Describe Basic SELinux Use Cases F5N4 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A developer created a new directory /srv/nginx-content and moved website files into it. NGINX is configured with root /srv/nginx-content;. The site returns 403 Forbidden. The audit log shows: 'avc: denied { getattr } for pid=1234 comm="nginx" name="/" dev="dm-0" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir'. What is the correct fix?

   • AChange the directory ownership to nginx:nginx with chown -R nginx:nginx /srv/nginx-content.
   • BEnable the httpd_read_user_content boolean to allow access to custom directories.
   • CRun setsebool -P httpd_unified 1 to allow httpd to access all file types.
   • DApply the httpd_sys_content_t type to the directory and its contents with semanage fcontext and restorecon.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An NGINX server on RHEL 9 was working normally until a security patch was applied. Now, when clients connect to the site, they receive a 502 Bad Gateway error. The NGINX error log shows 'connect() to 127.0.0.1:8080 failed (13: Permission denied)'. The upstream application on port 8080 is confirmed listening and reachable via curl from the shell. What is the most likely cause and the first diagnostic step?

   • ANGINX worker processes lost their file contexts after the patch; restorecon -Rv /etc/nginx is needed.
   • BThe upstream service changed its SELinux type; the fix is to setsebool -P httpd_can_network_connect 1 immediately.
   • CThe firewall is blocking the loopback interface; check iptables rules for port 8080.
   • DSELinux is blocking NGINX from making the outbound network connection; run ausearch -m avc -ts recent to confirm.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security audit requires documentation of the SELinux context of the NGINX binary and its configuration files. Which command provides the context for the NGINX binary, and what type should it have on a standard RHEL system?

   • Asemanage fcontext -l | grep nginx; the expected type is usr_t.
   • Bls -Z /usr/sbin/nginx; the expected type is httpd_exec_t.
   • Cstat -c %C /usr/sbin/nginx; the expected type is bin_t.
   • Dgetenforce /usr/sbin/nginx; the expected type is httpd_t.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An NGINX server is failing to proxy requests to a backend on port 8443. The audit log shows: 'avc: denied { name_connect } for pid=1234 comm="nginx" dest=8443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket'. The admin has already enabled httpd_can_network_connect, but the denial persists. What is the most likely reason and the correct next step?

   • AThe backend is on a different host, so the boolean does not apply; use a custom policy instead.
   • BThe NGINX process needs a restart to pick up the boolean change; run systemctl restart nginx.
   • CThe port 8443 is labeled http_cache_port_t, and the boolean does not override port type restrictions; add 8443 to http_port_t with semanage port.
   • DThe boolean was not applied persistently; run setsebool -P httpd_can_network_connect 1 again.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An administrator needs to allow NGINX to make outbound network connections to a backend server. What is the recommended method to resolve this SELinux denial?

   • AEnable the httpd_can_network_connect boolean
   • BChange the NGINX process type to unconfined_t
   • CCreate a custom port rule with semanage
   • DSet SELinux to Permissive mode permanently
   Reveal Solution Discussion Select an answer first