I have in my logs
grsec: From <>: (default:D:/sbin/mdadm) denied access to hidden file /dev/mem by /sbin/mdadm[mdadm:1168] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/strace[strace:1167] uid/euid:0/0 gid/egid:0/0
grsec: From <>: (default:D:/sbin/mdadm) denied access to hidden file /dev/grsec by /sbin/mdadm[mdadm:1168] uid/euid:0/0 gid/egid:0/0, parent /usr/bin/strace[strace:1167] uid/euid:0/0 gid/egid:0/0
Although /dev/grsec has the hidden object mode.
This is caused by udev leaking grsec's existance through a symlink in /dev/.udev/db/mem:grsec
Same thing happens with /dev/mem.
Just wanted to let you know.