RHCSA RHCSA SELinux Contexts and Booleans 3

Question 1

An SELinux denial appears in /var/log/audit/audit.log. Which tool converts that denial into a human-readable explanation with suggested fixes?

Accepted Answer

sealert -a /var/log/audit/audit.log

Answer

sealert analyzes audit log AVC messages and provides plain-English explanations and prioritized remediation steps.

Question 2

What does the SELinux type 'httpd_sys_rw_content_t' allow that 'httpd_sys_content_t' does not?

Accepted Answer

Apache to both read and write the file

Answer

httpd_sys_rw_content_t grants the httpd domain read and write access, while httpd_sys_content_t grants read-only access.

Question 3

Which file stores the mapping of file paths to SELinux contexts used by restorecon?

Accepted Answer

/etc/selinux/targeted/contexts/files/file_contexts

Answer

The file_contexts file under the policy directory contains all path-to-context mappings that restorecon and matchpathcon reference.

Question 4

Which command temporarily sets a single process's SELinux domain for troubleshooting without modifying policy?

Accepted Answer

runcon -t vsftpd_t -- /usr/sbin/vsftpd

Answer

runcon executes a command in a specified security context, useful for testing without policy changes.

Question 5

You want to allow Samba to share home directories. Which boolean must be enabled?

Accepted Answer

samba_enable_home_dirs

Answer

samba_enable_home_dirs allows the Samba daemon to read and share user home directories under SELinux.

RHCSA Exam Practice Test