Advanced Linux test (Advanced)

Sample questions

5 sample questions from the Advanced Linux test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. What is the primary purpose of the audit2allow tool in SELinux?

   1. audit2allow is used to enforce SELinux policies on system calls
   2. audit2allow rewrites the SELinux policy to disable all denials permanently
   3. audit2allow generates a policy module based on audit logs to allow previously denied operations
   4. audit2allow compiles SELinux policies into binary format for the kernel

   Answer: C. audit2allow generates a policy module based on audit logs to allow previously denied operations

   audit2allow is a tool used in SELinux to create policy modules based on audit logs that record denied operations. It does not modify the existing policy directly but instead generates a new policy module that can be added to the system to allow the previously denied operations. This makes it a crucial part of SELinux troubleshooting and policy development.

2. In a realistic project scenario, a kernel module is being used by a driver. What happens to the reference count for the module when the driver starts using it?

   1. The reference count for the module is decremented by 1.
   2. The reference count for the module is not changed.
   3. The reference count for the module is set to 0.
   4. The reference count for the module is incremented by 1.

   Answer: D. The reference count for the module is incremented by 1.

   When a kernel module is used by a driver or another component, the reference count is incremented to prevent it from being unloaded while it is in use. This ensures that the module remains loaded as long as it is needed, and the count is only decremented when the module is no longer required.

3. Which of the following statements correctly describes a common edge case or mistake related to UTS namespace customization?

   1. The UTS namespace allows customizing the hostname and domain name of a process, but changes are not visible to other processes outside the namespace.
   2. The UTS namespace automatically propagates hostname changes to all other namespaces in the system.
   3. The UTS namespace does not support customizing the hostname or domain name for processes.
   4. The UTS namespace allows all processes to share the same hostname and domain name, regardless of their isolation.

   Answer: A. The UTS namespace allows customizing the hostname and domain name of a process, but changes are not visible to other processes outside the namespace.

   The UTS namespace allows processes to have their own hostname and domain name, but these changes are isolated within the namespace and do not affect other processes outside it. A common mistake is assuming that changes in the UTS namespace are visible globally, which is incorrect. Other options incorrectly describe the behavior or introduce unrelated concepts.

4. Which of the following statements accurately describes how SELinux handles network port restrictions?

   1. SELinux automatically blocks all network traffic on ports not explicitly allowed by the system's firewall.
   2. SELinux enforces port restrictions based on the application's user context, regardless of the port number.
   3. SELinux does not restrict network ports directly; it relies on policies and rules defined in the SELinux configuration to control access to ports.
   4. SELinux restricts network ports directly by default, without requiring any configuration.

   Answer: C. SELinux does not restrict network ports directly; it relies on policies and rules defined in the SELinux configuration to control access to ports.

   SELinux does not directly restrict network ports; instead, it uses policies and rules defined in the SELinux configuration to control access to ports. This means that the enforcement of port restrictions is not automatic and requires proper configuration. A common mistake is assuming that SELinux blocks access to certain ports by default without any configuration, which is not accurate.

5. Which SELinux tool is used to generate policy modules based on audit logs, allowing previously denied operations to be permitted?

   1. SELinux audit logs
   2. SELinux type enforcement
   3. SELinux policy compilation
   4. SELinux audit2allow

   Answer: D. SELinux audit2allow

   The 'audit2allow' tool is used in SELinux to generate policy modules based on audit logs, which helps in creating custom policies to allow previously denied operations. The other options are related but not the direct tool used for this purpose.