tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

add SELINUX_ANDROID_RESTORECON_SKIP_SEHASH

Browse source 
Allow callers to indicate that they don't want to compute the sehash
value. Callers may not have CAP_SYS_ADMIN, so attempting to write the
sehash value will result in the following (harmless) errors:

  SELinux:  setxattr failed: /data/app/com.andromeda.androbench2-z5oLVfPATqQF35yGDuMUeA==:  Operation not permitted

TODO: It would be better if the default for restorecon was to suppress
the hash computation, since otherwise it encourages programs to be
overprivileged with CAP_SYS_ADMIN. I'll plan on doing that in a followup
commit.

Bugs where this error message has been called out:
Bug: 129766333
Bug: 129271240
Bug: 128700692
Bug: 129925723

Test: install an APK and ensure that no "SELinux:  setxattr failed"
    error messages are generated.

Change-Id: I396f036681abf106d48413a7a6126d4a6af2fa3a
This commit is contained in:
Nick Kralevich 2019-04-04 16:14:08 -07:00
parent 3e334d0162
commit 3060b61d41
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
libselinux/include/selinux/android.h
View file

@ -53,6 +53,7 @@ extern int selinux_vendor_log_callback(int type, const char *fmt, ...)
#define SELINUX_ANDROID_RESTORECON_DATADATA 16
#define SELINUX_ANDROID_RESTORECON_SKIPCE 32
#define SELINUX_ANDROID_RESTORECON_CROSS_FILESYSTEMS 64
#define SELINUX_ANDROID_RESTORECON_SKIP_SEHASH 128
extern int selinux_android_restorecon(const char *file, unsigned int flags);
extern int selinux_android_restorecon_pkgdir(const char *pkgdir,

2
libselinux/src/android/android_platform.c
View file

@ -1569,8 +1569,8 @@ static int selinux_android_restorecon_common(const char* pathname_orig,
bool datadata = (flags & SELINUX_ANDROID_RESTORECON_DATADATA) ? true : false;
bool skipce = (flags & SELINUX_ANDROID_RESTORECON_SKIPCE) ? true : false;
bool cross_filesystems = (flags & SELINUX_ANDROID_RESTORECON_CROSS_FILESYSTEMS) ? true : false;
bool setrestoreconlast = (flags & SELINUX_ANDROID_RESTORECON_SKIP_SEHASH) ? false : true;
bool issys;
bool setrestoreconlast = true;
struct stat sb;
struct statfs sfsb;
FTS *fts;