From 60f82f8d33cef82f3ff5e90073803c199bad02fb Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Tue, 7 Jul 2020 11:31:59 +0200

Subject: [PATCH 1/3] modify rule description and ocil

---

 .../selinux_all_devicefiles_labeled/rule.yml  | 19 +++++++++++--------

 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml

index 765fca583e..1667557740 100644

--- a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml

+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml

@@ -6,18 +6,20 @@ title: 'Ensure No Device Files are Unlabeled by SELinux'

 description: |-

     Device files, which are used for communication with important system

-    resources, should be labeled with proper SELinux types. If any device

-    files do not carry the SELinux type <tt>device_t</tt>, report the bug so

-    that policy can be corrected. Supply information about what the device is

-    and what programs use it.

+    resources, should be labeled with proper SELinux types. If any device files

+    carry the SELinux type <tt>device_t</tt> or <tt>unlabeled_t</tt>, report the

+    bug so that policy can be corrected. Supply information about what the

+    device is and what programs use it.

-    To check for unlabeled device files, run the following command:

+    To check for incorrectly labeled device files, run following commands:

     
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"

+    
$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"

     It should produce no output in a well-configured system.

 rationale: |-

-    If a device file carries the SELinux type <tt>device_t</tt>, then SELinux

-    cannot properly restrict access to the device file.

+    If a device file carries the SELinux type <tt>device_t</tt> or

+    <tt>unlabeled_t</tt>, then SELinux cannot properly restrict access to the

+    device file.

 severity: medium

@@ -45,8 +47,9 @@ references:

 ocil_clause: 'there is output'

 ocil: |-

-    To check for unlabeled device files, run the following command:

+    To check for incorrectly labeled device files, run following commands:

     
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"

+    
$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"

     It should produce no output in a well-configured system.

 warnings:

From e0cb2d04a9d95967e4adb3e05cc93a4a834a90b5 Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Tue, 7 Jul 2020 11:32:57 +0200

Subject: [PATCH 2/3] updated oval to check only device files

---

 .../oval/shared.xml                           | 64 +++++++++++++------

 1 file changed, 43 insertions(+), 21 deletions(-)

diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml

index 51b68008af..7dcfb98577 100644

--- a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml

+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml

@@ -2,32 +2,54 @@

   <definition class="compliance" id="selinux_all_devicefiles_labeled" version="1">

     <metadata>

       <title>Device Files Have Proper SELinux Context</title>

-      <affected family="unix">

-        <platform>Red Hat Enterprise Linux 6</platform>

-        <platform>Red Hat Enterprise Linux 7</platform>

-        <platform>Red Hat Enterprise Linux 8</platform>

-        <platform>Red Hat Virtualization 4</platform>

-        <platform>multi_platform_fedora</platform>

-        <platform>multi_platform_ol</platform>

-        <platform>multi_platform_wrlinux</platform>

-      </affected>

-      <description>All device files in /dev should be assigned an SELinux security context other than 'device_t'.</description>

+      {{{- oval_affected(products) }}}

+      <description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</description>

     </metadata>

-    <criteria>

-      <criterion comment="device_t in /dev" test_ref="test_selinux_all_devicefiles_labeled" />

+    <criteria operator="AND">

+      <criterion comment="device_t in /dev" test_ref="test_selinux_dev_device_t" />

+      <criterion comment="unlabeled_t in /dev" test_ref="test_selinux_dev_unlabeled_t" />

     </criteria>

   </definition>

-  <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="test_selinux_all_devicefiles_labeled" version="2">

-    <linux:object object_ref="object_selinux_all_devicefiles_labeled" />

-    <linux:state state_ref="state_selinux_all_devicefiles_labeled" />

+

+  

+  <unix:file_object id="object_dev_device_files" comment="device files within /dev directory" version="1">

+    <unix:behaviors recurse_direction="down" />

+    <unix:path operation="equals">/dev</unix:path>

+    <unix:filename operation="pattern match">^.*$</unix:filename>

+    <filter action="include">state_block_or_char_device_file</filter>

+  </unix:file_object>

+

+  <unix:file_state id="state_block_or_char_device_file" version="1" comment="device files" >

+    <unix:type operation="pattern match">^(block|character) special$</unix:type>

+  </unix:file_state>

+

+  <local_variable id="variable_dev_device_files" comment="all device files within /dev directory" datatype="string" version="1">

