XK0-005 · Question #231
A user receives an access_denied error when trying to modify a file, even though the file permissions are set to 777. Which of the following commands should be used to view additional file…
The correct answer is C. ls -z. Even with full file permissions, SELinux can deny access; therefore, viewing the file's SELinux security context is necessary to diagnose access_denied errors.
Question
A user receives an access_denied error when trying to modify a file, even though the file permissions are set to 777. Which of the following commands should be used to view additional file permissions?
Options
- Agetsebool
- Bgetenforce
- Cls -z
- Dps -z
How the community answered
(47 responses)- A2% (1)
- C94% (44)
- D4% (2)
Why each option
Even with full file permissions, SELinux can deny access; therefore, viewing the file's SELinux security context is necessary to diagnose access_denied errors.
`getsebool` is used to display the state of SELinux booleans, which are high-level policy controls, but it does not provide specific file context information.
`getenforce` shows the current enforcement mode of SELinux (e.g., enforcing, permissive, disabled), indicating if SELinux is active, but not the specific reason for a file access denial.
The `ls -Z` (or `ls -z`) command displays the SELinux security context for files and directories. This context, along with SELinux policies, determines access, and an incorrect context can lead to 'access_denied' errors even when standard file permissions are 777.
`ps -Z` displays the SELinux security context associated with running *processes*, not files, and is not relevant for diagnosing file access issues directly.
Concept tested: SELinux context and file permissions
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/using_selinux/viewing-and-changing-file-contexts_using-selinux
Topics
Community Discussion
No community discussion yet for this question.