nerdexam
CompTIA

LX0-104 · Question #388

An unprivileged user issued a command which produced the following log message: avc: denied { getattr } for pid=984 exe=/usr/bin/vim path=/etc/shadow dev=03:01 ino=134343 scontext=hugh:user_r:user_t t

The correct answer is A. User hugh was not running in a security context that permitted reading the file.. The SELinux AVC denial message indicates that the user hugh, operating under the user_t domain, was denied permission to perform the getattr operation on the /etc/shadow file, which has the shadow_t type.

Security

Question

An unprivileged user issued a command which produced the following log message: avc: denied { getattr } for pid=984 exe=/usr/bin/vim path=/etc/shadow dev=03:01 ino=134343 scontext=hugh:user_r:user_t tcontext=system_u:object_r:shadow_t tclass=file What does the message mean?

Options

  • AUser hugh was not running in a security context that permitted reading the file.
  • BUser hugh only needs to switch to the object_r role in order to edit /etc/shadow.
  • CThe security context for hugh is misconfigured and needs access to read any system file.
  • DUser hugh was not running in a security context that permitted writing to the file.

How the community answered

(32 responses)
  • A
    66% (21)
  • B
    19% (6)
  • C
    9% (3)
  • D
    6% (2)

Why each option

The SELinux AVC denial message indicates that the user `hugh`, operating under the `user_t` domain, was denied permission to perform the `getattr` operation on the `/etc/shadow` file, which has the `shadow_t` type.

AUser hugh was not running in a security context that permitted reading the file.Correct

The `getattr` permission in SELinux refers to retrieving file attributes, which includes reading metadata and often implies an attempt to access or read the file itself. The denial shows that the source context (`scontext=hugh:user_r:user_t`) lacked the necessary permissions to perform this operation on the target file (`tcontext=system_u:object_r:shadow_t`), thus preventing access.

BUser hugh only needs to switch to the object_r role in order to edit /etc/shadow.

`object_r` is a role for objects (files), not a role for users to switch into; user roles are like `user_r`, `sysadm_r`.

CThe security context for hugh is misconfigured and needs access to read any system file.

While `hugh`'s context prevented access, the message doesn't inherently imply misconfiguration or a need for broad system file access; it's a standard SELinux access control enforcement.

DUser hugh was not running in a security context that permitted writing to the file.

The denied operation is `getattr` (get attributes), not `write`, which would be explicitly listed as `write` or similar operations if write access was denied.

Concept tested: Interpreting SELinux AVC denial messages

Source: https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/selinux/SELinux_Troubleshooting/#Troubleshooting_SELinux_Denials_Troubleshooting_SELinux_Denials

Topics

#SELinux#access denied#log analysis#security context

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LX0-104 Practice