Describe Basic SELinux Use Cases F5N4 Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A developer copied a new static website into /opt/webcontent/ using rsync from a staging server. NGINX is configured with root /opt/webcontent; and the files have 755 permissions owned by root. When browsing the site, NGINX returns 403 Forbidden. The NGINX error log shows 'open() "/opt/webcontent/index.html" failed (13: Permission denied)'. What is the most likely cause and the correct fix?

   • AThe files have the wrong SELinux type; run restorecon -Rv /opt/webcontent to apply the httpd_sys_content_t type.
   • BThe files are owned by the wrong user; change ownership to the nginx user with chown nginx:nginx /opt/webcontent.
   • CThe SELinux boolean httpd_read_user_content is off; enable it with setsebool -P httpd_read_user_content 1.
   • DThe directory is on a filesystem mounted with noexec; remount with exec in /etc/fstab.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An administrator pipes an SELinux denial message into audit2why. What is the primary purpose of this command?

   • ATo automatically apply a fix for the denial
   • BTo change the SELinux mode to Permissive
   • CTo explain the denial and suggest a possible fix
   • DTo list all SELinux denials in the audit log
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   An administrator wants to view the SELinux security context of an NGINX configuration file. Which command displays this information?

   • Aps -Z /etc/nginx/nginx.conf
   • Bgetenforce /etc/nginx/nginx.conf
   • Cchcon /etc/nginx/nginx.conf
   • Dls -Z /etc/nginx/nginx.conf
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An NGINX server runs a custom module that opens a Unix domain socket in /var/run/nginx-custom.sock. The module fails to create the socket, and ausearch shows: 'avc: denied { create } for pid=1234 comm="nginx" name="nginx-custom.sock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file'. The admin wants a solution that is persistent across reboots and minimal in scope. What is the best approach?

   • ASet the boolean httpd_builtin_scripting with setsebool -P httpd_builtin_scripting 1.
   • BRun chcon -t httpd_var_run_t /var/run/nginx-custom.sock before NGINX starts.
   • CCreate a custom policy module with audit2allow -M nginx_custom and load it with semodule -i nginx_custom.pp.
   • DChange the socket path to /tmp/nginx-custom.sock, which is already writable by httpd_t.
   Reveal Solution Discussion Select an answer first