Ensure No Device Files are Unlabeled by SELinux

Description

Device files, which are used for communication with important system resources, should be labeled with proper SELinux types. If any device files carry the SELinux type device_t or unlabeled_t, report the bug so that policy can be corrected. Supply information about what the device is and what programs use it.

To check for incorrectly labeled device files, run following commands:

$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"

$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"

Rationale

If a device file carries the SELinux type device_t or unlabeled_t, then SELinux cannot properly restrict access to the device file.