{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/328","repository_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/328/labels{/name}","comments_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/328/comments","events_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/328/events","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/328","id":47866327,"number":328,"title":"[RHEL/6, RHEL/7] Fix selinux_all_devicefiles_labeled XCCDF description to use 'device_t' rather than 'unlabeled_t'","user":{"login":"iankko","id":8414918,"avatar_url":"https://avatars.githubusercontent.com/u/8414918?v=3","gravatar_id":"","url":"https://api.github.com/users/iankko","html_url":"https://github.com/iankko","followers_url":"https://api.github.com/users/iankko/followers","following_url":"https://api.github.com/users/iankko/following{/other_user}","gists_url":"https://api.github.com/users/iankko/gists{/gist_id}","starred_url":"https://api.github.com/users/iankko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iankko/subscriptions","organizations_url":"https://api.github.com/users/iankko/orgs","repos_url":"https://api.github.com/users/iankko/repos","events_url":"https://api.github.com/users/iankko/events{/privacy}","received_events_url":"https://api.github.com/users/iankko/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/bugfix","name":"bugfix","color":"fbca04"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/help%20wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/RHEL6","name":"RHEL6","color":"006b75"},{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/labels/RHEL7","name":"RHEL7","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"shawndwells","id":5713754,"avatar_url":"https://avatars.githubusercontent.com/u/5713754?v=3","gravatar_id":"","url":"https://api.github.com/users/shawndwells","html_url":"https://github.com/shawndwells","followers_url":"https://api.github.com/users/shawndwells/followers","following_url":"https://api.github.com/users/shawndwells/following{/other_user}","gists_url":"https://api.github.com/users/shawndwells/gists{/gist_id}","starred_url":"https://api.github.com/users/shawndwells/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawndwells/subscriptions","organizations_url":"https://api.github.com/users/shawndwells/orgs","repos_url":"https://api.github.com/users/shawndwells/repos","events_url":"https://api.github.com/users/shawndwells/events{/privacy}","received_events_url":"https://api.github.com/users/shawndwells/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/milestones/22","html_url":"https://github.com/OpenSCAP/scap-security-guide/milestones/0.1.30","labels_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/milestones/22/labels","id":1591263,"number":22,"title":"0.1.30","description":null,"creator":{"login":"iankko","id":8414918,"avatar_url":"https://avatars.githubusercontent.com/u/8414918?v=3","gravatar_id":"","url":"https://api.github.com/users/iankko","html_url":"https://github.com/iankko","followers_url":"https://api.github.com/users/iankko/followers","following_url":"https://api.github.com/users/iankko/following{/other_user}","gists_url":"https://api.github.com/users/iankko/gists{/gist_id}","starred_url":"https://api.github.com/users/iankko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iankko/subscriptions","organizations_url":"https://api.github.com/users/iankko/orgs","repos_url":"https://api.github.com/users/iankko/repos","events_url":"https://api.github.com/users/iankko/events{/privacy}","received_events_url":"https://api.github.com/users/iankko/received_events","type":"User","site_admin":false},"open_issues":42,"closed_issues":4,"state":"open","created_at":"2016-02-18T18:32:49Z","updated_at":"2016-05-05T04:12:12Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2014-11-05T17:51:12Z","updated_at":"2016-05-05T04:12:12Z","closed_at":"2016-05-05T04:12:12Z","body":"As pointed out in:\r\n  [1] https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-October/006257.html\r\n\r\nthe default SELinux type when SELinux knows nothing about the particular device in question isn't ```unlabeled_t```, but rather ```device_t```. This can be verified by running e.g. the following commands:\r\n```\r\n[root@localhost ~]# cat /etc/redhat-release \r\nRed Hat Enterprise Linux Server release 6.6 (Santiago)\r\n[root@localhost ~]# matchpathcon /dev\r\n/dev\tsystem_u:object_r:device_t:s0\r\n[root@localhost ~]# touch /dev/mydevice\r\n[root@localhost ~]# ls -Z /dev/mydevice \r\n-rw-------. root root unconfined_u:object_r:device_t:s0 /dev/mydevice\r\n[root@localhost ~]# ln -s /dev/zero /dev/my_custom_zero\r\n[root@localhost ~]# ls -Z /dev/my_custom_zero \r\nlrwxrwxrwx. root root unconfined_u:object_r:device_t:s0 /dev/my_custom_zero -> /dev/zero\r\n```\r\n\r\nTherefore we should modify selinux_all_devicefiles_labeled XCCDF rule's ```<description>``` & ```<rationale>``` elements (for both of RHEL-6 & RHEL-7) to read ```device_t``` instead of (current) ```unlabeled_t```."},"comment":{"url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/comments/217073300","html_url":"https://github.com/OpenSCAP/scap-security-guide/issues/328#issuecomment-217073300","issue_url":"https://api.github.com/repos/OpenSCAP/scap-security-guide/issues/328","id":217073300,"user":{"login":"redhatrises","id":8398836,"avatar_url":"https://avatars.githubusercontent.com/u/8398836?v=3","gravatar_id":"","url":"https://api.github.com/users/redhatrises","html_url":"https://github.com/redhatrises","followers_url":"https://api.github.com/users/redhatrises/followers","following_url":"https://api.github.com/users/redhatrises/following{/other_user}","gists_url":"https://api.github.com/users/redhatrises/gists{/gist_id}","starred_url":"https://api.github.com/users/redhatrises/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/redhatrises/subscriptions","organizations_url":"https://api.github.com/users/redhatrises/orgs","repos_url":"https://api.github.com/users/redhatrises/repos","events_url":"https://api.github.com/users/redhatrises/events{/privacy}","received_events_url":"https://api.github.com/users/redhatrises/received_events","type":"User","site_admin":false},"created_at":"2016-05-05T04:12:12Z","updated_at":"2016-05-05T04:12:12Z","body":"Running `grep -rni unlabeled_t *` on the latest master does not return any results for XCCDF or OVAL content. Therefore, it looks like this issue can be closed."}}