Merge "More robust restorecon and additional debug info." into tm-dev am: 8169e839ca

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/18129666

Change-Id: I70d164407767133370c4c8cd50252b6cc572ed26
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

core/jni/android_os_SELinux.cpp

@@ -239,8 +239,12 @@ static jboolean setFileCon(JNIEnv *env, jobject, jstring pathStr, jstring contex
     char *tmp = const_cast<char *>(context.c_str());
     int ret = setfilecon(path.c_str(), tmp);
 
-    ALOGV("setFileCon(%s, %s) => %d", path.c_str(), context.c_str(), ret);
+    if (ret == 0) {
-    return (ret == 0) ? true : false;
+        ALOGV("setFileCon(%s, %s) => %d", path.c_str(), context.c_str(), ret);
+        return true;
+    }
+    ALOGE("setFileCon(%s, %s) => %d, err: %s", path.c_str(), context.c_str(), ret, strerror(errno));
+    return false;
 }
 
 /*

services/core/java/com/android/server/pm/PackageInstallerService.java

@@ -1034,7 +1034,16 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements
         }
 
         if (!SELinux.restorecon(stageDir)) {
-            throw new IOException("Failed to restorecon session dir: " + stageDir);
+            String path = stageDir.getCanonicalPath();
+            String ctx = SELinux.fileSelabelLookup(path);
+            boolean success = SELinux.setFileContext(path, ctx);
+            Slog.e(TAG,
+                    "Failed to SELinux.restorecon session dir, path: [" + path + "], ctx: [" + ctx
+                            + "]. Retrying via SELinux.fileSelabelLookup/SELinux.setFileContext: "
+                            + (success ? "SUCCESS" : "FAILURE"));
+            if (!success) {
+                throw new IOException("Failed to restorecon session dir: " + stageDir);
+            }
         }
     }