RHCSA RHCSA SELinux Contexts and Booleans 2 — Questions and Answers
Question 1: Which command permanently changes the SELinux context of a file so it survives a relabel?
- chcon -t httpd_sys_content_t /var/www/html/index.html
- semanage fcontext -a -t httpd_sys_content_t '/var/www/html/index.html' (Correct answer)
- restorecon -v /var/www/html/index.html
- setfattr -n security.selinux /var/www/html/index.html
Correct answer: semanage fcontext -a -t httpd_sys_content_t '/var/www/html/index.html'
semanage fcontext writes a persistent policy rule; chcon only sets the label temporarily and it is lost on relabel.
Question 2: A web server cannot read files copied from /root/docs/ to /var/www/html/. Audit2allow suggests allowing the access. What should you check FIRST?
- Run audit2allow -M and load the custom module
- Verify the file context with ls -Z and run restorecon (Correct answer)
- Disable SELinux temporarily and test
- Add the httpd_t domain to the permissive list
Correct answer: Verify the file context with ls -Z and run restorecon
Files copied from /root retain the user_home_t context; restorecon resets them to the correct httpd_sys_content_t label before writing any new policy.
Question 3: What is the effect of running 'touch /.autorelabel' and rebooting?
- SELinux is disabled on the next boot
- All filesystem objects are relabeled according to the current policy on next boot (Correct answer)
- Only /etc and /var are relabeled
- SELinux booleans are reset to their defaults
Correct answer: All filesystem objects are relabeled according to the current policy on next boot
The presence of /.autorelabel triggers a full filesystem relabel during the next boot using the active policy.
Question 4: Which SELinux boolean allows Apache to connect to a network database like MariaDB?
- httpd_can_network_connect (Correct answer)
- httpd_enable_cgi
- httpd_use_nfs
- httpd_can_network_relay
Correct answer: httpd_can_network_connect
httpd_can_network_connect permits Apache to initiate outbound TCP connections, including to database ports.
Question 5: You need to allow the FTP daemon to read files in home directories. Which boolean should you enable?
- ftp_home_dir (Correct answer)
- allow_ftpd_full_access
- ftpd_use_passive_mode
- use_samba_home_dirs
Correct answer: ftp_home_dir
The ftp_home_dir boolean grants vsftpd read access to user home directories under SELinux.
Question 6: Which command lists all currently active SELinux boolean values along with their descriptions?
- getsebool -a
- semanage boolean -l (Correct answer)
- sestatus -b
- seinfo --bool
Correct answer: semanage boolean -l
semanage boolean -l shows each boolean, its current and default state, and a human-readable description.
Question 7: A custom application writes logs to /opt/myapp/logs/. After setting the correct SELinux context with semanage fcontext, what command applies the new context to existing files?
- chcon -R --reference /var/log /opt/myapp/logs/
- restorecon -Rv /opt/myapp/logs/ (Correct answer)
- semanage fcontext -R /opt/myapp/logs/
- fixfiles relabel /opt/myapp/logs/
Correct answer: restorecon -Rv /opt/myapp/logs/
restorecon -Rv recursively applies the contexts defined in the policy database to existing files, and -v reports changes.
RHCSA RHCSA SELinux Contexts and Booleans 2
Which command permanently changes the SELinux context of a file so it survives a relabel?