tequilaOS/platform_system_vold
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Revert "Strictly check for SELinux labelling errors"

Browse source 
This reverts commit 2ef4e85448.

Reason for revert: b/271157681

Change-Id: I7224fd68027e2e9824694171547b8b2c808f9923
This commit is contained in:
Austin Delgado 2023-02-28 21:58:08 +00:00 committed by Gerrit Code Review
parent 2ef4e85448
commit b0f997deae
3 changed files with 68 additions and 63 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

62
Utils.cpp
View file

@ -23,7 +23,6 @@
#include <android-base/file.h> #include <android-base/file.h>
#include <android-base/logging.h> #include <android-base/logging.h>
#include <android-base/properties.h> #include <android-base/properties.h>
#include <android-base/scopeguard.h>
#include <android-base/stringprintf.h> #include <android-base/stringprintf.h>
#include <android-base/strings.h> #include <android-base/strings.h>
#include <android-base/unique_fd.h> #include <android-base/unique_fd.h>
@ -101,18 +100,13 @@ std::string GetFuseMountPathForUser(userid_t user_id, const std::string& relativ
status_t CreateDeviceNode(const std::string& path, dev_t dev) { status_t CreateDeviceNode(const std::string& path, dev_t dev) {
std::lock_guard<std::mutex> lock(kSecurityLock); std::lock_guard<std::mutex> lock(kSecurityLock);
const char* cpath = path.c_str(); const char* cpath = path.c_str();
auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); }); status_t res = 0;
auto secontext = std::unique_ptr<char, void (*)(char*)>(nullptr, freecon);
char* tmp_secontext;
if (selabel_lookup(sehandle, &tmp_secontext, cpath, S_IFBLK) != 0) { char* secontext = nullptr;
PLOG(ERROR) << "Failed to look up selabel for device node " << path; if (sehandle) {
return -errno; if (!selabel_lookup(sehandle, &secontext, cpath, S_IFBLK)) {
} setfscreatecon(secontext);
secontext.reset(tmp_secontext); }
if (setfscreatecon(secontext.get()) != 0) {
LOG(ERROR) << "Failed to setfscreatecon for device node " << path;
return -EINVAL;
} }
mode_t mode = 0660 | S_IFBLK; mode_t mode = 0660 | S_IFBLK;
@ -120,10 +114,16 @@ status_t CreateDeviceNode(const std::string& path, dev_t dev) {
if (errno != EEXIST) { if (errno != EEXIST) {
PLOG(ERROR) << "Failed to create device node for " << major(dev) << ":" << minor(dev) PLOG(ERROR) << "Failed to create device node for " << major(dev) << ":" << minor(dev)
<< " at " << path; << " at " << path;
return -errno; res = -errno;
} }
} }
return OK;
if (secontext) {
setfscreatecon(nullptr);
freecon(secontext);
}
return res;
} }
status_t DestroyDeviceNode(const std::string& path) { status_t DestroyDeviceNode(const std::string& path) {
@ -449,23 +449,29 @@ status_t PrepareDir(const std::string& path, mode_t mode, uid_t uid, gid_t gid,
unsigned int attrs) { unsigned int attrs) {
std::lock_guard<std::mutex> lock(kSecurityLock); std::lock_guard<std::mutex> lock(kSecurityLock);
const char* cpath = path.c_str(); const char* cpath = path.c_str();
auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); });
auto secontext = std::unique_ptr<char, void (*)(char*)>(nullptr, freecon);
char* tmp_secontext;
if (selabel_lookup(sehandle, &tmp_secontext, cpath, S_IFDIR) != 0) { char* secontext = nullptr;
PLOG(ERROR) << "Failed to look up selabel for directory " << path; if (sehandle) {
if (!selabel_lookup(sehandle, &secontext, cpath, S_IFDIR)) {
setfscreatecon(secontext);
}
}
int res = fs_prepare_dir(cpath, mode, uid, gid);
if (secontext) {
setfscreatecon(nullptr);
freecon(secontext);
}
if (res) return -errno;
if (attrs) res = SetAttrs(path, attrs);
if (res == 0) {
return OK;
} else {
return -errno; return -errno;
} }
secontext.reset(tmp_secontext);
if (setfscreatecon(secontext.get()) != 0) {
LOG(ERROR) << "Failed to setfscreatecon for directory " << path;
return -EINVAL;
}
if (fs_prepare_dir(cpath, mode, uid, gid) != 0) return -errno;
if (attrs && SetAttrs(path, attrs) != 0) return -errno;
return OK;
} }
status_t ForceUnmount(const std::string& path) { status_t ForceUnmount(const std::string& path) {

