Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't set sehash when calling restoreconRecursive

Browse Source 
restorecon_recursive updates the SELinux label of the files in the
filesystem, and then attempts to write the xattr "security.sehash" as an
optimization for future restorecons. Writing security.* extended
attributes requires CAP_SYS_ADMIN, which system_server doesn't have (and
shouldn't have).

Suppress the computation and writing of the hash value. It's not
needed.

This bug has been around for a long time, but due to the fix for
bug 62302954, the error message is being generated more frequently
now.

TODO: It would be better if the default for restorecon was to suppress
the hash computation, since otherwise it encourages programs to be
overprivileged with CAP_SYS_ADMIN. I'll plan on doing that in a followup
commit.

Bugs where this error message has been called out:
Bug: 129766333
Bug: 129271240
Bug: 128700692
Bug: 129925723

Test: install an APK and ensure that no "SELinux:  setxattr failed"
    error messages are generated.
Change-Id: I83f4f225e4e73453daea42dbcabf0f8a06d320d6
This commit is contained in:
Nick Kralevich
2019-04-04 15:54:58 -07:00
parent 37f6620029
commit cb1dddad27
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/java/android/os/SELinux.java
View File

@@ -31,12 +31,15 @@ import java.io.IOException;
public class SELinux {
private static final String TAG = "SELinux";
/** Keep in sync with ./external/libselinux/include/selinux/android.h */
/** Keep in sync with ./external/selinux/libselinux/include/selinux/android.h */
private static final int SELINUX_ANDROID_RESTORECON_NOCHANGE = 1;
private static final int SELINUX_ANDROID_RESTORECON_VERBOSE = 2;
private static final int SELINUX_ANDROID_RESTORECON_RECURSE = 4;
private static final int SELINUX_ANDROID_RESTORECON_FORCE = 8;
private static final int SELINUX_ANDROID_RESTORECON_DATADATA = 16;
private static final int SELINUX_ANDROID_RESTORECON_SKIPCE = 32;
private static final int SELINUX_ANDROID_RESTORECON_CROSS_FILESYSTEMS = 64;
private static final int SELINUX_ANDROID_RESTORECON_SKIP_SEHASH = 128;
/**
* Determine whether SELinux is disabled or enabled.
@@ -175,7 +178,8 @@ public class SELinux {
@UnsupportedAppUsage
public static boolean restoreconRecursive(File file) {
try {
return native_restorecon(file.getCanonicalPath(), SELINUX_ANDROID_RESTORECON_RECURSE);
return native_restorecon(file.getCanonicalPath(),
SELINUX_ANDROID_RESTORECON_RECURSE | SELINUX_ANDROID_RESTORECON_SKIP_SEHASH);
} catch (IOException e) {
Slog.e(TAG, "Error getting canonical path. Restorecon failed for " +
file.getPath(), e);