RHCSA RHCSA SELinux Contexts and Booleans 5

Question 1

A script running as cron_t needs to write to /var/log/myapp.log. The file has type var_log_t. What should you do to allow this properly?

Accepted Answer

Use audit2allow to create a module allowing cron_t write to var_log_t

Answer

When no standard boolean covers the case, audit2allow creates a minimal targeted policy allowing the specific cron_t write to var_log_t.

Question 2

Which SELinux user is typically mapped to the Linux root account in the targeted policy?

Accepted Answer

unconfined_u

Answer

In the targeted policy, root logs in as unconfined_u, giving it the unconfined_t domain and effectively unrestricted access.

Question 3

You copy /etc/passwd to /srv/myapp/passwd. What SELinux context will the copy have by default?

Accepted Answer

The context matching the destination directory: var_t or srv_t

Answer

cp inherits the destination directory's context for new files unless --preserve=context is specified.

Question 4

Which command shows the SELinux context of a running process?

Accepted Answer

ps auxZ | grep httpd

Answer

ps auxZ adds a column showing the SELinux security context (domain) of each running process.

Question 5

What is the purpose of the 'object_r' role seen in file SELinux contexts like 'system_u:object_r:httpd_sys_content_t:s0'?

Accepted Answer

It is a placeholder role used for filesystem objects since roles apply only to subjects

Answer

Roles are meaningful only for subjects (processes); object_r is the conventional placeholder role for all filesystem objects.

RHCSA Exam Practice Test