+    <object_component object_ref="object_dev_device_files" item_field="filepath" />

+  </local_variable>

+

+

+  <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="test_selinux_dev_device_t" version="2">

+    <linux:object object_ref="object_selinux_dev_device_t" />

+    <linux:state state_ref="state_selinux_dev_device_t" />

   </linux:selinuxsecuritycontext_test>

-  <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="object_selinux_all_devicefiles_labeled" version="1">

-    <linux:behaviors recurse_direction="down" />

-    <linux:path>/dev</linux:path>

-    <linux:filename operation="pattern match">^.*$</linux:filename>

-    <filter action="include">state_selinux_all_devicefiles_labeled</filter>

+  <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="object_selinux_dev_device_t" version="1">

+    <linux:filepath operation="equals" var_ref="variable_dev_device_files"  var_check="at least one"/>

+    <filter action="include">state_selinux_dev_device_t</filter>

   </linux:selinuxsecuritycontext_object>

-  <linux:selinuxsecuritycontext_state comment="do it" id="state_selinux_all_devicefiles_labeled" version="1">

+  <linux:selinuxsecuritycontext_state comment="device_t label" id="state_selinux_dev_device_t" version="1">

     <linux:type datatype="string" operation="equals">device_t</linux:type>

   </linux:selinuxsecuritycontext_state>

+

+  <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="unlabeled_t in /dev" id="test_selinux_dev_unlabeled_t" version="2">

+    <linux:object object_ref="object_selinux_dev_unlabeled_t" />

+    <linux:state state_ref="state_selinux_dev_unlabeled_t" />

+  </linux:selinuxsecuritycontext_test>

+  <linux:selinuxsecuritycontext_object comment="unlabeled_t in /dev" id="object_selinux_dev_unlabeled_t" version="1">

+    <linux:filepath operation="equals" var_ref="variable_dev_device_files"  var_check="at least one"/>

+    <filter action="include">state_selinux_dev_unlabeled_t</filter>

+  </linux:selinuxsecuritycontext_object>

+  <linux:selinuxsecuritycontext_state comment="unlabeled_t label" id="state_selinux_dev_unlabeled_t" version="1">

+    <linux:type datatype="string" operation="equals">unlabeled_t</linux:type>

+  </linux:selinuxsecuritycontext_state>

+

 </def-group>

From 0bd95e6dbe3684524c86150cdb6beb0af05ff119 Mon Sep 17 00:00:00 2001

From: Vojtech Polasek <vpolasek@redhat.com>

Date: Tue, 7 Jul 2020 11:33:26 +0200

Subject: [PATCH 3/3] add tests

---

 .../tests/block_device_device_t.fail.sh            |  4 ++++

 .../tests/char_device_unlabeled_t.fail.sh          | 14 ++++++++++++++

 .../tests/regular_file_device_t.pass.sh            |  4 ++++

 .../tests/symlink_with_wrong_label.pass.sh         |  4 ++++

 4 files changed, 26 insertions(+)

 create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh

 create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh

 create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh

 create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh

diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh

new file mode 100644

index 0000000000..08c4142e5b

--- /dev/null

+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh

@@ -0,0 +1,4 @@

+#!/bin/bash

+

+mknod /dev/foo b 1 5

+chcon -t device_t /dev/foo

diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh

new file mode 100644

index 0000000000..1da85c2034

--- /dev/null

+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh

@@ -0,0 +1,14 @@

+#!/bin/bash

+

+# selinux does not allow unlabeled_t in /dev

+# we have to modify the selinux policy to allow that

+

+echo '(allow unlabeled_t device_t (filesystem (associate)))' > /tmp/unlabeled_t.cil

+semodule -i /tmp/unlabeled_t.cil

+

+mknod /dev/foo c 1 5

+chcon -t unlabeled_t /dev/foo

+

+

+mknod /dev/foo c 1 5

+chcon -t device_t /dev/foo

diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh

new file mode 100644

index 0000000000..d161951d7a

--- /dev/null

+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh

@@ -0,0 +1,4 @@

+#!/bin/bash

+

+touch /dev/foo

+restorecon -F /dev/foo

diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh

new file mode 100644

index 0000000000..a8280bf37e

--- /dev/null

+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh

@@ -0,0 +1,4 @@

+#!/bin/bash

+

+ln -s /dev/cpu /dev/foo

+restorecon -F /dev/foo