Courseiva
← XK0-006
Full test
hardMultiple ChoiceObjective-mapped

How to Set a Persistent SELinux File Context Using semanage fcontext

A Red Hat Enterprise Linux 8 system is configured with SELinux in enforcing mode. A custom application needs to write to a file in /var/log. The audit log shows an AVC denial for httpd_t attempting to write to var_log_t. Which of the following is the most appropriate persistent solution?

Quick Answer

The correct answer is to use semanage fcontext to define the default context for the file and then run restorecon. This is the most appropriate persistent SELinux file context configuration because semanage fcontext writes a rule to the SELinux policy that survives file system relabeling, unlike chcon which only applies a temporary label that can be overwritten. On the CompTIA Linux+ XK0-005 exam, this question tests your understanding of the difference between temporary and persistent context changes, a common trap where candidates mistakenly choose chcon for a permanent fix. The key distinction is that semanage fcontext modifies the file_contexts database, making the rule stick even after a full system relabel or restorecon operation. Remember the mnemonic: "semanage sets the stage, restorecon plays the part" — semanage defines the rule, restorecon applies it to the actual file.

⚠ Common exam trap

Test-takers frequently confuse chcon (temporary) with semanage fcontext (persistent), or mistakenly think changing Unix ownership or enabling a network boolean will resolve a file-based SELinux denial.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use semanage fcontext to define the default context for the file and then restorecon.

Semanage fcontext defines a persistent default SELinux file context rule, which survives file system relabeling. After defining the rule, restorecon applies the context to the file. This ensures the custom application's log file is labeled httpd_log_t, allowing httpd_t to write to it, while chcon (option C) only makes a temporary change that can be overwritten by restorecon or a relabel.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Set the SELinux boolean httpd_can_network_connect to on.

    Why it's wrong here

    Unrelated to file write permissions.

  • ✗

    Change the ownership of the file to apache.

    Why it's wrong here

    Does not affect SELinux policy.

  • ✗

    Use chcon to set the file context to httpd_log_t.

    Why it's wrong here

    Immediate but will not survive a restorecon or relabel.

  • ✓

    Use semanage fcontext to define the default context for the file and then restorecon.

    Why this is correct

    Persistent method; sets default context in policy.

About these practice questions

One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on XK0-006

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Scenario: A cloud hosting company uses SELinux in enforcing mode on all Linux servers. A developer reports that a custom web application running under Apache (httpd) is unable to write log files to /var/log/myapp/. The directory /var/log/myapp/ has permissions 755 and is owned by root:root. The httpd process runs as the 'apache' user. The administrator checks SELinux context: /var/log/myapp is labeled with default_t type. The administrator wants to allow httpd to write to this directory while maintaining security. Which command should the administrator run?

medium
  • A.Change ownership with 'chown apache:apache /var/log/myapp'
  • B.Run 'setenforce 0' to disable SELinux
  • C.Run 'chcon -t httpd_log_t /var/log/myapp'
  • ✓ D.Run 'semanage fcontext -a -t httpd_log_t "/var/log/myapp(/.*)?"' and then 'restorecon -Rv /var/log/myapp'

Why D: It permanently relabels the directory with the httpd_log_t SELinux type, which is specifically designed to allow Apache (httpd) to write log files. The semanage fcontext command adds a file context mapping to the SELinux policy database, and restorecon applies that mapping to the filesystem. This approach maintains SELinux enforcing mode and does not rely on temporary changes like chcon or insecure workarounds like disabling SELinux.

Variation 2. A web server on RHEL 8 is serving content from a non-default directory /data/web. The SELinux context is set to default_t for the directory, causing access denials. Which command should be used to set the correct context for web content?

medium
  • A.setsebool -P httpd_can_network_connect on
  • B.restorecon -R /data/web
  • C.chcon -t httpd_sys_content_t /data/web
  • ✓ D.semanage fcontext -a -t httpd_sys_content_t "/data/web(/.*)?"

Why D: `semanage fcontext` modifies the SELinux file context policy persistently, and the regular expression `/data/web(/.*)?` ensures that the directory and all its contents are labeled with `httpd_sys_content_t`, which is the type required for web content served by Apache. This persistent change survives file system relabeling, unlike `chcon` which only sets a temporary context.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.