[PATCH 1/4] improved checks and text so that unlabeled devices are recursively sought
Jeffrey Blank
blank at eclipse.ncsc.mil
Thu Dec 20 22:58:07 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
.../checks/selinux_all_devicefiles_labeled.xml | 1 +
RHEL6/input/system/selinux.xml | 2 +-
2 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/selinux_all_devicefiles_labeled.xml b/RHEL6/input/checks/selinux_all_devicefiles_labeled.xml
index c1acd8c..affef3d 100644
--- a/RHEL6/input/checks/selinux_all_devicefiles_labeled.xml
+++ b/RHEL6/input/checks/selinux_all_devicefiles_labeled.xml
@@ -16,6 +16,7 @@
<linux:state state_ref="state_selinux_all_devicefiles_labeled" />
</linux:selinuxsecuritycontext_test>
<linux:selinuxsecuritycontext_object comment="unlabeled_t in /dev" id="object_selinux_all_devicefiles_labeled" version="1">
+ <linux:behaviors recurse_direction="down" />
<linux:path>/dev</linux:path>
<linux:filename operation="pattern match">^.*$</linux:filename>
<filter action="include">state_selinux_all_devicefiles_labeled</filter>
diff --git a/RHEL6/input/system/selinux.xml b/RHEL6/input/system/selinux.xml
index 4ac37b3..543f3a9 100644
--- a/RHEL6/input/system/selinux.xml
+++ b/RHEL6/input/system/selinux.xml
@@ -236,7 +236,7 @@ files carry the SELinux type <tt>unlabeled_t</tt>, investigate the cause and
correct the file's context.
</description>
<ocil clause="there is output">To check for unlabeled device files, run the following command:
-<pre># ls -Z /dev | grep unlabeled_t</pre>
+<pre># ls -RZ /dev | grep unlabeled_t</pre>
It should produce no output in a well-configured system.</ocil>
<rationale>
If a device file carries the SELinux type <tt>unlabeled_t</tt>, then SELinux
--
1.7.1
More information about the scap-security-guide
mailing list