From 2d3cc3b458831550a4a1caccd03c98a4a0def064 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Tue, 14 May 2019 09:23:26 -0700 Subject: Delay /data/vendor_ce restorecon When Android boots after file_contexts has changed, the boot process walks the entire /data partition, updating any changed SELinux labels as appropriate. However, credential encrypted ("ce") directories are deliberately excluded from this early boot directory walk. Files within ce directories have their filenames encrypted, and as a result, cannot match the file_contexts entries. Only after the user has unlocked their device are the unencrypted filenames available and a restorecon appropriate. Exclude /data/vendor_ce from the early boot restorecon, like we do for /data/system_ce and /data/misc_ce. This prevents init from inappropriately relabeling these files with encrypted filenames. Bug: 132349934 Test: See bug 132349934 comment #12 for test procedure Change-Id: I59171f11dc25d446fae3760c4aa538264944391d --- libselinux/src/android/android_platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libselinux/src/android/android_platform.c b/libselinux/src/android/android_platform.c index c0e60440..83a795a7 100644 --- a/libselinux/src/android/android_platform.c +++ b/libselinux/src/android/android_platform.c @@ -1324,6 +1324,7 @@ struct pkg_info *package_info_lookup(const char *name) * to delay restorecon of those until vold explicitly requests it. */ // NOTE: these paths need to be kept in sync with vold #define DATA_SYSTEM_CE_PREFIX "/data/system_ce/" +#define DATA_VENDOR_CE_PREFIX "/data/vendor_ce/" #define DATA_MISC_CE_PREFIX "/data/misc_ce/" /* The path prefixes of package data directories. */ @@ -1713,7 +1714,8 @@ static int selinux_android_restorecon_common(const char* pathname_orig, if (skipce && (!strncmp(ftsent->fts_path, DATA_SYSTEM_CE_PREFIX, sizeof(DATA_SYSTEM_CE_PREFIX)-1) || - !strncmp(ftsent->fts_path, DATA_MISC_CE_PREFIX, sizeof(DATA_MISC_CE_PREFIX)-1))) { + !strncmp(ftsent->fts_path, DATA_MISC_CE_PREFIX, sizeof(DATA_MISC_CE_PREFIX)-1) || + !strncmp(ftsent->fts_path, DATA_VENDOR_CE_PREFIX, sizeof(DATA_VENDOR_CE_PREFIX)-1))) { // Don't label anything below this directory. fts_set(fts, ftsent, FTS_SKIP); // but fall through and make sure we label the directory itself -- cgit v1.2.3