<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/24/13, 2:02 PM, Jeff Bachtel
      wrote:<br>
    </div>
    <blockquote
cite="mid:CAHahqg1HnkokMZNj4Q_yZu73wW2r77JJvyh0jq_-5gR3mBEAHQ@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div>Apologies - SSG master/HEAD, openscap 0.9.3-1<br>
        </div>
        <div><br>
        </div>
        <div>Jeff</div>
        <div class="gmail_extra"><br>
          <div class="gmail_quote">On Thu, Oct 24, 2013 at 1:47 PM, Jeff
            Bachtel <span dir="ltr">&lt;<a moz-do-not-send="true"
                href="mailto:jbachtel@bericotechnologies.com"
                target="_blank">jbachtel@bericotechnologies.com</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0
              .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div dir="ltr">Getting errors
                running selinux_all_devicefiles_labeled check on RHEL6.
                I ran testcheck.py, and initially the check was barfing
                on all of the broken symlinks under /dev/.udev/**. I
                deleted all of the broken symlinks, but I'm still
                getting an error on one file (that does not exist)
                <div>
                  <br>
                </div>
                <div>
                  <div>       &lt;system_data&gt;</div>
                  <div>          &lt;lin-sys:selinuxsecuritycontext_item
                    id="1255121" status="error"&gt;</div>
                  <div>            &lt;message level="error"&gt;Can't
                    get context for /dev/fd/6: No such file or directory</div>
                  <div>&lt;/message&gt;</div>
                  <div>           
                    &lt;lin-sys:filepath&gt;/dev/fd/6&lt;/lin-sys:filepath&gt;</div>
                  <div>           
                    &lt;lin-sys:path&gt;/dev/fd&lt;/lin-sys:path&gt;</div>
                  <div>           
                    &lt;lin-sys:filename&gt;6&lt;/lin-sys:filename&gt;</div>
                  <div>         
                    &lt;/lin-sys:selinuxsecuritycontext_item&gt;</div>
                  <div>        &lt;/system_data&gt;</div>
                </div>
                <div><br>
                </div>
                <div>Regarding the broken symlinks: should the check
                  error out on them? Looking, the problem might occur
                  around</div>
                <div>
                  <div>                if ((ofts = oval_fts_open(path,
                    filename, filepath, behaviors)) != NULL) {</div>
                </div>
                <div>in OVAL/probes/unix/linux/selinuxsecuritycontext.c</div>
                <div><br>
                </div>
                <div>Regarding the search for the stray file descriptor:
                  the check still errors out when run properly via
                  oscap, as well. Might this be some sort of race
                  condition with the file descriptor being opened by the
                  probe, and disappearing before the check can get to
                  it? I've tried manually creating the symlink for
                  /dev/fd/6 to test, but devfs unfortunately won't let
                  me create it.</div>
                <div><br>
                </div>
                <div>Thanks for any ideas,</div>
              </div>
            </blockquote>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    It's a known issue, ref
    <a class="moz-txt-link-freetext" href="https://fedorahosted.org/scap-security-guide/ticket/392">https://fedorahosted.org/scap-security-guide/ticket/392</a><br>
    <br>
    There's much debate about how SCAP (as a protocol) should handle
    /proc and /dev. We're waiting to see how things square out.<br>
  </body>
</html>