selinux_all_devicefiles_labeled

Shawn Wells shawn at redhat.com
Sat Oct 26 04:08:32 UTC 2013


On 10/24/13, 2:02 PM, Jeff Bachtel wrote:
> Apologies - SSG master/HEAD, openscap 0.9.3-1
>
> Jeff
>
> On Thu, Oct 24, 2013 at 1:47 PM, Jeff Bachtel 
> <jbachtel at bericotechnologies.com 
> <mailto:jbachtel at bericotechnologies.com>> wrote:
>
>     Getting errors running selinux_all_devicefiles_labeled check on
>     RHEL6. I ran testcheck.py, and initially the check was barfing on
>     all of the broken symlinks under /dev/.udev/**. I deleted all of
>     the broken symlinks, but I'm still getting an error on one file
>     (that does not exist)
>
>            <system_data>
>               <lin-sys:selinuxsecuritycontext_item id="1255121"
>     status="error">
>                 <message level="error">Can't get context for
>     /dev/fd/6: No such file or directory
>     </message>
>     <lin-sys:filepath>/dev/fd/6</lin-sys:filepath>
>     <lin-sys:path>/dev/fd</lin-sys:path>
>     <lin-sys:filename>6</lin-sys:filename>
>     </lin-sys:selinuxsecuritycontext_item>
>             </system_data>
>
>     Regarding the broken symlinks: should the check error out on them?
>     Looking, the problem might occur around
>                     if ((ofts = oval_fts_open(path, filename,
>     filepath, behaviors)) != NULL) {
>     in OVAL/probes/unix/linux/selinuxsecuritycontext.c
>
>     Regarding the search for the stray file descriptor: the check
>     still errors out when run properly via oscap, as well. Might this
>     be some sort of race condition with the file descriptor being
>     opened by the probe, and disappearing before the check can get to
>     it? I've tried manually creating the symlink for /dev/fd/6 to
>     test, but devfs unfortunately won't let me create it.
>
>     Thanks for any ideas,
>

It's a known issue, ref 
https://fedorahosted.org/scap-security-guide/ticket/392

There's much debate about how SCAP (as a protocol) should handle /proc 
and /dev. We're waiting to see how things square out.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131026/780f88ad/attachment.html>


More information about the scap-security-guide mailing list