<Rule id="selinux_unlabeled_device_files">
<title>Ensure No Device Files are Unlabeled by SELinux</title>
<description>Device files, which are used for communication with important
system resources, should be labeled with proper SELinux types. If any device
files carry the SELinux type <tt>unlabeled_t</tt>, investigate the cause and
correct the file's context.
</description>
<ocil clause="there is output">To check for unlabeled device files, run the following command:
<pre># ls -RZ /dev | grep unlabeled_t</pre>
It should produce no output in a well-configured system.</ocil>
<rationale>
If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
cannot properly restrict access to the device file.
</rationale>
<ident cce="26774-0" />
<oval id="selinux_all_devicefiles_labeled" />
<ref nist="AC-6,AU-9,CM-7" disa="22,32"/>
<tested by="DS" on="20121024"/>
</Rule>
(ref: