ExamFinch.com My Study

Study guide

20.2 List and Identify SELinux File and Process Contexts

Practice this exam

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

20.2 List and Identify SELinux File and Process Contexts

Key Takeaways Explain This Topic AI

SELinux labels are user:role:type:level tuples; on targeted policy, the type field (for example httpd_sys_content_t) is what you read most often for access decisions.

List file contexts with ls -Z (and ls -Zd for directories); list process contexts with ps -Z or ps auxZ; show your own context with id -Z.

Match process type to file type: a confined domain such as httpd_t needs correctly typed content, logs, and ports—wrong type is a classic AVC denial cause.

Compare contexts on working vs broken paths (for example /var/www/html vs a custom DocumentRoot) to spot mislabels before changing modes or booleans.

Identification is a read-only skill: this section focuses on listing and recognizing labels; restoring and persistently fixing labels is Section 20.3.

Last updated: August 2026

20.2 List and Identify SELinux File and Process Contexts

Quick Answer: File labels: ls -Z / ls -Zd . Process labels: ps -Z or ps auxZ . Your login context: id -Z . Read the type field in user:role:type:level first—on RHEL’s targeted policy, type is usually the decision that matters for services.

Why context identification is an EX200 skill

Under Manage security , Red Hat expects you to list and identify SELinux file and process contexts . Tasks look like:

  • “Identify the SELinux context of /var/www/html .”
  • “Show the context of the httpd process.”
  • “Determine whether files under /srv/web have the correct type for a web server.”
  • “Report the SELinux user/role/type of the current shell.”

Before you run restorecon or change booleans, you must see what is labeled and what is running. Graders and real systems both reward correct reading of -Z output.

  • Anatomy of a context
  • A full SELinux security context looks like: user:role:type:level
  • unconfined_u:object_r:httpd_sys_content_t:s0
  • system_u:system_r:httpd_t:s0
  • Field Typical meaning on RHEL targeted
  • user SELinux user identity ( unconfined_u , system_u , root_u , …)—not always the same as the Linux login name
  • role Role in role-based access ( object_r for files, system_r for many daemons, unconfined_r , …)

type (domain for processes) The critical field for most RHCSA work—e.g. httpd_sys_content_t , httpd_t , sshd_t , user_home_t

level Sensitivity/category ( s0 , sometimes s0:c0.c1023 with MCS)—often s0 on simple tasks

Mental model: Linux discretionary permissions (ugo/rwx) answer “who may open this as UID/GID?” SELinux answers “may this domain (process type) access this type (file type) for this class of operation?” Both must allow access.

On targeted policy (RHEL default), many admin shells run as unconfined domains with broad freedom, while network-facing daemons ( httpd_t , sshd_t , named_t , …) are tightly confined. That is why a file you can cat as root may still be denied to Apache if the type is wrong.

  • List file and directory contexts: ls -Z ls -Z /var/www/html
  • ls -Z /var/www/html/index.html
  • ls -Zd /var/www/html
  • ls -laZ /var/www/html
  • Command Use
  • ls -Z path Show SELinux context with names
  • ls -Zd dir Context of the directory itself (not only its children)
  • ls -laZ Combine long listing (DAC mode, owner) with SELinux context
  • ls -ZR dir Recursive listing (noisy; use carefully)
  • Example patterns you should recognize: system_u:object_r:httpd_sys_content_t:s0 /var/www/html
  • unconfined_u:object_r:user_home_t:s0 /home/alice/public_html
  • system_u:object_r:var_t:s0 /var/myservice # often wrong for httpd content
  • system_u:object_r:etc_t:s0 /etc/httpd

Common web content types:

  • Type Typical use
  • httpd_sys_content_t Static content readable by httpd
  • httpd_sys_rw_content_t Content httpd may write
  • httpd_sys_script_exec_t Executable scripts (CGI-style paths)
  • httpd_config_t Apache configuration
  • httpd_log_t Apache logs
  • httpd_var_run_t Runtime files under /run

Home and user types:

  • Type Typical use
  • user_home_t Normal home content
  • user_home_dir_t The home directory inode itself
  • ssh_home_t ~/.ssh materials
  • admin_home_t Root’s home content in many policies

Shared / custom data:

  • Type Note
  • var_t Generic /var default—often insufficient for httpd DocumentRoot
  • default_t Generic default—frequently appears on new filesystems or poorly labeled mounts
  • nfs_t / related Network filesystem labels when applicable

When a task moves web content to /srv/www or /web , ls -Zd /srv/www often reveals default_t or var_t instead of httpd_sys_content_t —that identification drives the restore/label fix in Section 20.3.

  • matchpathcon and stat (optional identification helpers) matchpathcon /var/www/html
  • matchpathcon /srv/web
  • stat -c '%n %C' /var/www/html/index.html

matchpathcon shows what the policy’s file context database thinks a path should be labeled. Compare that to ls -Z actual label to see drift. stat -c '%C' prints the context in a compact form.

  • List process contexts: ps -Z ps -Z
  • ps -eZ | head
  • ps -eZ | grep httpd
  • ps auxZ | grep -E 'httpd|sshd|nginx'
  • ps -ZC httpd
  • Command Use
  • ps -Z Contexts for processes in the current view
  • ps -eZ All processes with SELinux context
  • ps -ZC name Processes by name with context
  • ps auxZ User-oriented listing plus context
  • Example process lines (simplified): system_u:system_r:httpd_t:s0 ... httpd
  • system_u:system_r:sshd_t:s0 ... sshd
  • unconfined_u:unconfined_r:unconfined_t:s0 ... bash

Identify:

Is the daemon confined? ( httpd_t yes; unexpected unconfined_t for a service may mean it was started oddly.)

