All device files must be monitored by the system Linux Security Module.

From Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Associated with: CCI-000366

SV-65589r1_rule All device files must be monitored by the system Linux Security Module.

Vulnerability discussion

If a device file carries the SELinux type "unlabeled_t", then SELinux cannot properly restrict access to the device file.

Check content

To check for unlabeled device files, run the following command: # ls -RZ /dev | grep unlabeled_t It should produce no output in a well-configured system. If there is output, this is a finding.

Fix text

Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type "unlabeled_t", investigate the cause and correct the file's context.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.