
httpd_sys_rw_content_t grants the httpd domain read and write access, while httpd_sys_content_t grants read-only access.
Question 3: Which file stores the mapping of file paths to SELinux contexts used by restorecon?
- /etc/selinux/targeted/contexts/files/file_contexts (Correct answer)
- /etc/selinux/config
- /var/lib/selinux/contexts.db
- /etc/sysconfig/selinux
Correct answer: /etc/selinux/targeted/contexts/files/file_contexts
The file_contexts file under the policy directory contains all path-to-context mappings that restorecon and matchpathcon reference.
Question 4: Which command temporarily sets a single process's SELinux domain for troubleshooting without modifying policy?
- runcon -t vsftpd_t -- /usr/sbin/vsftpd (Correct answer)
- chcon -t vsftpd_t /usr/sbin/vsftpd
- semanage permissive -a vsftpd_t
- secon --type vsftpd_t
Correct answer: runcon -t vsftpd_t -- /usr/sbin/vsftpd
runcon executes a command in a specified security context, useful for testing without policy changes.
Question 5: You want to allow Samba to share home directories. Which boolean must be enabled?
- samba_export_all_rw
- samba_enable_home_dirs (Correct answer)
- use_samba_home_dirs
- smbd_anon_write
Correct answer: samba_enable_home_dirs
samba_enable_home_dirs allows the Samba daemon to read and share user home directories under SELinux.
Question 6: After enabling the boolean 'httpd_can_sendmail', what additional step is required to make the change survive a reboot?
- Run semanage boolean -m --on httpd_can_sendmail
- No additional step; setsebool -P already persists the change (Correct answer)
- Edit /etc/selinux/booleans.conf
- Run systemctl enable selinux-booleans
Correct answer: No additional step; setsebool -P already persists the change
The -P flag to setsebool writes the boolean to persistent storage, making it survive reboots without any additional command.
Question 7: Which SELinux context label component identifies the sensitivity level in MLS/MCS policies?
- User (e.g., system_u)
- Role (e.g., object_r)
- Type (e.g., httpd_t)
- Level (e.g., s0:c0,c1) (Correct answer)
Correct answer: Level (e.g., s0:c0,c1)
The level field (format s<sensitivity>:c<categories>) encodes MLS sensitivity and MCS category information.
RHCSA RHCSA SELinux Contexts and Booleans 3
An SELinux denial appears in /var/log/audit/audit.log.
Which tool converts that denial into a human-readable explanation with suggested fixes?