nerdexam
CompTIA

LX0-104 · Question #393

An SELinux security context is required to ensure that all files in /opt have the default context of system_u:object_r:usr_t. How should the corresponding configuration entry be formatted?

The correct answer is B. /opt/.* system_u:object_r:usr_t. SELinux file context configuration entries typically specify the regular expression matching the file path followed by the desired security context.

Security

Question

An SELinux security context is required to ensure that all files in /opt have the default context of system_u:object_r:usr_t. How should the corresponding configuration entry be formatted?

Options

  • Asystem_u:object_r:usr_t /opt/*
  • B/opt/.* system_u:object_r:usr_t
  • C/opt/* system_u:object_r:usr_t
  • Dsystem_u:object_r:usr_t: /opt/.*
  • Esystem_u:object_r:usr_t /opt/.*

How the community answered

(37 responses)
  • A
    5% (2)
  • B
    78% (29)
  • C
    3% (1)
  • D
    3% (1)
  • E
    11% (4)

Why each option

SELinux file context configuration entries typically specify the regular expression matching the file path followed by the desired security context.

Asystem_u:object_r:usr_t /opt/*

This option has the order of the context and path reversed.

B/opt/.* system_u:object_r:usr_tCorrect

In SELinux file context configuration files (like those used by `semanage fcontext`), the correct format specifies a regular expression for the file path, followed by the desired security context. The `/opt/.*` regular expression correctly matches `/opt` itself and all files and subdirectories within it, while `system_u:object_r:usr_t` is the full specified context.

C/opt/* system_u:object_r:usr_t

While `/opt/*` could match immediate children, `/opt/.*` is more robust for matching the directory itself and all its contents recursively in SELinux contexts, and the order is reversed.

Dsystem_u:object_r:usr_t: /opt/.*

This option has the order reversed and includes an extra colon after the context.

Esystem_u:object_r:usr_t /opt/.*

This option has the order of the context and path reversed.

Concept tested: SELinux file context configuration format

Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-selinux_users_and_administrators_guide-changing_contexts-persistent_changes_semanage_fcontext

Topics

#SELinux#file context#configuration

Community Discussion

No community discussion yet for this question.

Full LX0-104 Practice