nerdexam
Linux_Foundation

LFCS · Question #388

An unprivileged user issued a command which produced the following log message: avc: denied { getattr } for pid=984 exe=/usr/bin/vim path=/etc/shadow dev=03:01 ino=134343 scontext=hugh:user_r:user_t…

The correct answer is A. User hugh was not running in a security context that permitted reading the file. The SELinux AVC denial message indicates that user 'hugh' (running in user_r:user_t context) was denied the getattr permission on the /etc/shadow file, meaning their current security context does not allow reading its attributes.

Submitted by certguy· Apr 18, 2026Operation of Running Systems

Question

An unprivileged user issued a command which produced the following log message: avc: denied { getattr } for pid=984 exe=/usr/bin/vim path=/etc/shadow dev=03:01 ino=134343 scontext=hugh:user_r:user_t tcontext=system_u:object_r:shadow_t tclass=file What does the message mean?

Options

  • AUser hugh was not running in a security context that permitted reading the file.
  • BUser hugh only needs to switch to the object_r role in order to edit /etc/shadow.
  • CThe security context for hugh is misconfigured and needs access to read any system file.
  • DUser hugh was not running in a security context that permitted writing to the file.

How the community answered

(24 responses)
  • A
    92% (22)
  • C
    4% (1)
  • D
    4% (1)

Why each option

The SELinux AVC denial message indicates that user 'hugh' (running in `user_r:user_t` context) was denied the `getattr` permission on the `/etc/shadow` file, meaning their current security context does not allow reading its attributes.

AUser hugh was not running in a security context that permitted reading the file.Correct

The `avc: denied` message explicitly states `{{ getattr }}`, which is an access vector permission related to getting attributes or, broadly, reading metadata about a file. The `scontext=hugh:user_r:user_t` indicates the security context of the user, and `tcontext=system_u:object_r:shadow_t` is the context of `/etc/shadow`. The denial means the policy forbids the `user_t` domain from performing `getattr` on `shadow_t` files.

BUser hugh only needs to switch to the object_r role in order to edit /etc/shadow.

The `object_r` is typically a role for objects, not users, and switching to `object_r` is not a standard or correct way for a user to gain access; furthermore, the specific denial is `getattr`, not editing.

CThe security context for hugh is misconfigured and needs access to read any system file.

While a denial might indicate a policy issue or misconfiguration in a broader sense, stating that the user "needs access to read *any* system file" is too broad and incorrect; SELinux aims to restrict, not grant universal access. The issue is with a specific permission on a specific file.

DUser hugh was not running in a security context that permitted writing to the file.

The log message clearly indicates `{{ getattr }}` as the denied permission, not a write operation. Write operations would typically involve permissions like `write`, `setattr`, or `open` with write flags.

Concept tested: SELinux AVC denial message interpretation

Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-troubleshooting-interpreting_denials.html

Topics

#SELinux#Access Control#AVC message#Security Context

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LFCS Practice