STIGQter STIGQter: STIG Summary: Oracle Linux 9 Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

OL 9 must be configured so that all system device files are correctly labeled to prevent unauthorized modification.

DISA Rule

SV-271769r1092019_rule

Vulnerability Number

V-271769

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

OL09-00-002500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure OL 9 to correctly label all system devices.

Restore the SELinux policy for the affected device file from the system policy database using the following command:

$ sudo restorecon -v <device_path>

Substituting "<device_path>" with the path to the affected device file (from the output of the previous commands). An example device file path would be "/dev/ttyUSB0". If the output of the above command does not indicate that the device was relabeled to a more specific SELinux type label, then the SELinux policy of the system must be updated with more specific policy for the device class specified. If a package was used to install support for a device class, that package could be reinstalled using the following command:

$ sudo dnf reinstall -y <package_name>

If a package was not used to install the SELinux policy for a given device class, then it must be generated manually and provide specific type labels.

Check Contents

Verify that OL 9 configures all system device files to be correctly labeled to prevent unauthorized modification.

List all device files on the system that are incorrectly labeled with the following commands:

Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system.

$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"

$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"

Note: There are device files, such as "/dev/dtrace/helper" or "/dev/vmci", that are used for system trace capabilities or when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding.

If there is output from either of these commands, other than already noted, this is a finding.

Vulnerability Number

V-271769

Documentable

False

Rule Version

OL09-00-002500

Severity Override Guidance

Verify that OL 9 configures all system device files to be correctly labeled to prevent unauthorized modification.

List all device files on the system that are incorrectly labeled with the following commands:

Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system.

$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"

$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"

Note: There are device files, such as "/dev/dtrace/helper" or "/dev/vmci", that are used for system trace capabilities or when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding.

If there is output from either of these commands, other than already noted, this is a finding.

Check Content Reference

M

Target Key

5680