Re: /dev/full

[Dominick Grift <dominick.grift@defensec.nl>]

Russell Coker <russell@coker.com.au> writes:

> Running a recent Debian kernel with latest git policy without the unconfined 
> module I'm seeing the following.  Why would /dev/full be getting the wrong 
> label early in the boot?  It gets fixed along the way somewhere before the 
> system goes to multi-user mode.
>
> # dmesg|grep event_device_t
> [   11.282465] audit: type=1400 audit(1790509173.037:4): avc:  denied  { write 
> } for  pid=534 comm="modprobe" name="full" dev="devtmpfs" ino=7 
> scontext=system_u:system_r:kmod_t:s0 
> tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0
> # ls -lZi /dev/full
> 7 crw-rw-rw-. 1 root root system_u:object_r:null_device_t:s0 1, 7 Sep 27 21:39 
> /dev/full
> # uname -a
> Linux babycakes 7.2.8+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.2.8-1 
> (2026-09-26) x86_64 GNU/Linux

I noticed similar. I suspect this is due to how userspace_initial_sid
polcap is implemented in refpolicy (refpolicy does leverage it does it
not?). Misssing an appropriate auto type transition because the scenario
changed.


-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl