XK0-004 · Question #384
A Linux administrator is configuring a web server that connects to an external SQL database. However, after starting the web application, the logs are show an error message: Which of the following is
The correct answer is C. sed -1 s/'SELINUX. ' /SELINUXpermissive// etc/selinux/config. SELinux is blocking the web application from connecting to the external SQL database. Changing SELinux to permissive mode in the config file removes the enforcement that is causing the connection error.
Question
A Linux administrator is configuring a web server that connects to an external SQL database. However, after starting the web application, the logs are show an error message:
Which of the following is the BEST way to resolve this issue?
Options
- Aecho 0> seLinux/enforce
- Brestorecon -rv /var/www/ html
- Csed -1 s/'SELINUX. ' /SELINUXpermissive// etc/selinux/config
- Dsetseboo1 -p http-can-network_connect_db 1
How the community answered
(39 responses)- A5% (2)
- B13% (5)
- C79% (31)
- D3% (1)
Why each option
SELinux is blocking the web application from connecting to the external SQL database. Changing SELinux to permissive mode in the config file removes the enforcement that is causing the connection error.
Writing 0 to seLinux/enforce would temporarily disable enforcement at runtime but uses an incorrect relative path and does not persist after a reboot, making it an unreliable fix.
restorecon -rv /var/www/html restores file context labels for web content but does not address SELinux network boolean restrictions that block outbound database connections.
The sed command modifies /etc/selinux/config to set SELINUX=permissive, which transitions SELinux from enforcing mode to permissive mode persistently across reboots. In permissive mode, SELinux logs policy violations but does not block them, allowing the web application to connect to the external database. This is a system-wide configuration change that survives reboots, making it a durable fix.
While setsebool -p httpd_can_network_connect_db 1 would be the targeted fix for this scenario, the option as written contains a typo in the command name (setseboo1 with a digit) and an incorrect boolean name (http-can-network_connect_db), making it syntactically invalid.
Concept tested: SELinux permissive mode configuration for web services
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/changing-selinux-states-and-modes_using-selinux
Topics
Community Discussion
No community discussion yet for this question.