6
main.cpp
View file

@ -82,11 +82,9 @@ int main(int argc, char** argv) {
parse_args(argc, argv); parse_args(argc, argv);
sehandle = selinux_android_file_context_handle(); sehandle = selinux_android_file_context_handle();
if (!sehandle) { if (sehandle) {
LOG(ERROR) << "Failed to get SELinux file contexts handle"; selinux_android_set_sehandle(sehandle);
exit(1);
} }
selinux_android_set_sehandle(sehandle);
mkdir("/dev/block/vold", 0755); mkdir("/dev/block/vold", 0755);

63
vold_prepare_subdirs.cpp
View file

@ -58,45 +58,50 @@ static bool prepare_dir_for_user(struct selabel_handle* sehandle, mode_t mode, u
const std::string& path, uid_t user_id) { const std::string& path, uid_t user_id) {
auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); }); auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); });
auto secontext = std::unique_ptr<char, void (*)(char*)>(nullptr, freecon); auto secontext = std::unique_ptr<char, void (*)(char*)>(nullptr, freecon);
char* tmp_secontext; if (sehandle) {
char* tmp_secontext;
if (selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) != 0) { if (selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) == 0) {
PLOG(ERROR) << "Failed to look up selabel for directory " << path; secontext.reset(tmp_secontext);
return false;
}
secontext.reset(tmp_secontext);
if (user_id != (uid_t)-1) { if (user_id != (uid_t)-1) {
if (selinux_android_context_with_level(secontext.get(), &tmp_secontext, user_id, if (selinux_android_context_with_level(secontext.get(), &tmp_secontext, user_id,
(uid_t)-1) != 0) { (uid_t)-1) != 0) {
PLOG(ERROR) << "Unable to create context with level for: " << path; PLOG(ERROR) << "Unable to create context with level for: " << path;
return false; return false;
}
secontext.reset(tmp_secontext); // Free the context
}
} }
secontext.reset(tmp_secontext);
} }
LOG(DEBUG) << "Setting up mode " << std::oct << mode << std::dec << " uid " << uid << " gid " LOG(DEBUG) << "Setting up mode " << std::oct << mode << std::dec << " uid " << uid << " gid "
<< gid << " context " << secontext.get() << " on path: " << path; << gid << " context " << (secontext ? secontext.get() : "null")
if (setfscreatecon(secontext.get()) != 0) { << " on path: " << path;
LOG(ERROR) << "Failed to setfscreatecon for directory " << path; if (secontext) {
return false; if (setfscreatecon(secontext.get()) != 0) {
PLOG(ERROR) << "Unable to setfscreatecon for: " << path;
return false;
}
} }
if (fs_prepare_dir(path.c_str(), mode, uid, gid) != 0) { if (fs_prepare_dir(path.c_str(), mode, uid, gid) != 0) {
return false; return false;
} }
char* tmp_oldsecontext = nullptr; if (secontext) {
if (lgetfilecon(path.c_str(), &tmp_oldsecontext) < 0) { char* tmp_oldsecontext = nullptr;
PLOG(ERROR) << "Unable to read secontext for: " << path; if (lgetfilecon(path.c_str(), &tmp_oldsecontext) < 0) {
return false; PLOG(ERROR) << "Unable to read secontext for: " << path;
}
auto oldsecontext = std::unique_ptr<char, void (*)(char*)>(tmp_oldsecontext, freecon);
if (strcmp(secontext.get(), oldsecontext.get()) != 0) {
LOG(INFO) << "Relabelling from " << ((char*)oldsecontext.get()) << " to "
<< ((char*)secontext.get()) << ": " << path;
if (lsetfilecon(path.c_str(), secontext.get()) != 0) {
PLOG(ERROR) << "Relabelling failed for: " << path;
return false; return false;
} }
auto oldsecontext = std::unique_ptr<char, void (*)(char*)>(tmp_oldsecontext, freecon);
if (strcmp(secontext.get(), oldsecontext.get()) != 0) {
LOG(INFO) << "Relabelling from " << ((char*)oldsecontext.get()) << " to "
<< ((char*)secontext.get()) << ": " << path;
if (lsetfilecon(path.c_str(), secontext.get()) != 0) {
PLOG(ERROR) << "Relabelling failed for: " << path;
return false;
}
}
} }
return true; return true;
} }
@ -163,10 +168,6 @@ static bool prepare_apex_subdirs(struct selabel_handle* sehandle, const std::str
static bool prepare_subdirs(const std::string& volume_uuid, int user_id, int flags) { static bool prepare_subdirs(const std::string& volume_uuid, int user_id, int flags) {
struct selabel_handle* sehandle = selinux_android_file_context_handle(); struct selabel_handle* sehandle = selinux_android_file_context_handle();
if (!sehandle) {
LOG(ERROR) << "Failed to get SELinux file contexts handle";
return false;
}
if (flags & android::os::IVold::STORAGE_FLAG_DE) { if (flags & android::os::IVold::STORAGE_FLAG_DE) {
auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id); auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);