Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1451358 - scap reports device files with device_t context as violating a rule
scap reports device files with device_t context as violating a rule
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.3
Unspecified Linux
medium Severity medium
: rc
: ---
Assigned To: Lukas Vrabec
Milos Malik
:
Depends On:
Blocks: 1420851
  Show dependency treegraph
 
Reported: 2017-05-16 09:35 EDT by Zdenek Pytela
Modified: 2018-04-10 08:32 EDT (History)
7 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-174.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-04-10 08:29:42 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Bugzilla 1451363 None CLOSED scap tests report issues with symlinks whereas documentation mentions only plain files 2018-08-07 10:20 EDT
Red Hat Knowledge Base (Solution) 3062591 None None None 2017-05-31 10:58 EDT
Red Hat Product Errata RHBA-2018:0763 None None None 2018-04-10 08:32 EDT

  None (edit)
Description Zdenek Pytela 2017-05-16 09:35:13 EDT
Description of problem:
scap tests report device files with device_t SELinux context as violating the following rule:
Ensure No Device Files are Unlabeled by SELinux

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7_3.16.noarch

How reproducible:


Steps to Reproduce:
1. Run scap on latest RHEL 7

Actual results:
These files are reported with device_t context:
/dev/vsock
/dev/vmci
/dev/char/10:57
/dev/char/10:58

Expected results:
No files reported.

Additional info:
  # matchpathcon /dev/vmci /dev/vsock /dev/char/10:5[78]
/dev/vmci       system_u:object_r:device_t:s0
/dev/vsock      system_u:object_r:device_t:s0
/dev/char/10:57 system_u:object_r:device_t:s0
/dev/char/10:58 system_u:object_r:device_t:s0

These files: /dev/char/10:5[78]
are symlinks which are not displayed by the helper find command in 
http://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-server-upstream.html#xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled

The wording changed in a different document revision: Ensure No Device Files are Unknown to SELinux
Comment 4 Milos Malik 2017-10-24 09:55:51 EDT
Scap tests should skip symbolic links in /dev/char directory, because they are always labeled device_t.
Comment 8 errata-xmlrpc 2018-04-10 08:29:42 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763

Note You need to log in before you can comment on or make changes to this bug.