LFCS · Question #390
How are SELinux permissions related to standard Linux permissions?
The correct answer is D. SELinux permissions are verified after standard Linux permissions. Both standard Linux Discretionary Access Control (DAC) permissions and SELinux Mandatory Access Control (MAC) permissions must be satisfied for an action to be allowed, with SELinux checks occurring after the initial DAC checks.
Question
Options
- ASELinux permissions override standard Linux permissions.
- BStandard Linux permissions override SELinux permissions.
- CSELinux permissions are verified before standard Linux permissions.
- DSELinux permissions are verified after standard Linux permissions.
How the community answered
(51 responses)- A2% (1)
- B8% (4)
- C4% (2)
- D86% (44)
Why each option
Both standard Linux Discretionary Access Control (DAC) permissions and SELinux Mandatory Access Control (MAC) permissions must be satisfied for an action to be allowed, with SELinux checks occurring after the initial DAC checks.
SELinux permissions do not override standard Linux permissions; both must grant access. If either denies access, the operation is denied.
Standard Linux permissions do not override SELinux permissions; both must grant access.
SELinux permissions are verified *after* standard Linux permissions, not before.
When an access attempt is made, the Linux kernel first checks the traditional Discretionary Access Control (DAC) permissions (owner, group, others, and ACLs). If the DAC check passes, then the SELinux Mandatory Access Control (MAC) policy is consulted. Both sets of permissions must grant access for the operation to proceed, effectively making SELinux an additional layer of security.
Concept tested: SELinux and DAC interaction order
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/what-is-selinux_using-selinux#selinux-and-standard-linux-permissions_what-is-selinux
Topics
Community Discussion
No community discussion yet for this question.