Re: /dev/full

[Russell Coker <russell@coker.com.au>]

On Monday, 28 September 2026 22:21:32 AEST Dominick Grift wrote:
> >> Thanks for that, it was a default trans rule.  I'll add a named
> >> transition
> >> for /dev/full
> > 
> > That doesn't seem to work.
> > 
> > root@ami:~# sesearch -T -c chr_file|grep null
> > type_transition kernel_t device_t:chr_file null_device_t full;
> > root@ami:~# dmesg|grep event_device_t
> > [    3.269252] audit: type=1400 audit(1790597162.343:4): avc:  denied  {
> > write } for  pid=330 comm="modprobe" name="full" dev="devtmpfs" ino=7
> > scontext=system_u:system_r:kmod_t:s0
> > tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0
> > [    3.272938] audit: type=1400 audit(1790597162.343:5): avc:  denied  {
> > write } for  pid=332 comm="modprobe" name="full" dev="devtmpfs" ino=7
> > scontext=system_u:system_r:kmod_t:s0
> > tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0
> 
> What is the context associated with the init sid? Maybe that is actually
> creating it then?

That's an interesting question, I get the following message in dmesy.

[   10.940969] systemd[1]: Failed to transition into init label 
'system_u:system_r:init_t:s0', ignoring: Permission denied

The following is the policy line you are probably interested in:

policy/modules/kernel/kernel.te:sid init 
gen_context(system_u:system_r:init_t,mls_systemhigh)

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/