Does the domain match the service you think is running?

  • Are helper processes in related domains? systemctl status httpd
  • ps -eZ | grep httpd

If httpd is not running, start it only if the task allows—identification of installed unit vs running domain are different checks.

  • Current user context: id -Z id -Z
  • id -Z alice
  • Example: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

id -Z shows the SELinux identity of your session (or another user when permitted). On RHEL, interactive admins are often unconfined , which explains why root can edit files that httpd cannot serve— DAC allows root , and SELinux does not confine that shell the same way as httpd_t .

  • Related tools: secon # if available, decode context components
  • prompt often shows context in specialized shells—not required
  • Putting it together: process type vs file type

Access problems almost always reduce to:

Process domain T_process wants operation O on object type T_file (and class file/dir/…).

Identification workflow: # 1) What domain is the service?

ps -eZ | grep httpd

# 2) What type is the content path?

  • ls -Zd /srv/web
  • ls -Z /srv/web | head

# 3) What should the path be?

matchpathcon /srv/web

# 4) Mode still enforcing?

getenforce

If httpd_t is serving files labeled user_home_t or default_t , you have identified a context mismatch . Do not conclude “SELinux is broken”—conclude “labels do not match the service domain.”

  • Directory vs contents ls -Zd /srv/web
  • ls -Z /srv/web

Sometimes the directory is correct but new files created by copy ( cp without preserving context) inherit an unexpected type, or only the top directory was relabeled. Identify both directory and file labels.

  • Copy and create behavior (awareness) cp /var/www/html/index.html /tmp/index.html
  • ls -Z /var/www/html/index.html /tmp/index.html

Copied files often receive a type based on the destination directory policy, not always a perfect clone of the source type—unless you use options that preserve contexts. Identification after copy is a common exam discovery step before restorecon .

  • Other useful listing commands # Find files with a given type (can be slow on large trees)
  • sudo find /srv -context '*:httpd_sys_content_t:*' 2>/dev/null | head
  • # Show context with find -Z (GNU find on RHEL)
  • find /var/www -maxdepth 2 -Z 2>/dev/null | head
  • # Pathname regex rules (policy database)—advanced identification
  • sudo semanage fcontext -l | grep '/srv/web'

semanage fcontext -l lists persistent path → context rules . You do not need to memorize the full policy map, but grepping for a custom path shows whether a permanent mapping already exists. Changing those rules belongs with restore workflows (20.3); listing them is identification.

  • DAC vs MAC: do not misread ls -l ls -laZ /srv/web/index.html
  • You might see: -rw-r--r--. 1 root root ... unconfined_u:object_r:default_t:s0 index.html

Mode 644 and owner root may look “fine” for a web server reading world-readable files.

Type default_t may still cause AVC denial for httpd_t .

Always include -Z when SELinux is in play. Conversely, a perfect SELinux type with mode 000 still fails DAC.

  • Exam identification workflows
  • Workflow A — Web content path getenforce
  • ls -Zd /var/www/html
  • ls -Z /var/www/html | head
  • matchpathcon /var/www/html
  • ps -eZ | grep httpd
  • Workflow B — Custom DocumentRoot ls -Zd /srv/myapp
  • ls -Z /srv/myapp | head
  • matchpathcon /srv/myapp
  • sudo semanage fcontext -l | grep '/srv/myapp' || true
  • Workflow C — User home and SSH ls -Zd /home/alice
  • ls -Za /home/alice/.ssh 2>/dev/null
  • id -Z alice
  • ps -eZ | grep sshd
  • Workflow D — Compare good vs bad ls -Zd /var/www/html /srv/web
  • matchpathcon /var/www/html /srv/web

Side-by-side context comparison is the fastest way to see that /srv/web is mislabeled relative to a known-good path.

Workflow E — Process domain inventory ps -eZ | awk '{print $1}' | sort | uniq -c | sort -nr | head

Shows which SELinux domains are active—useful when a task asks which domain a service uses.

Common traps

Reading ls -l only and missing a wrong type .

Checking files but not the directory ( ls -Zd ).

Confusing SELinux user ( unconfined_u ) with Linux user ( alice ).

Assuming root shell context means Apache can read the same path.

Ignoring matchpathcon when actual ls -Z differs from expected policy.

Looking at Permissive denials without identifying the process domain and file type pair.

Treating default_t as “fine because world-readable.”

Expecting id -Z alone to show file contexts—it shows identity , not path labels.

Stopping at process list without ps -Z , so you never see httpd_t .

Jumping to setenforce 0 before identifying the mismatch (mode change hides the teaching of labels).

Relationship to other sections

  • Skill Section
  • Enforcing/Permissive modes 20.1
  • List/identify contexts 20.2 (this)
  • restorecon / persistent fcontext 20.3
  • Port types for non-default ports 21.1
  • Booleans that loosen policy 21.2

Identification tells you what is wrong ; 20.3 and Chapter 21 tell you how to fix it without disabling SELinux.

Section checkpoint

You should list file contexts with ls -Z / ls -Zd , list process contexts with ps -Z / ps -eZ , show session context with id -Z , interpret user:role:type:level with emphasis on type/domain , compare actual labels to matchpathcon , relate httpd_t (and other domains) to content types such as httpd_sys_content_t , and separate DAC mode bits from SELinux labels. That is the EX200 skill to list and identify SELinux file and process contexts on RHEL 10.