Re: /dev/full

[Dominick Grift <dominick.grift@defensec.nl>]

Russell Coker <russell@coker.com.au> writes:

> On Monday, 28 September 2026 22:21:32 AEST Dominick Grift wrote:
>> >> Thanks for that, it was a default trans rule.  I'll add a named
>> >> transition
>> >> for /dev/full
>> > 
>> > That doesn't seem to work.
>> > 
>> > root@ami:~# sesearch -T -c chr_file|grep null
>> > type_transition kernel_t device_t:chr_file null_device_t full;
>> > root@ami:~# dmesg|grep event_device_t
>> > [    3.269252] audit: type=1400 audit(1790597162.343:4): avc:  denied  {
>> > write } for  pid=330 comm="modprobe" name="full" dev="devtmpfs" ino=7
>> > scontext=system_u:system_r:kmod_t:s0
>> > tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0
>> > [    3.272938] audit: type=1400 audit(1790597162.343:5): avc:  denied  {
>> > write } for  pid=332 comm="modprobe" name="full" dev="devtmpfs" ino=7
>> > scontext=system_u:system_r:kmod_t:s0
>> > tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0
>> 
>> What is the context associated with the init sid? Maybe that is actually
>> creating it then?
>
> That's an interesting question, I get the following message in dmesy.
>
> [   10.940969] systemd[1]: Failed to transition into init label 
> 'system_u:system_r:init_t:s0', ignoring: Permission denied

Interesting but I dont think that is related. Maybe a
setcurrent/dyntransition is missing there.

>
> The following is the policy line you are probably interested in:
>
> policy/modules/kernel/kernel.te:sid init 
> gen_context(system_u:system_r:init_t,mls_systemhigh)

You could try: type_transition kernel_t device_t:chr_file null_device_t
full;

My reasoning:

1. whatever creates that /dev/full with event_device_t is very early
because otherwise udev and pid1 would have relabeled it by the time the
event happened.

2. That leaves either kernel_t or init_t. Some stuff that now runs in
init_t used to run in kernel_t previously. If its not kernel_t then that
leaves us with init_t.

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl