How are SELinux permissions related to standard Linux permissions? (Choose TWO correct answers.)

Question

Options

• ASELinux permissions override standard Linux permissions.
• BStandard Linux permissions override SELinux permissions.
• CSELinux permissions are verified before standard Linux permissions.
• DSELinux permissions are verified after standard Linux permissions.

• A
  11% (2)
• B
  83% (15)
• C
  6% (1)

Explanation

Standard Linux DAC (Discretionary Access Control) permissions are checked first, and only if they grant access does the kernel then consult SELinux. This makes D correct - SELinux is verified after standard permissions - and B correct - a standard Linux denial stops the chain entirely, effectively overriding SELinux (SELinux cannot grant access that DAC has already denied).

A is wrong because the relationship is the reverse: SELinux cannot bypass or override a DAC denial; it can only add further restrictions. C is wrong because it describes the order backwards - SELinux is the second gate, not the first.

Memory tip: Picture a two-checkpoint security line. You must pass the standard Linux guard first; if you're turned away there, you never even reach the SELinux guard. Only after clearing the first checkpoint can the second one make a decision - and it can only say no, never yes on behalf of the first.

No community discussion yet for this question.