Red Hat Bugzilla – Bug 1451358
scap reports device files with device_t context as violating a rule
Last modified: 2018-04-10 08:32:07 EDT
Description of problem: scap tests report device files with device_t SELinux context as violating the following rule: Ensure No Device Files are Unlabeled by SELinux Version-Release number of selected component (if applicable): selinux-policy-3.13.1-102.el7_3.16.noarch How reproducible: Steps to Reproduce: 1. Run scap on latest RHEL 7 Actual results: These files are reported with device_t context: /dev/vsock /dev/vmci /dev/char/10:57 /dev/char/10:58 Expected results: No files reported. Additional info: # matchpathcon /dev/vmci /dev/vsock /dev/char/10:5[78] /dev/vmci system_u:object_r:device_t:s0 /dev/vsock system_u:object_r:device_t:s0 /dev/char/10:57 system_u:object_r:device_t:s0 /dev/char/10:58 system_u:object_r:device_t:s0 These files: /dev/char/10:5[78] are symlinks which are not displayed by the helper find command in http://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-server-upstream.html#xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled The wording changed in a different document revision: Ensure No Device Files are Unknown to SELinux
Scap tests should skip symbolic links in /dev/char directory, because they are always labeled device_t.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763