EX188 Registry And Security Practice Question
A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.
In rootless mode, the underlying user namespace maps the user to a UID/GID range on the host, but the SELinux sandbox limitations in older kernels or certain rootless configurations prevent standard multi-category security (MCS) label translation for shared volumes unless configured correctly. Specifically, the correct SELinux handling for rootless containers using shared volumes often requires relying on the user's process label or using the ':disable' suffix if SELinux is not enforcing within the namespace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rootless containers automatically disable SELinux enforcement for all mounted volumes, bypassing container isolation.
Why it's wrong here
Rootless containers still respect host SELinux rules, but volume relabeling behaves differently than in root mode.
- ✗
The SELinux policy enforcement level must be set to permissive globally across the entire RHEL host.
Why it's wrong here
Disabling or setting SELinux to permissive globally is a bad practice and not required for rootless Podman volume mounts.
- ✗
The host directory must be owned by the root user before mounting into a rootless container.
Why it's wrong here
Rootless containers operate using user namespaces where the root inside the container maps to the unprivileged user on the host.
- ✓
Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.
Why this is correct
Rootless Podman does not have privileges to dynamically relabel host files using chcon/restorecon with unique MCS categories in the same way privileged root Podman does, causing permission failures when :Z is incorrectly applied.
About these practice questions
This EX188 question is part of Courseiva's 296-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Red Hat exam blueprint
This EX188 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX188 exam.