327.2 Mandatory Access Control (weight: 4) LPIC-3-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A file at /var/www/html/index.html has the SELinux context 'system_u:object_r:httpd_sys_content_t:s0'. An administrator copies a new version of the file from a home directory to /var/www/html/. The new file has the context 'unconfined_u:object_r:user_home_t:s0'. Users report that the website is now returning a 403 Forbidden error. What is the most likely cause and the correct fix?

   • AThe file's SELinux user is unconfined_u, which is not allowed. Run chcon -u system_u on the file.
   • BThe file's SELinux level is s0, which is too low. Run chcon -l s0:c0.c1023 on the file.
   • CThe file's type is user_home_t, which httpd_t cannot read. Run restorecon on the file.
   • DThe file's SELinux role is object_r, which is incorrect. Run chcon -r object_r on the file.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which command is used to change the SELinux type of a file without modifying its user or role?

   • Achcon -t
   • Bchmod
   • Cchown
   • Dsetsebool
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A Linux administrator is troubleshooting a custom daemon that fails to start on a CentOS 7 system. The system log shows 'SELinux is preventing /usr/local/bin/customd from using the execmem access on a process.' The administrator wants to identify the exact denial and the recommended fix. Which command should the administrator run first?

   • Asetsebool -P allow_execmem on
   • Bgetenforce
   • Crestorecon -v /usr/local/bin/customd
   • Dausearch -m AVC -ts recent
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which log file contains SELinux denial messages by default?

   • A/var/log/secure
   • B/var/log/audit/audit.log
   • C/var/log/messages
   • D/var/log/selinux.log
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In the context of SELinux, what is the primary role of Role-Based Access Control (RBAC)?

   • AIt defines which network ports a service may listen on.
   • BIt determines the priority of processes in the CPU scheduler.
   • CIt associates each Linux user with one or more roles, and each role is authorized to enter specific domains.
   • DIt restricts which file types a process can read based on the file's owner.
   Reveal Solution Discussion Select an answer first