A Linux administrator is helping the security team troubleshoot an SELinux policy violation incident. Which of the following would be the BEST utility command to display SELinux violation and AVC…

The correct answer is B. sealert -a /var/log/audit/audit.log. You can investigate SELinux issues without any tools by opening the audit log it generates. This log is found at /var/log/audit/audit.log. To run sealert from the command-line, we need to point it to the SELinux audit log. sealert -a /var/log/audit/audit.log

Troubleshooting

Question

A Linux administrator is helping the security team troubleshoot an SELinux policy violation incident. Which of the following would be the BEST utility command to display SELinux violation and AVC denial messages?

Options

Ajournalctl | grep sealert
Bsealert -a /var/log/audit/audit.log
Caureport | grep AVC
Dcat /var/log/messages | grep selinux

How the community answered

(45 responses)

A
4% (2)
B
82% (37)
C
11% (5)
D
2% (1)

Explanation

You can investigate SELinux issues without any tools by opening the audit log it generates. This log is found at /var/log/audit/audit.log. To run sealert from the command-line, we need to point it to the SELinux audit log. sealert -a /var/log/audit/audit.log

Topics

#SELinux#Troubleshooting#Audit Log#Security Utilities

Community Discussion

No community discussion yet for this question.

Full XK0-005 Practice