Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change when the SELinux relabel of /data/data occurs.

Browse Source 
Perform the relabel of the /data/data/<pkg> directories
when the app is being scanned by the PMS. The impetus
for this change was that the data directories of forward
locked apps were receiving the wrong label during an
OTA. Because the PMS doesn't actually scan forward locked
apps til later in the boot process, the prior restorecon
call was actually applying the default label of
system_data_file for all such apps. By performing a
restorecon on each individual app as they are entered into
the PMS we can handle them correctly. This mechanism also
allows us to pass down the seinfo tag as part of the
restorecon call which drops our need to rely on the contents
of packages.list.

Change-Id: Ie440cba2c96f0907458086348197e1506d31c1b6
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
This commit is contained in:
Robert Craig
2014-03-27 10:00:58 -04:00
parent 55a655091a
commit 172d38bcda
2 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/java/com/android/server/pm/Installer.java
View File

@@ -397,7 +397,14 @@ public final class Installer {
return execute(builder.toString());
}
public boolean restoreconData() {
return (execute("restorecondata") == 0);
public boolean restoreconData(String pkgName, String seinfo, int uid) {
StringBuilder builder = new StringBuilder("restorecondata");
builder.append(' ');
builder.append(pkgName);
builder.append(' ');
builder.append(seinfo != null ? seinfo : "!");
builder.append(' ');
builder.append(uid);
return (execute(builder.toString()) == 0);
}
}

19
services/java/com/android/server/pm/PackageManagerService.java
View File

@@ -393,6 +393,9 @@ public class PackageManagerService extends IPackageManager.Stub {
// If mac_permissions.xml was found for seinfo labeling.
boolean mFoundPolicyFile;
// If a recursive restorecon of /data/data/<pkg> is needed.
private boolean mShouldRestoreconData = SELinuxMMAC.shouldRestorecon();
// All available activities, for your resolving pleasure.
final ActivityIntentResolver mActivities =
new ActivityIntentResolver();
@@ -1486,13 +1489,6 @@ public class PackageManagerService extends IPackageManager.Stub {
// can downgrade to reader
mSettings.writeLPr();
if (SELinuxMMAC.shouldRestorecon()) {
Slog.i(TAG, "Relabeling of /data/data and /data/user issued.");
if (mInstaller.restoreconData()) {
SELinuxMMAC.setRestoreconDone();
}
}
EventLog.writeEvent(EventLogTags.BOOT_PROGRESS_PMS_READY,
SystemClock.uptimeMillis());
@@ -4617,6 +4613,11 @@ public class PackageManagerService extends IPackageManager.Stub {
}
}
pkg.applicationInfo.dataDir = dataPath.getPath();
if (mShouldRestoreconData) {
Slog.i(TAG, "SELinux relabeling of " + pkg.packageName + " issued.");
mInstaller.restoreconData(pkg.packageName, pkg.applicationInfo.seinfo,
pkg.applicationInfo.uid);
}
} else {
if (DEBUG_PACKAGE_SCANNING) {
if ((parseFlags & PackageParser.PARSE_CHATTY) != 0)
@@ -11062,6 +11063,10 @@ public class PackageManagerService extends IPackageManager.Stub {
*/
public void scanAvailableAsecs() {
updateExternalMediaStatusInner(true, false, false);
if (mShouldRestoreconData) {
SELinuxMMAC.setRestoreconDone();
mShouldRestoreconData = false;
}
}
/*