From b0f997deae8edd0a3f7e3ebfc8da5b62bbea10c1 Mon Sep 17 00:00:00 2001 From: Austin Delgado Date: Tue, 28 Feb 2023 21:58:08 +0000 Subject: [PATCH] Revert "Strictly check for SELinux labelling errors" This reverts commit 2ef4e85448df5767b98e0d1dc793b7805249393f. Reason for revert: b/271157681 Change-Id: I7224fd68027e2e9824694171547b8b2c808f9923 --- Utils.cpp | 62 +++++++++++++++++++++------------------ main.cpp | 6 ++-- vold_prepare_subdirs.cpp | 63 ++++++++++++++++++++-------------------- 3 files changed, 68 insertions(+), 63 deletions(-) diff --git a/Utils.cpp b/Utils.cpp index 7f64d33..33dbaf6 100644 --- a/Utils.cpp +++ b/Utils.cpp @@ -23,7 +23,6 @@ #include #include #include -#include #include #include #include @@ -101,18 +100,13 @@ std::string GetFuseMountPathForUser(userid_t user_id, const std::string& relativ status_t CreateDeviceNode(const std::string& path, dev_t dev) { std::lock_guard lock(kSecurityLock); const char* cpath = path.c_str(); - auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); }); - auto secontext = std::unique_ptr(nullptr, freecon); - char* tmp_secontext; + status_t res = 0; - if (selabel_lookup(sehandle, &tmp_secontext, cpath, S_IFBLK) != 0) { - PLOG(ERROR) << "Failed to look up selabel for device node " << path; - return -errno; - } - secontext.reset(tmp_secontext); - if (setfscreatecon(secontext.get()) != 0) { - LOG(ERROR) << "Failed to setfscreatecon for device node " << path; - return -EINVAL; + char* secontext = nullptr; + if (sehandle) { + if (!selabel_lookup(sehandle, &secontext, cpath, S_IFBLK)) { + setfscreatecon(secontext); + } } mode_t mode = 0660 | S_IFBLK; @@ -120,10 +114,16 @@ status_t CreateDeviceNode(const std::string& path, dev_t dev) { if (errno != EEXIST) { PLOG(ERROR) << "Failed to create device node for " << major(dev) << ":" << minor(dev) << " at " << path; - return -errno; + res = -errno; } } - return OK; + + if (secontext) { + setfscreatecon(nullptr); + freecon(secontext); + } + + return res; } status_t DestroyDeviceNode(const std::string& path) { @@ -449,23 +449,29 @@ status_t PrepareDir(const std::string& path, mode_t mode, uid_t uid, gid_t gid, unsigned int attrs) { std::lock_guard lock(kSecurityLock); const char* cpath = path.c_str(); - auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); }); - auto secontext = std::unique_ptr(nullptr, freecon); - char* tmp_secontext; - if (selabel_lookup(sehandle, &tmp_secontext, cpath, S_IFDIR) != 0) { - PLOG(ERROR) << "Failed to look up selabel for directory " << path; + char* secontext = nullptr; + if (sehandle) { + if (!selabel_lookup(sehandle, &secontext, cpath, S_IFDIR)) { + setfscreatecon(secontext); + } + } + + int res = fs_prepare_dir(cpath, mode, uid, gid); + + if (secontext) { + setfscreatecon(nullptr); + freecon(secontext); + } + + if (res) return -errno; + if (attrs) res = SetAttrs(path, attrs); + + if (res == 0) { + return OK; + } else { return -errno; } - secontext.reset(tmp_secontext); - if (setfscreatecon(secontext.get()) != 0) { - LOG(ERROR) << "Failed to setfscreatecon for directory " << path; - return -EINVAL; - } - - if (fs_prepare_dir(cpath, mode, uid, gid) != 0) return -errno; - if (attrs && SetAttrs(path, attrs) != 0) return -errno; - return OK; } status_t ForceUnmount(const std::string& path) { diff --git a/main.cpp b/main.cpp index 078ee14..b07ee68 100644 --- a/main.cpp +++ b/main.cpp @@ -82,11 +82,9 @@ int main(int argc, char** argv) { parse_args(argc, argv); sehandle = selinux_android_file_context_handle(); - if (!sehandle) { - LOG(ERROR) << "Failed to get SELinux file contexts handle"; - exit(1); + if (sehandle) { + selinux_android_set_sehandle(sehandle); } - selinux_android_set_sehandle(sehandle); mkdir("/dev/block/vold", 0755); diff --git a/vold_prepare_subdirs.cpp b/vold_prepare_subdirs.cpp index f4d4309..6ad3c6f 100644 --- a/vold_prepare_subdirs.cpp +++ b/vold_prepare_subdirs.cpp @@ -58,45 +58,50 @@ static bool prepare_dir_for_user(struct selabel_handle* sehandle, mode_t mode, u const std::string& path, uid_t user_id) { auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); }); auto secontext = std::unique_ptr(nullptr, freecon); - char* tmp_secontext; + if (sehandle) { + char* tmp_secontext; - if (selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) != 0) { - PLOG(ERROR) << "Failed to look up selabel for directory " << path; - return false; - } - secontext.reset(tmp_secontext); + if (selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) == 0) { + secontext.reset(tmp_secontext); - if (user_id != (uid_t)-1) { - if (selinux_android_context_with_level(secontext.get(), &tmp_secontext, user_id, - (uid_t)-1) != 0) { - PLOG(ERROR) << "Unable to create context with level for: " << path; - return false; + if (user_id != (uid_t)-1) { + if (selinux_android_context_with_level(secontext.get(), &tmp_secontext, user_id, + (uid_t)-1) != 0) { + PLOG(ERROR) << "Unable to create context with level for: " << path; + return false; + } + secontext.reset(tmp_secontext); // Free the context + } } - secontext.reset(tmp_secontext); } LOG(DEBUG) << "Setting up mode " << std::oct << mode << std::dec << " uid " << uid << " gid " - << gid << " context " << secontext.get() << " on path: " << path; - if (setfscreatecon(secontext.get()) != 0) { - LOG(ERROR) << "Failed to setfscreatecon for directory " << path; - return false; + << gid << " context " << (secontext ? secontext.get() : "null") + << " on path: " << path; + if (secontext) { + if (setfscreatecon(secontext.get()) != 0) { + PLOG(ERROR) << "Unable to setfscreatecon for: " << path; + return false; + } } if (fs_prepare_dir(path.c_str(), mode, uid, gid) != 0) { return false; } - char* tmp_oldsecontext = nullptr; - if (lgetfilecon(path.c_str(), &tmp_oldsecontext) < 0) { - PLOG(ERROR) << "Unable to read secontext for: " << path; - return false; - } - auto oldsecontext = std::unique_ptr(tmp_oldsecontext, freecon); - if (strcmp(secontext.get(), oldsecontext.get()) != 0) { - LOG(INFO) << "Relabelling from " << ((char*)oldsecontext.get()) << " to " - << ((char*)secontext.get()) << ": " << path; - if (lsetfilecon(path.c_str(), secontext.get()) != 0) { - PLOG(ERROR) << "Relabelling failed for: " << path; + if (secontext) { + char* tmp_oldsecontext = nullptr; + if (lgetfilecon(path.c_str(), &tmp_oldsecontext) < 0) { + PLOG(ERROR) << "Unable to read secontext for: " << path; return false; } + auto oldsecontext = std::unique_ptr(tmp_oldsecontext, freecon); + if (strcmp(secontext.get(), oldsecontext.get()) != 0) { + LOG(INFO) << "Relabelling from " << ((char*)oldsecontext.get()) << " to " + << ((char*)secontext.get()) << ": " << path; + if (lsetfilecon(path.c_str(), secontext.get()) != 0) { + PLOG(ERROR) << "Relabelling failed for: " << path; + return false; + } + } } return true; } @@ -163,10 +168,6 @@ static bool prepare_apex_subdirs(struct selabel_handle* sehandle, const std::str static bool prepare_subdirs(const std::string& volume_uuid, int user_id, int flags) { struct selabel_handle* sehandle = selinux_android_file_context_handle(); - if (!sehandle) { - LOG(ERROR) << "Failed to get SELinux file contexts handle"; - return false; - } if (flags & android::os::IVold::STORAGE_FLAG_DE) { auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);