Red Hat Bugzilla – Bug 1520897
/dev/drm_dp_aux* devices should have a more specific label than device_t
Last modified: 2018-04-10 08:48:22 EDT
Description of problem: The RHEL7 STIG requires that all device files in /dev have specific SELinux file types other than the device_t type: http://rhel7stig.readthedocs.io/en/latest/medium.html#v-72039-all-system-device-files-must-be-correctly-labeled-to-prevent-unauthorized-modification-rhel-07-020900 As the /dev/drm_dp_aux* files have the generic device_t file type, conformance to the RHEL-07-020900 STIG rule on hosts with Intel Corporation HD Graphics 630 controllers fails. Version-Release number of selected component (if applicable): How reproducible: Always with this hardware or a similar one Steps to Reproduce: 1. restorecon -Rv /dev 2. find /dev -context '*:device_t:*' \( -type c -o -type b \) -print0 | xargs -0 ls -lsaZ Actual results: crw-------. root root system_u:object_r:device_t:s0 /dev/drm_dp_aux0 crw-------. root root system_u:object_r:device_t:s0 /dev/drm_dp_aux1 crw-------. root root system_u:object_r:device_t:s0 /dev/drm_dp_aux2 Expected results: <no files with device_t labels> Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763