Which of the following statement are true regarding SELinux on FreelPA nodes? (Choose two.)

Question

Options

• AIn FreeIPA, SELinux User Maps map FreeIPA domain users to SELinux users.
• BFreeIPA never creates or modifies SELinux contexts on a FreeIPA client.
• CSELinux roles can be configured per host, per host group, or based on an HBAC rule in FreeIPA.
• DSELinux policies are dynamically created based on domain-wide FreeIPA NFSv4 ACLs.
• EFreeIPA can not define how users and systems are handled by SELinux.

• A
  73% (16)
• B
  5% (1)
• D
  9% (2)
• E
  14% (3)

Explanation

FreeIPA's SELinux User Maps (managed via ipa selinuxusermap-* commands) are a core feature that assigns SELinux user contexts (e.g., staff_u, guest_u) to FreeIPA domain users when they log into a client - making A correct. These maps gain additional power through their targeting flexibility: they can be applied to a specific host, a host group, or triggered by an existing HBAC rule, which is exactly what C describes.

B is false because SSSD (the IPA client daemon) actively applies SELinux user contexts at login time by reading the User Maps from the IPA directory - FreeIPA clients absolutely modify SELinux context assignments. D is false because SELinux policies are statically defined by the OS policy packages; they are not dynamically generated from NFSv4 ACLs, which are an entirely separate access-control layer. E is false for the same reason as B - FreeIPA provides explicit mechanisms (SELinux User Maps) to influence SELinux behavior for domain users.

Memory tip: Think of it as two halves of one feature - what it does (maps domain users to SELinux users = A) and where it applies (per host, host group, or HBAC rule = C). The wrong options either deny that this feature exists (B, E) or invent a non-existent dynamic-policy mechanism (D).

No community discussion yet for this question.