フリー問題

問題文

A file is owned by the web server account with mode 640, and the web server still cannot read it on a host with mandatory access control in enforcing mode. Which explanation fits?

選択肢

1. Mode 640 does not grant read access to the owner, so the permission bits are the cause.
2. The web server account must be a member of the file's group, which mode 640 prevents.
3. Mandatory access control replaces the permission bits while enforcing, so the bits are ignored and only the label matters, which means changing the mode can never affect access on such a host.
4. The file carries a security label that the web server's policy does not permit it to read, and mandatory access control is evaluated in addition to the permission bits.