From 60f82f8d33cef82f3ff5e90073803c199bad02fb Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Tue, 7 Jul 2020 11:31:59 +0200
Subject: [PATCH 1/3] modify rule description and ocil
---
.../selinux_all_devicefiles_labeled/rule.yml | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml
index 765fca583e..1667557740 100644
--- a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml
+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml
@@ -6,18 +6,20 @@ title: 'Ensure No Device Files are Unlabeled by SELinux'
description: |-
Device files, which are used for communication with important system
- resources, should be labeled with proper SELinux types. If any device
- files do not carry the SELinux type <tt>device_t</tt>, report the bug so
- that policy can be corrected. Supply information about what the device is
- and what programs use it.
+ resources, should be labeled with proper SELinux types. If any device files
+ carry the SELinux type <tt>device_t</tt> or <tt>unlabeled_t</tt>, report the
+ bug so that policy can be corrected. Supply information about what the
+ device is and what programs use it.
<br /><br />
- To check for unlabeled device files, run the following command:
+ To check for incorrectly labeled device files, run following commands:
<pre>$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"</pre>
+ <pre>$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"</pre>
It should produce no output in a well-configured system.
rationale: |-
- If a device file carries the SELinux type <tt>device_t</tt>, then SELinux
- cannot properly restrict access to the device file.
+ If a device file carries the SELinux type <tt>device_t</tt> or
+ <tt>unlabeled_t</tt>, then SELinux cannot properly restrict access to the
+ device file.
severity: medium
@@ -45,8 +47,9 @@ references:
ocil_clause: 'there is output'
ocil: |-
- To check for unlabeled device files, run the following command:
+ To check for incorrectly labeled device files, run following commands:
<pre>$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"</pre>
+ <pre>$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"</pre>
It should produce no output in a well-configured system.
warnings:
From e0cb2d04a9d95967e4adb3e05cc93a4a834a90b5 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Tue, 7 Jul 2020 11:32:57 +0200
Subject: [PATCH 2/3] updated oval to check only device files
---
.../oval/shared.xml | 64 +++++++++++++------
1 file changed, 43 insertions(+), 21 deletions(-)
diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml
index 51b68008af..7dcfb98577 100644
--- a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml
+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/oval/shared.xml
@@ -2,32 +2,54 @@
<definition class="compliance" id="selinux_all_devicefiles_labeled" version="1">
<metadata>
<title>Device Files Have Proper SELinux Context</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- <platform>Red Hat Enterprise Linux 7</platform>
- <platform>Red Hat Enterprise Linux 8</platform>
- <platform>Red Hat Virtualization 4</platform>
- <platform>multi_platform_fedora</platform>
- <platform>multi_platform_ol</platform>
- <platform>multi_platform_wrlinux</platform>
- </affected>
- <description>All device files in /dev should be assigned an SELinux security context other than 'device_t'.</description>
+ {{{- oval_affected(products) }}}
+ <description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</description>
</metadata>
- <criteria>
- <criterion comment="device_t in /dev" test_ref="test_selinux_all_devicefiles_labeled" />
+ <criteria operator="AND">
+ <criterion comment="device_t in /dev" test_ref="test_selinux_dev_device_t" />
+ <criterion comment="unlabeled_t in /dev" test_ref="test_selinux_dev_unlabeled_t" />
</criteria>
</definition>
- <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="test_selinux_all_devicefiles_labeled" version="2">
- <linux:object object_ref="object_selinux_all_devicefiles_labeled" />
- <linux:state state_ref="state_selinux_all_devicefiles_labeled" />
+
+ <!-- collect all special files from /dev directory -->
+ <unix:file_object id="object_dev_device_files" comment="device files within /dev directory" version="1">
+ <unix:behaviors recurse_direction="down" />
+ <unix:path operation="equals">/dev</unix:path>
+ <unix:filename operation="pattern match">^.*$</unix:filename>
+ <filter action="include">state_block_or_char_device_file</filter>
+ </unix:file_object>
+
+ <unix:file_state id="state_block_or_char_device_file" version="1" comment="device files" >
