mediumsystemverified ✓

Ensure all system device files are correctly labeled by SELinux

selinux-device-file-labels · RHEL ≥ 8 · 1 impl

Description

All system device files must have correct SELinux labels to prevent unauthorized modification and enforce mandatory access controls on device access.

Rationale

Incorrectly labeled device files may allow processes to access them in ways not intended by the SELinux policy. Unlabeled device files can bypass SELinux access controls entirely, undermining the mandatory access control system.

Check → Remediate

Checkcommand

# Mislabeled device files are those typed unlabeled_t or device_t.
# NOTE: the find type/context clauses MUST be grouped with \( \) — an
# ungrouped "-type b -o -type c -context X" binds as "(b) OR (c AND X)",
# matching every char device unconditionally.
# /dev/vmci legitimately requires device_t on VMware guests — the STIG
# explicitly excludes it, so it is not a finding.
bad=$(find /dev \( -type b -o -type c \) \
        \( -context '*:unlabeled_t:*' -o -context '*:device_t:*' \) \
        ! -name vmci 2>/dev/null | head -5)
if [ -z "$bad" ]; then
  echo "OK: no mislabeled device files"
  exit 0
fi
echo "FAIL: mislabeled device files: $bad"
exit 1

expected_exit:: 0

Remediatecommand_exec

restorecon -R /dev

Framework references

STIG

V-281046 / RHEL-10-400145V-257932 / RHEL-09-232260

NIST 800-53

AC-3CM-6

Live verification

rhel9:check

#selinux#device-files#labels#mandatory-access-control