RHCSA SELinux Contexts and Booleans Questions and Answers — Questions and Answers
Question 1: A web administrator moves a new website's content from their home directory to `/srv/www/content` using the `mv` command. Standard file permissions are correct, but the website is returning '403 Forbidden' errors. An `ls -Z` on the content reveals the context `unconfined_u:object_r:user_home_t:s0`. Which command will fix the context issue for the existing files and ensure new files created in that directory get the correct context?
- chcon -R -t httpd_sys_content_t /srv/www/content
- setenforce 0
- semanage fcontext -a -t httpd_sys_content_t "/srv/www/content(/.*)?" && restorecon -Rv /srv/www/content (Correct answer)
- chmod -R 755 /srv/www/content
Correct answer: semanage fcontext -a -t httpd_sys_content_t "/srv/www/content(/.*)?" && restorecon -Rv /srv/www/content
Moving files (`mv`) preserves the original SELinux context (`user_home_t`), which httpd cannot read by default. The `semanage fcontext` command permanently adds a rule for the `/srv/www/content` directory and its contents to have the `httpd_sys_content_t` type. The subsequent `restorecon -Rv` command applies this newly defined rule to the existing files and directories. `chcon` would only provide a temporary fix that would not survive a system relabel. `setenforce 0` disables SELinux, which is a security risk and not the proper solution. `chmod` only affects standard Linux permissions, not the SELinux context.
Question 2: What is the primary difference between SELinux's 'enforcing' and 'permissive' modes?
- Enforcing mode logs denials but allows actions, while permissive mode blocks and logs actions.
- There is no functional difference; permissive is just an alias for enforcing.
- Permissive mode completely disables SELinux, while enforcing mode enables it.
- Enforcing mode blocks and logs policy violations, while permissive mode only logs them without blocking. (Correct answer)
Correct answer: Enforcing mode blocks and logs policy violations, while permissive mode only logs them without blocking.
In 'enforcing' mode, SELinux actively enforces the security policy, meaning it will both log the AVC denial and block the disallowed action. In 'permissive' mode, SELinux does not enforce the policy; it allows the action to proceed but still logs the AVC denial message. This makes permissive mode a useful tool for troubleshooting and policy development.
Question 3: A system administrator needs to allow the Apache web server (httpd) to serve content from user home directories. After verifying file permissions are correct, access is still denied by SELinux. Which of the following commands is the most appropriate and secure way to grant this specific capability?
- semanage fcontext -a -t httpd_sys_content_t "/home(/.*)?"
- setsebool -P httpd_enable_homedirs on (Correct answer)
- setenforce Permissive
- chcon -R httpd_sys_content_t /home
Correct answer: setsebool -P httpd_enable_homedirs on
SELinux uses booleans as on/off switches for specific policies. The `httpd_enable_homedirs` boolean is designed specifically to allow the httpd process to access user home directories. Using `setsebool -P` enables this boolean and makes the change persistent across reboots. Changing the context of the entire `/home` directory is incorrect and would cause significant system-wide problems. Setting SELinux to permissive mode or disabling it would solve the immediate issue but would weaken the overall security of the system.
Question 4: Which command is used to make a temporary, non-persistent change to an SELinux boolean value?
- getsebool httpd_can_sendmail on
- semanage boolean -m --on httpd_can_sendmail
- setsebool -P httpd_can_sendmail on
- setsebool httpd_can_sendmail on (Correct answer)
Correct answer: setsebool httpd_can_sendmail on
The `setsebool` command is used to change the value of an SELinux boolean. When used without the `-P` flag, the change is temporary and will revert to the default setting upon reboot. The `-P` flag makes the change persistent. `getsebool` is used to view booleans, not set them. `semanage boolean` is an alternative for persistent changes.
Question 5: An SELinux AVC denial has been logged in `/var/log/audit/audit.log`. A system administrator wants to see a human-readable translation of the denial, including a potential solution. Which of the following tools is best suited for this purpose?
- ausearch -m AVC
- sealert -a /var/log/audit/audit.log (Correct answer)
- journalctl -t audit
- cat /var/log/audit/audit.log | grep 'denied'
Correct answer: sealert -a /var/log/audit/audit.log
The `sealert` tool, part of the `setroubleshoot-server` package, is specifically designed to analyze audit logs, find AVC denials, and provide clear, human-readable explanations and suggested solutions, such as relabeling a file or enabling a boolean. While `ausearch` and `grep` can find the denial messages, they do not interpret them or provide solutions.
Question 6: After using `semanage fcontext` to define a new default context for the `/data/mysql` directory, the administrator runs `ls -Z /data/mysql` and sees the old context is still applied. What command must be run next to apply the newly defined default context to the existing directory and its contents?
- chcon -R -t new_context_t /data/mysql
- semodule -B
- touch /.autorelabel && reboot
- restorecon -Rv /data/mysql (Correct answer)
Correct answer: restorecon -Rv /data/mysql
The `semanage fcontext` command only updates the SELinux file context database; it does not change the context of any existing files. The `restorecon` command reads this database and restores files to their default context. The `-R` flag makes it recursive, and `-v` makes it verbose, showing which files are being relabeled.
RHCSA SELinux Contexts and Booleans Questions and Answers
A web administrator moves a new website's content from their home directory to `/srv/www/content` using the `mv` command.
Standard file permissions are correct, but the website is returning '403 Forbidden' errors.
An `ls -Z` on the content reveals the context `unconfined_u:object_r:user_home_t:s0`.
Which command will fix the context issue for the existing files and ensure new files created in that directory get the correct context?