How to check for Unlabeled Device Files

Device files are used for communication with important system resources. SELinux contexts should exist for these. If a device file is not labeled, then misconfiguration is likely.

To check for unlabeled device files, run the following command:

# ls -Z | grep unlabeled_t

It should produce no output in a well-configured system.

Comments are closed.