Re: /dev/full

[Dominick Grift <dominick.grift@defensec.nl>]

Russell Coker <russell@coker.com.au> writes:

> On Monday, 28 September 2026 21:58:17 AEST Russell Coker wrote:
>> On Monday, 28 September 2026 20:34:23 AEST Dominick Grift wrote:
>> > Could also be that the name-based transition for /dev/full was never
>> > added because the event was not reproduced after name-based transitions
>> > became available.
>> > 
>> > Bottom line: missing (name-based) type transition rule
>> 
>> # sesearch -T -c chr_file|grep -v devpts_t|grep event
>> type_transition kernel_t device_t:chr_file event_device_t;
>> 
>> policy/modules/kernel/kernel.te: dev_filetrans_input_dev(kernel_t)
>> 
>> Thanks for that, it was a default trans rule.  I'll add a named transition
>> for /dev/full
>
> That doesn't seem to work.
>
> root@ami:~# sesearch -T -c chr_file|grep null
> type_transition kernel_t device_t:chr_file null_device_t full;
> root@ami:~# dmesg|grep event_device_t
> [    3.269252] audit: type=1400 audit(1790597162.343:4): avc:  denied  { write 
> } for  pid=330 comm="modprobe" name="full" dev="devtmpfs" ino=7 
> scontext=system_u:system_r:kmod_t:s0 
> tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0
> [    3.272938] audit: type=1400 audit(1790597162.343:5): avc:  denied  { write 
> } for  pid=332 comm="modprobe" name="full" dev="devtmpfs" ino=7 
> scontext=system_u:system_r:kmod_t:s0 
> tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0

What is the context associated with the init sid? Maybe that is actually
creating it then?

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl