Re: /dev/full

[Dominick Grift <dominick.grift@defensec.nl>]

Russell Coker <russell@coker.com.au> writes:

> On Monday, 28 September 2026 14:28:27 AEST Dominick Grift wrote:
>> I noticed similar. I suspect this is due to how userspace_initial_sid
>> polcap is implemented in refpolicy (refpolicy does leverage it does it
>> not?). Misssing an appropriate auto type transition because the scenario
>> changed.

The fact that it ends up event_device_t means that the wrong type
transition applies (theres a default for chr_file event_device_t which
is triggered instead of the proper name-based transition

the polcap mentioned can be used to implement a different context for
userspace processes in initrd. Depending on how its implemented it could
introduce issues like these (I encountered similar but my implementation
of that polcap is more intrusive.

For example: any transitions associated with kernel_t would no longer
apply to userspace in initrd if that is now given a private context.

>
> The below is in current refpolicy, is this what you mean?
>
> # Enable separate user space context for processes started before first
> # policy load.
> # Requires libsepol 3.7 and kernel 6.8.
> #
> # Added checks:
> # (none)
> policycap userspace_initial_context;
>
> How do you think it could be affecting the issue I saw?

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl