From eba0d3845b4068713aeb7fbf5f1bdebb1ccbcf19 Mon Sep 17 00:00:00 2001
From: Inseob Kim <inseob@google.com>
Date: Thu, 15 Jun 2023 17:28:50 +0900
Subject: [PATCH] Add preinstalled partition to seinfo

Bug: 280547417
Test: boot pixel and cuttlefish
Test: atest SELinuxMMACTest
Change-Id: I0b407ad8b95278453d5b917e0da7024b245062b9
Merged-In: I0b407ad8b95278453d5b917e0da7024b245062b9
---
 .../com/android/server/pm/SELinuxMMAC.java    | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/services/core/java/com/android/server/pm/SELinuxMMAC.java b/services/core/java/com/android/server/pm/SELinuxMMAC.java
index c0e191fd11949..5a941feedd65e 100644
--- a/services/core/java/com/android/server/pm/SELinuxMMAC.java
+++ b/services/core/java/com/android/server/pm/SELinuxMMAC.java
@@ -80,6 +80,8 @@ public final class SELinuxMMAC {
     // Append targetSdkVersion=n to existing seinfo label where n is the app's targetSdkVersion
     private static final String TARGETSDKVERSION_STR = ":targetSdkVersion=";
 
+    private static final String PARTITION_STR = ":partition=";
+
     /**
      * Allows opt-in to the latest targetSdkVersion enforced changes without changing target SDK.
      * Turning this change on for an app targeting the latest SDK or higher is a no-op.
@@ -370,6 +372,23 @@ public final class SELinuxMMAC {
         return pkg.getTargetSdkVersion();
     }
 
+    private static String getPartition(AndroidPackage pkg) {
+        if (pkg.isSystemExt()) {
+            return "system_ext";
+        } else if (pkg.isProduct()) {
+            return "product";
+        } else if (pkg.isVendor()) {
+            return "vendor";
+        } else if (pkg.isOem()) {
+            return "oem";
+        } else if (pkg.isOdm()) {
+            return "odm";
+        } else if (pkg.isSystem()) {
+            return "system";
+        }
+        return "";
+    }
+
     /**
      * Selects a security label to a package based on input parameters and the seinfo tag taken
      * from a matched policy. All signature based policy stanzas are consulted and, if no match
@@ -433,6 +452,11 @@ public final class SELinuxMMAC {
 
         seInfo += TARGETSDKVERSION_STR + targetSdkVersion;
 
+        String partition = getPartition(pkg);
+        if (!partition.isEmpty()) {
+            seInfo += PARTITION_STR + partition;
+        }
+
         if (DEBUG_POLICY_INSTALL) {
             Slog.i(TAG, "package (" + pkg.getPackageName() + ") labeled with "
                     + "seinfo=" + seInfo);