Bug 1622617 - /dev/tpmrm0 file has wrong SELinux file context
Summary: /dev/tpmrm0 file has wrong SELinux file context
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-08-27 15:36 UTC by Blair Aitken
Modified: 2018-10-30 10:10 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:09:38 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:10:13 UTC

Description Blair Aitken 2018-08-27 15:36:08 UTC
policy/modules/kernel/devices.fc in serefpolicy-3.13.1 contains this rule:

/dev/tpm[0-9]*		-c	gen_context(system_u:object_r:tpm_device_t,s0)

But on some of our systems, we also have a /dev/tpmrm0 device file.

Because there are no file contexts that specifically target /dev/tmprm[0-9]* device files, this device file inherits the default device_t label.

While this is a very minor SELinux labeling issue, we run RHEL7 on hosts where we must comply with various third-party security guidelines, such as the Defense Information Systems Agency (DISA) RHEL7 Secure Technical Implementation Guide (STIG). We must proactively report on areas where we fail conformance, and propose a plan of action to achieve conformance. Furthermore, we are regularly inspected and audited on our conformance to these guidelines.

The RHEL7 STIG requires that all device files in /dev have specific SELinux file types other than the device_t type:

http://rhel7stig.readthedocs.io/en/latest/medium.html#v-72039-all-system-device-files-must-be-correctly-labeled-to-prevent-unauthorized-modification-rhel-07-020900

Because the /dev/tpmrm0 file has the device_t file type, instead of a more specific file type, we fail conformance to the RHEL-07-020900 STIG rule on hosts with this device file.

We've worked around this issue in our custom SELinux policy:

# We need this until Red Hat adds this upstream.
/dev/tpmrm[0-9]*	-c	gen_context(system_u:object_r:tpm_device_t,s0)

Comment 5 errata-xmlrpc 2018-10-30 10:09:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.