Describe Basic SELinux Use Cases F5N4 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An administrator wants to list all SELinux booleans that affect the httpd_t type. Which command displays this information?

   • Asetsebool -P httpd_can_network_connect 1
   • Bsemanage boolean -l | grep httpd
   • Cgetsebool -a | grep httpd
   • Daudit2why -a | grep httpd
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which SELinux mode provides the highest level of security by actively blocking unauthorized operations and logging them?

   • APermissive
   • BStrict
   • CEnforcing
   • DDisabled
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An NGINX server hosts a PHP application that writes uploads to /var/www/uploads. The directory is labeled httpd_sys_content_t, and the PHP-FPM process runs in httpd_t. Uploads fail with 'Permission denied' in the PHP error log. ausearch shows an AVC denial for httpd_t trying to write to a directory labeled httpd_sys_content_t. The admin wants to allow writes while keeping the directory readable by NGINX for serving. What is the best solution?

   • ASet the boolean httpd_unified with setsebool -P httpd_unified 1.
   • BCreate a custom policy module with audit2allow -M mypolicy to allow the specific write access.
   • CChange the directory label to httpd_sys_rw_content_t using semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/uploads(/.*)?' and restorecon.
   • DChange the directory ownership to nginx:nginx and set permissions to 777.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An NGINX server is configured to serve files from a directory mounted from an NFS share. Clients receive 403 Forbidden, and the audit log shows: 'avc: denied { read } for pid=1234 comm="nginx" name="index.html" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file'. What is the most appropriate fix?

   • AEnable the httpd_use_nfs boolean with setsebool -P httpd_use_nfs 1.
   • BChange the NFS mount options to include context="system_u:object_r:httpd_sys_content_t:s0".
   • CSet the httpd_can_network_connect boolean to allow access to the NFS server.
   • DRun restorecon -Rv /mnt/nfs to relabel the files to httpd_sys_content_t.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An NGINX server is failing to start. The system log shows: 'avc: denied { name_bind } for pid=1234 comm="nginx" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket'. NGINX is configured to listen on port 8080. What is the correct fix?

   • AChange NGINX to listen on port 80, which is already allowed.
   • BEnable the httpd_can_network_connect boolean.
   • CAdd port 8080 to the http_port_t type with semanage port -a -t http_port_t -p tcp 8080.
   • DRun restorecon -Rv /etc/nginx to fix the NGINX configuration file contexts.
   Reveal Solution Discussion Select an answer first