RHCSA RHCSA SELinux Contexts and Booleans 4

Question 1

A service fails and audit.log shows 'type=AVC msg=audit: denied { name_connect } for pid=1234 comm="httpd"'. What does 'name_connect' indicate?

Accepted Answer

Apache attempted an outbound TCP connection to a remote port

Answer

name_connect is the SELinux permission checked when a process initiates an outbound TCP connection to a specific port number.

Question 2

Which command would you use to add port 8888 to the http_port_t SELinux type so Apache can listen on it?

Accepted Answer

semanage port -a -t http_port_t -p tcp 8888

Answer

semanage port -a adds a port-to-type mapping; without it, Apache is denied the bind permission on non-standard ports.

Question 3

What does 'semanage permissive -a httpd_t' do?

Accepted Answer

Puts only the httpd_t domain into permissive mode while the rest of the system remains enforcing

Answer

Per-domain permissive mode lets a single type run unrestricted and log denials without affecting the enforcement of other domains.

Question 4

The command 'ls -Z /var/www/html/app.php' shows 'user_home_t'. What is the quickest correct fix?

Accepted Answer

restorecon /var/www/html/app.php

Answer

restorecon resets the file to the context already defined for /var/www/html in the policy database, which is httpd_sys_content_t.

Question 5

Which tool generates a loadable SELinux policy module (.pp file) from AVC denial messages?

Accepted Answer

audit2allow -M mymodule

Answer

audit2allow -M reads AVC denials, generates a .te source and compiles it into a loadable .pp module in one step.

RHCSA Exam Practice Test