+ <unix:type operation="pattern match">^(block|character) special$</unix:type>
+ </unix:file_state>
+
+ <local_variable id="variable_dev_device_files" comment="all device files within /dev directory" datatype="string" version="1">
+ <object_component object_ref="object_dev_device_files" item_field="filepath" />
+ </local_variable>
+
+
+ <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="test_selinux_dev_device_t" version="2">
+ <linux:object object_ref="object_selinux_dev_device_t" />
+ <linux:state state_ref="state_selinux_dev_device_t" />
</linux:selinuxsecuritycontext_test>
- <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="object_selinux_all_devicefiles_labeled" version="1">
- <linux:behaviors recurse_direction="down" />
- <linux:path>/dev</linux:path>
- <linux:filename operation="pattern match">^.*$</linux:filename>
- <filter action="include">state_selinux_all_devicefiles_labeled</filter>
+ <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="object_selinux_dev_device_t" version="1">
+ <linux:filepath operation="equals" var_ref="variable_dev_device_files" var_check="at least one"/>
+ <filter action="include">state_selinux_dev_device_t</filter>
</linux:selinuxsecuritycontext_object>
- <linux:selinuxsecuritycontext_state comment="do it" id="state_selinux_all_devicefiles_labeled" version="1">
+ <linux:selinuxsecuritycontext_state comment="device_t label" id="state_selinux_dev_device_t" version="1">
<linux:type datatype="string" operation="equals">device_t</linux:type>
</linux:selinuxsecuritycontext_state>
+
+ <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="unlabeled_t in /dev" id="test_selinux_dev_unlabeled_t" version="2">
+ <linux:object object_ref="object_selinux_dev_unlabeled_t" />
+ <linux:state state_ref="state_selinux_dev_unlabeled_t" />
+ </linux:selinuxsecuritycontext_test>
+ <linux:selinuxsecuritycontext_object comment="unlabeled_t in /dev" id="object_selinux_dev_unlabeled_t" version="1">
+ <linux:filepath operation="equals" var_ref="variable_dev_device_files" var_check="at least one"/>
+ <filter action="include">state_selinux_dev_unlabeled_t</filter>
+ </linux:selinuxsecuritycontext_object>
+ <linux:selinuxsecuritycontext_state comment="unlabeled_t label" id="state_selinux_dev_unlabeled_t" version="1">
+ <linux:type datatype="string" operation="equals">unlabeled_t</linux:type>
+ </linux:selinuxsecuritycontext_state>
+
</def-group>
From 0bd95e6dbe3684524c86150cdb6beb0af05ff119 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Tue, 7 Jul 2020 11:33:26 +0200
Subject: [PATCH 3/3] add tests
---
.../tests/block_device_device_t.fail.sh | 4 ++++
.../tests/char_device_unlabeled_t.fail.sh | 14 ++++++++++++++
.../tests/regular_file_device_t.pass.sh | 4 ++++
.../tests/symlink_with_wrong_label.pass.sh | 4 ++++
4 files changed, 26 insertions(+)
create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh
create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh
create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh
create mode 100644 linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh
diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh
new file mode 100644
index 0000000000..08c4142e5b
--- /dev/null
+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/block_device_device_t.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+mknod /dev/foo b 1 5
+chcon -t device_t /dev/foo
diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh
new file mode 100644
index 0000000000..1da85c2034
--- /dev/null
+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/char_device_unlabeled_t.fail.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# selinux does not allow unlabeled_t in /dev
+# we have to modify the selinux policy to allow that
+
+echo '(allow unlabeled_t device_t (filesystem (associate)))' > /tmp/unlabeled_t.cil
+semodule -i /tmp/unlabeled_t.cil
+
+mknod /dev/foo c 1 5
+chcon -t unlabeled_t /dev/foo
+
+
+mknod /dev/foo c 1 5
+chcon -t device_t /dev/foo
diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh
new file mode 100644
index 0000000000..d161951d7a
--- /dev/null
+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/regular_file_device_t.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+touch /dev/foo
+restorecon -F /dev/foo
diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh
new file mode 100644
index 0000000000..a8280bf37e
--- /dev/null
+++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/tests/symlink_with_wrong_label.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+ln -s /dev/cpu /dev/foo
+restorecon -F /dev/foo