<def-group>
  <definition class="compliance" id="selinux_all_devicefiles_labeled" version="1">
    <metadata>
      <title>Device Files Have Proper SELinux Context</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>All device files in /dev should be assigned an SELinux security context other than 'unlabeled_t'.</description>
    </metadata>
    <criteria>
      <criterion comment="unlabeled_t in /dev" test_ref="test_selinux_all_devicefiles_labeled" />
    </criteria>
  </definition>
  <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="unlabeled_t in /dev" id="test_selinux_all_devicefiles_labeled" version="2">
    <linux:object object_ref="object_selinux_all_devicefiles_labeled" />
    <linux:state state_ref="state_selinux_all_devicefiles_labeled" />
  </linux:selinuxsecuritycontext_test>
  <linux:selinuxsecuritycontext_object comment="unlabeled_t in /dev" id="object_selinux_all_devicefiles_labeled" version="1">
    <linux:behaviors recurse_direction="down" />
    <linux:path>/dev</linux:path>
    <linux:filename operation="pattern match">^.*$</linux:filename>
    <filter action="include">state_selinux_all_devicefiles_labeled</filter>
  </linux:selinuxsecuritycontext_object>
  <linux:selinuxsecuritycontext_state comment="do it" id="state_selinux_all_devicefiles_labeled" version="1">
    <linux:type datatype="string" operation="equals">unlabeled_t</linux:type>
  </linux:selinuxsecuritycontext_state>
</def-group>
