RHCSA RHCSA SELinux Contexts and Booleans 5 — Questions and Answers
Question 1: A script running as cron_t needs to write to /var/log/myapp.log. The file has type var_log_t. What should you do to allow this properly?
- Set the file context to cron_log_t and run restorecon
- Set the boolean allow_cron_write_log to on
- Use audit2allow to create a module allowing cron_t write to var_log_t (Correct answer)
- Change the file to /tmp/myapp.log where cron can write freely
Correct answer: Use audit2allow to create a module allowing cron_t write to var_log_t
When no standard boolean covers the case, audit2allow creates a minimal targeted policy allowing the specific cron_t write to var_log_t.
Question 2: Which SELinux user is typically mapped to the Linux root account in the targeted policy?
- root_u
- sysadm_u
- unconfined_u (Correct answer)
- system_u
Correct answer: unconfined_u
In the targeted policy, root logs in as unconfined_u, giving it the unconfined_t domain and effectively unrestricted access.
Question 3: You copy /etc/passwd to /srv/myapp/passwd. What SELinux context will the copy have by default?
- The source file's context: passwd_file_t
- The context matching the destination directory: var_t or srv_t (Correct answer)
- No context (unlabeled_t)
- The context of the shell that ran cp: unconfined_t
Correct answer: The context matching the destination directory: var_t or srv_t
cp inherits the destination directory's context for new files unless --preserve=context is specified.
Question 4: Which command shows the SELinux context of a running process?
- ps auxZ | grep httpd (Correct answer)
- ls -Z /proc/<pid>
- secon -p <pid>
- sestatus --process <pid>
Correct answer: ps auxZ | grep httpd
ps auxZ adds a column showing the SELinux security context (domain) of each running process.
Question 5: What is the purpose of the 'object_r' role seen in file SELinux contexts like 'system_u:object_r:httpd_sys_content_t:s0'?
- It grants the object read-only access
- It is a placeholder role used for filesystem objects since roles apply only to subjects (Correct answer)
- It indicates the object belongs to the root role
- It means the file is owned by system processes
Correct answer: It is a placeholder role used for filesystem objects since roles apply only to subjects
Roles are meaningful only for subjects (processes); object_r is the conventional placeholder role for all filesystem objects.
Question 6: An administrator sets 'setsebool -P httpd_execmem on'. What risk does this boolean introduce?
- It allows Apache to execute files in /tmp
- It permits Apache to allocate memory that is both writable and executable, increasing the attack surface (Correct answer)
- It lets Apache bypass DAC file permissions
- It enables Apache to send raw network packets
Correct answer: It permits Apache to allocate memory that is both writable and executable, increasing the attack surface
httpd_execmem allows the httpd domain to use execmem, which enables write-then-execute memory patterns exploited by shellcode injection.
Question 7: Which command removes a custom semanage fcontext rule that was previously added for /opt/myapp(/.*)?
- semanage fcontext -d '/opt/myapp(/.*)?' (Correct answer)
- semanage fcontext -r '/opt/myapp(/.*)?'
- restorecon -D '/opt/myapp(/.*)?'
- chcon --remove '/opt/myapp(/.*)?'
Correct answer: semanage fcontext -d '/opt/myapp(/.*)?'
semanage fcontext -d deletes a previously added file context rule from the persistent policy database.
RHCSA RHCSA SELinux Contexts and Booleans 5
A script running as cron_t needs to write to /var/log/myapp.log.
The file has type var_log_t.
What should you do to allow this properly?