From 693e97732f830cc531c10029eff45b8ef2d31a32 Mon Sep 17 00:00:00 2001 From: Alex Buynytskyy Date: Mon, 2 May 2022 15:56:49 -0700 Subject: [PATCH] More robust restorecon and additional debug info. Bug: 229129448 Test: presubmit Change-Id: I9c71d2702ef17e852a52686f85a4ea591e83950f --- core/jni/android_os_SELinux.cpp | 8 ++++++-- .../android/server/pm/PackageInstallerService.java | 11 ++++++++++- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/core/jni/android_os_SELinux.cpp b/core/jni/android_os_SELinux.cpp index 43c1cfd33fa0b..84ca1ba6ad7cf 100644 --- a/core/jni/android_os_SELinux.cpp +++ b/core/jni/android_os_SELinux.cpp @@ -239,8 +239,12 @@ static jboolean setFileCon(JNIEnv *env, jobject, jstring pathStr, jstring contex char *tmp = const_cast(context.c_str()); int ret = setfilecon(path.c_str(), tmp); - ALOGV("setFileCon(%s, %s) => %d", path.c_str(), context.c_str(), ret); - return (ret == 0) ? true : false; + if (ret == 0) { + ALOGV("setFileCon(%s, %s) => %d", path.c_str(), context.c_str(), ret); + return true; + } + ALOGE("setFileCon(%s, %s) => %d, err: %s", path.c_str(), context.c_str(), ret, strerror(errno)); + return false; } /* diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java index e406a1a4bca78..a01942d0dfa8b 100644 --- a/services/core/java/com/android/server/pm/PackageInstallerService.java +++ b/services/core/java/com/android/server/pm/PackageInstallerService.java @@ -1034,7 +1034,16 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements } if (!SELinux.restorecon(stageDir)) { - throw new IOException("Failed to restorecon session dir: " + stageDir); + String path = stageDir.getCanonicalPath(); + String ctx = SELinux.fileSelabelLookup(path); + boolean success = SELinux.setFileContext(path, ctx); + Slog.e(TAG, + "Failed to SELinux.restorecon session dir, path: [" + path + "], ctx: [" + ctx + + "]. Retrying via SELinux.fileSelabelLookup/SELinux.setFileContext: " + + (success ? "SUCCESS" : "FAILURE")); + if (!success) { + throw new IOException("Failed to restorecon session dir: " + stageDir); + } } }