Skip to content
LFCSOperations DeploymentSingle Linux VMHard

Kernel parameters and mandatory access control

Scenario lfcs-ops-001 · about 9 minutes · 10 points · 10 grader checks

Persist two sysctl values against a conflicting drop-in, set one runtime-only, confine a binary with AppArmor and prepare an SELinux policy rule.

  • sysctl
  • kernel-parameters
  • apparmor
  • selinux
  • mac

What you will practise

  • Persist kernel parameters and understand sysctl.d ordering
  • Change a kernel parameter for the running kernel only
  • Write and enforce an AppArmor profile
  • Set the SELinux mode and a persistent file-context rule

Start this lab

With the CLI installed and signed in, this command provisions a fresh Ubuntu 24.04 LTS virtual machine on your Mac, applies the scenario setup and prints the task below.

goldenkube start lfcs-ops-001

Task

The task text exactly as the CLI shows it. Solve it on the machine, then run goldenkube submit.

This host needs kernel tuning and mandatory access control (MAC). 1. Persistent kernel parameters: vm.swappiness = 10 and net.ipv4.ip_forward = 1, stored in /etc/sysctl.d/60-lab.conf and in effect right now. After a reboot the values must still be 10 and 1, whatever other files in the sysctl configuration directories say. 2. Runtime-only kernel parameter: set kernel.pid_max to 131072 for the running kernel. It must NOT be stored in any sysctl configuration file. 3. AppArmor: /usr/local/bin/lab-cat is a copy of cat. Confine it with an AppArmor profile stored under /etc/apparmor.d/ and loaded in enforce mode, so that lab-cat can still print /srv/public.txt but is denied reading anything below /srv/secret/. Do not modify or delete /srv/secret/key.txt. 4. SELinux (the SELinux policy tools are installed; SELinux itself is not active on this host): set the configured mode in /etc/selinux/config to permissive, and add a persistent file-context rule to the local policy that labels /srv/web and everything below it as httpd_sys_content_t (path expression "/srv/web(/.*)?"). Do not activate SELinux and do not reboot.

Requirements and details

Certification
LFCS · Linux Foundation Certified System Administrator
Domain
Operations Deployment
Difficulty
Hard
Environment
Single Linux VM
Recommended time
9 minutes
Points
10
Grader checks
10
Operating system
Ubuntu 24.04 LTS
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 10 state checks read your machine when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Operations Deployment labs

LFCSOperations DeploymentMedium

Repair a failing service and re-prioritise a process

A systemd service crash-loops because of its unit file; fix it, enable it, and lower the priority of a running batch process without restarting it.

Single Linux VM · ~7 min · 8 points

  • systemd
  • services
  • troubleshooting
  • processes
  • nice

goldenkube start lfcs-ops-002

LFCSOperations DeploymentEasy

Schedule jobs with a systemd timer and cron

Run a backup script every day at 02:30 through a systemd timer that catches up missed runs, and add a weekday cron job for another user.

Single Linux VM · ~5 min · 7 points

  • systemd-timer
  • cron
  • scheduling
  • jobs

goldenkube start lfcs-ops-003

LFCSOperations DeploymentMedium

Local package repository, pinned install and package verification

Configure a local package repository, install and hold an exact package version, then find and restore a file that was modified after installation.

Single Linux VM · ~7 min · 8 points

  • apt
  • packages
  • repositories
  • dpkg
  • verification

goldenkube start lfcs-ops-004

LFCSOperations DeploymentHard

Run a container as a service and register a virtual machine

Run nginx in a rootful podman container managed by systemd with a read-only bind mount, configure the registry search list, and define an autostarted libvirt domain.

Single Linux VM · ~8 min · 9 points

  • podman
  • containers
  • systemd
  • libvirt
  • virsh

goldenkube start lfcs-ops-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.