From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from markus.defensec.nl (markus.defensec.nl [45.80.168.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47D8819F40B for ; Mon, 28 Sep 2026 10:20:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.80.168.93 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790590851; cv=none; b=S0xj19MolaDJ2fQW/hhRAJ5yVE2aeP4vEBI//HOG7kayMAkhLHTtKBqwb9M8cHa3O1Mut9PsLMHohg699M7aYhl5EdMmSmpYmIy4xhkPcozMNSLf3aFEKtj5Vq35kq4tKU3UG/JiOx96QocmWDPkvu1Xvo3El0ZDlJFuOouqrI0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790590851; c=relaxed/simple; bh=rhNPUV6p7BGYKMYQN35fxwMea8TE6y5JNcjsW+Op5b8=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=Aow2w7DumiirnTAlwLtj4NZ0ugrk+4445GoVe64yPWO0dSFnJOyAyy/KkdTodtWfuDDzGeMkZPC03lf3qnqGWXngC/J69T0zmF/AleJhKnyDC9WElfsjJA8iJK1X+GYDf+EmkwbCHR0QFEQwrYWW2ZHI2zB6E7CQ6ByO5qHcDaM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=defensec.nl; spf=pass smtp.mailfrom=defensec.nl; dkim=pass (1024-bit key) header.d=defensec.nl header.i=@defensec.nl header.b=RSakUBP7; arc=none smtp.client-ip=45.80.168.93 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=defensec.nl Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=defensec.nl Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=defensec.nl header.i=@defensec.nl header.b="RSakUBP7" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=defensec.nl; s=default; t=1790590847; bh=rhNPUV6p7BGYKMYQN35fxwMea8TE6y5JNcjsW+Op5b8=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=RSakUBP7yq7t2fK3sQTTpI0I9u1zqQAnJxim7ojPocHVlKRHCr9YhB2zYQcLmo+xt p6QLi1e9Jo/P+TQnrjVCPz19dsYwlBoWcXkeGwVNpK6acl8mjLr7i/6vO10aCqL/x3 ypQqcurkqOF+8XjpbSZ/ltm3t1GCf68aGZW3ub/U= Received: from nimbus (nimbus.defensec.nl [IPv6:2a10:3781:2099::514]) by markus.defensec.nl (Postfix) with ESMTPSA id 1823E2F242E; Mon, 28 Sep 2026 12:20:47 +0200 (CEST) From: Dominick Grift To: Russell Coker Cc: selinux-refpolicy@vger.kernel.org Subject: Re: /dev/full In-Reply-To: (Russell Coker's message of "Mon, 28 Sep 2026 20:09:41 +1000") References: <87ld8m3spg.fsf@defensec.nl> Date: Mon, 28 Sep 2026 12:20:46 +0200 Message-ID: <87fqyt4qyp.fsf@defensec.nl> User-Agent: Gnus/5.13 (Gnus v5.13) Precedence: bulk X-Mailing-List: selinux-refpolicy@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain Russell Coker writes: > On Monday, 28 September 2026 14:28:27 AEST Dominick Grift wrote: >> I noticed similar. I suspect this is due to how userspace_initial_sid >> polcap is implemented in refpolicy (refpolicy does leverage it does it >> not?). Misssing an appropriate auto type transition because the scenario >> changed. The fact that it ends up event_device_t means that the wrong type transition applies (theres a default for chr_file event_device_t which is triggered instead of the proper name-based transition the polcap mentioned can be used to implement a different context for userspace processes in initrd. Depending on how its implemented it could introduce issues like these (I encountered similar but my implementation of that polcap is more intrusive. For example: any transitions associated with kernel_t would no longer apply to userspace in initrd if that is now given a private context. > > The below is in current refpolicy, is this what you mean? > > # Enable separate user space context for processes started before first > # policy load. > # Requires libsepol 3.7 and kernel 6.8. > # > # Added checks: > # (none) > policycap userspace_initial_context; > > How do you think it could be affecting the issue I saw? -- gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098 Dominick Grift Mastodon: @kcinimod@defensec.nl