From d88acc95ab7b74979b123f0d4523bb2c4eec2880 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Thu, 4 Apr 2019 15:54:58 -0700 Subject: [PATCH] Don't set sehash when calling restoreconRecursive restorecon_recursive updates the SELinux label of the files in the filesystem, and then attempts to write the xattr "security.sehash" as an optimization for future restorecons. Writing security.* extended attributes requires CAP_SYS_ADMIN, which system_server doesn't have (and shouldn't have). Suppress the computation and writing of the hash value. It's not needed. This bug has been around for a long time, but due to the fix for bug 62302954, the error message is being generated more frequently now. TODO: It would be better if the default for restorecon was to suppress the hash computation, since otherwise it encourages programs to be overprivileged with CAP_SYS_ADMIN. I'll plan on doing that in a followup commit. Bugs where this error message has been called out: Bug: 129766333 Bug: 129271240 Bug: 128700692 Bug: 129925723 Test: install an APK and ensure that no "SELinux: setxattr failed" error messages are generated. (cherry picked from commit cb1dddad27b86e675f7141ca429e9bb8ab8ac410) Change-Id: Ifc5be24d14029cb616d5564366fc10a0b93c9939 --- core/java/android/os/SELinux.java | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/core/java/android/os/SELinux.java b/core/java/android/os/SELinux.java index f007dff0ab581..34809e76c91bd 100644 --- a/core/java/android/os/SELinux.java +++ b/core/java/android/os/SELinux.java @@ -31,12 +31,15 @@ import java.io.IOException; public class SELinux { private static final String TAG = "SELinux"; - /** Keep in sync with ./external/libselinux/include/selinux/android.h */ + /** Keep in sync with ./external/selinux/libselinux/include/selinux/android.h */ private static final int SELINUX_ANDROID_RESTORECON_NOCHANGE = 1; private static final int SELINUX_ANDROID_RESTORECON_VERBOSE = 2; private static final int SELINUX_ANDROID_RESTORECON_RECURSE = 4; private static final int SELINUX_ANDROID_RESTORECON_FORCE = 8; private static final int SELINUX_ANDROID_RESTORECON_DATADATA = 16; + private static final int SELINUX_ANDROID_RESTORECON_SKIPCE = 32; + private static final int SELINUX_ANDROID_RESTORECON_CROSS_FILESYSTEMS = 64; + private static final int SELINUX_ANDROID_RESTORECON_SKIP_SEHASH = 128; /** * Get context associated with path by file_contexts. @@ -182,7 +185,8 @@ public class SELinux { @UnsupportedAppUsage public static boolean restoreconRecursive(File file) { try { - return native_restorecon(file.getCanonicalPath(), SELINUX_ANDROID_RESTORECON_RECURSE); + return native_restorecon(file.getCanonicalPath(), + SELINUX_ANDROID_RESTORECON_RECURSE | SELINUX_ANDROID_RESTORECON_SKIP_SEHASH); } catch (IOException e) { Slog.e(TAG, "Error getting canonical path. Restorecon failed for " + file.getPath(), e);