EX200 SELinux context Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The script is in the wrong directory.

  Why it's wrong here

  The directory /var/www/cgi-bin is the standard CGI directory on Red Hat Enterprise Linux, configured via ScriptAlias /cgi-bin/ /var/www/cgi-bin/ in the Apache configuration. A CGI script placed there is correctly located, and a wrong-path problem would normally produce a 404 Not Found error, not a 500 Internal Server Error. Therefore, the directory is not the cause of the reported failure.

• ✓

  The SELinux context should be httpd_sys_script_exec_t.

  Why this is correct

  SELinux prevents httpd from executing scripts unless the file has the httpd_sys_script_exec_t type, which allows a transition into the httpd_sys_script_t domain when the script runs. If the script retains a generic context such as httpd_sys_content_t or user_home_t, httpd is blocked even when permissions and location are correct, producing a 500 error. Running `restorecon -R /var/www/cgi-bin` or `chcon -t httpd_sys_script_exec_t /var/www/cgi-bin/script.cgi` is the correct fix, not changing permissions.

• ✗

  The script is not marked as executable.

  Why it's wrong here

  Although a CGI script must be executable, simply setting the executable bit does not address the SELinux denial causing this failure. The error log may show 'Permission denied' for both ordinary mode restrictions and SELinux denials, but the executable bit alone cannot override a missing httpd_sys_script_exec_t type. If the problem were only a missing executable mode, `chmod +x` would fix it immediately; the given scenario points directly to a context issue, so this option is not the root cause.

• ✗

  The file permissions are incorrect.

  Why it's wrong here

  Incorrect file permissions could mean wrong ownership or mode bits, but no such problem is indicated in the exhibit; the script is in the standard directory and is likely owned properly. Even if the apache user lacked read or execute access, a RHEL 500 error from a CGI script is typically accompanied by an AVC denial in /var/log/audit/audit.log that cites the missing SELinux type. Fixing permissions alone would not re-contextualize the file, so SELinux corrections are still required, making this option an incorrect explanation of the actual error.

Go deeper

Related to this question