RHCSA RHCSA SELinux Contexts and Booleans 4 — Questions and Answers
Question 1: A service fails and audit.log shows 'type=AVC msg=audit: denied { name_connect } for pid=1234 comm="httpd"'. What does 'name_connect' indicate?
- Apache tried to bind to a local port
- Apache attempted an outbound TCP connection to a remote port (Correct answer)
- A DNS lookup was blocked
- Apache tried to create a Unix socket
Correct answer: Apache attempted an outbound TCP connection to a remote port
name_connect is the SELinux permission checked when a process initiates an outbound TCP connection to a specific port number.
Question 2: Which command would you use to add port 8888 to the http_port_t SELinux type so Apache can listen on it?
- semanage port -a -t http_port_t -p tcp 8888 (Correct answer)
- setsebool httpd_use_port 8888
- semanage fcontext -a -t http_port_t -p tcp 8888
- chcon -t http_port_t :8888
Correct answer: semanage port -a -t http_port_t -p tcp 8888
semanage port -a adds a port-to-type mapping; without it, Apache is denied the bind permission on non-standard ports.
Question 3: What does 'semanage permissive -a httpd_t' do?
- Sets the entire system to permissive mode
- Puts only the httpd_t domain into permissive mode while the rest of the system remains enforcing (Correct answer)
- Disables SELinux policy for the Apache binary
- Logs all httpd_t actions without enforcing any
Correct answer: Puts only the httpd_t domain into permissive mode while the rest of the system remains enforcing
Per-domain permissive mode lets a single type run unrestricted and log denials without affecting the enforcement of other domains.
Question 4: The command 'ls -Z /var/www/html/app.php' shows 'user_home_t'. What is the quickest correct fix?
- chcon -t httpd_sys_content_t /var/www/html/app.php
- restorecon /var/www/html/app.php (Correct answer)
- semanage fcontext -a -t httpd_sys_content_t '/var/www/html/app.php' && restorecon /var/www/html/app.php
- mv /var/www/html/app.php /tmp/ && mv /tmp/app.php /var/www/html/
Correct answer: restorecon /var/www/html/app.php
restorecon resets the file to the context already defined for /var/www/html in the policy database, which is httpd_sys_content_t.
Question 5: Which tool generates a loadable SELinux policy module (.pp file) from AVC denial messages?
- audit2allow -M mymodule (Correct answer)
- semodule -i mymodule.pp
- checkmodule -M -m -o mymodule.mod mymodule.te
- seinfo --allow
Correct answer: audit2allow -M mymodule
audit2allow -M reads AVC denials, generates a .te source and compiles it into a loadable .pp module in one step.
Question 6: After loading a custom SELinux module with 'semodule -i custom.pp', how do you verify it is loaded?
- semodule -l | grep custom (Correct answer)
- restorecon -v / | grep custom
- sestatus | grep custom
- audit2why | grep custom
Correct answer: semodule -l | grep custom
semodule -l lists all installed policy modules; grep filters for the specific module name.
Question 7: Which boolean enables NFS home directories to work correctly with SELinux for user logins?
- nfs_export_all_ro
- use_nfs_home_dirs (Correct answer)
- nfs_home_dir_rw
- allow_nfs_logins
Correct answer: use_nfs_home_dirs
use_nfs_home_dirs allows confined user domains to access home directories mounted via NFS.
RHCSA RHCSA SELinux Contexts and Booleans 4
A service fails and audit.log shows 'type=AVC msg=audit: denied { name_connect } for pid=1234 comm="httpd"'.
What does 'name_connect' indicate?