Looking through /sys/fs/selinux, I found this:

# ls -l /sys/fs/selinux/null
crw-rw-rw-. 1 root root 1, 3 Jan 24 02:47 /sys/fs/selinux/null

Which is identical to /dev/null:

# ls -l /dev/null
crw-rw-rw-. 1 root root 1, 3 Jan 24 10:47 /dev/null

So what's the point of SELinux having its own null device?


This is scarcely explained in Implementing SELinux as a Linux Security Module

This results in a populated selinuxfs filesystem and sets up the special null device node used by SELinux when it closes unauthorized files upon a context-changing execve.

Apparently programs cannot use /dev/null directly while in SELinux-context and they needed their own version. This was formerly known as open_devnull and its inception gives a few more details on why this was needed:

This patch against 2.6.6-rc3 changes the SELinux module to try to reset any descriptors it closes on exec (due to a lack of permission by the new domain to the inherited open file) to refer to the null device. This counters the problem of SELinux inducing program misbehavior, particularly due to having descriptors 0-2 closed when the new domain is not allowed access to the caller's tty. This is primarily to address the case where the caller is trusted with respect to the new domain, as the untrusted caller case is already handled via AT_SECURE and glibc secure mode.

  • 1
    Sound like technocratic gibberish to me, but still is an answer. – not2qubit May 28 '14 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.