GitLab

* commit '24a286e6':
  Don't set restorecon_last on subdirectories

* commit 'a8e4ad3c':
  Don't set restorecon_last on subdirectories

When restorecon_recursive is called, we set the directory xattr
"security.restorecon_last" to the hash of /file_contexts.
This allows us to do automatic relabeling when /file_contexts
changes.

Prior to this change, we were also setting the xattr for all
subdirectories of the directory. Doing so is unnecessary because
we never look at the value.

Remove setting the xattr for subdirectories, but continue to set
the xattr for the directory itself.

Change-Id: Id81d1e24209e195c559b4e382bee42ddd48a7593

* commit '807e815a':
  restorecon top-level entries under /data/user.

* commit 'b4c9808a':
  restorecon top-level entries under /data/user.

/data/user has a set of top-level entries including the /data/user/0
symlink and the /data/user/N subdirectories for secondary users that
need to be relabeled on upgrades from 4.2 with unlabeled userdata.
Only set the flag to skip on subdirectories of /data/user, not on
/data/user itself.

Change-Id: I7a4c7ede74daa249db654963ba49585755c9b04e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

* commit 'f6237001':
  Ensure labeling of /data/data and /data/user

* commit '4b130cc0':
  Ensure labeling of /data/data and /data/user

On an upgrade, the *contents* of the /data/data and /data/user
directories are not labeled by init, because their labels are
managed by installd.

However, the /data/data and /data/user directories themselves are
never labeled, neither by init nor installd.

On an upgrade from an Android 4.2 system, it's possible for these
two directories to remain unlabeled, causing anything created
within these directories to also be unlabeled.

Make sure we label /data/data and /data/user (but not their contents)
from init's restorecon_recursive.

Change-Id: I65dcfa8e77a63cb61551a1010358f0e45956dbbf

* commit 'f4a4fb4d':
  Optimize restorecon_recursive tree walk.

* commit '0e7340fb':
  Optimize restorecon_recursive tree walk.

restorecon_recursive can prune the tree walk whenever it
encounters a directory for which there is no possible match
for any of its descendants in the file_contexts configuration.
This will only presently benefit the restorecon_recursive("/sys") call
by init since other restorecon_recursive calls always have
top-level entries that will match anything underneath and this
is required to fully label those partitions on upgrade. However,
those other cases are already optimized to only run once per
file_contexts change (upgrade) and thus do not need this optimization.

Change-Id: I854bf1ccff6ded56e9da2c4184435f67d7069bc1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

* commit '5e4012a3':

* commit '13319cfa':
  Improve error handling for seapp_contexts.

Detect and reject configurations that specify name= without
seinfo= or with seinfo=default.

On any error during loading the configuration, drop the entire
configuration.  This will prevent system_server or any apps
from being started by zygote at all.  Previously we could be
left with a partially loaded, unsorted configuration which could
lead to partial startup but mislabeled processes.

On the error path, do not try to report the (name, value) pair for
the invalid entry as they are not always set (or meaningful) on all
code paths and we already have check_seapp to check and report the
same errors at build time.

Provide common helpers for freeing the configuration entries and
ensure that we always do it on any error during loading.

Change-Id: I2b238e90c9cc07a410e08a96a10d7699b608b3df
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

* commit '1d66afb5':
  Add a new API for relabeling package directories.

Add a new selinux_android_restorecon_pkgdir() API for
relabeling package directories that explicitly takes the
seinfo and uid information from the caller.  This is similar
to the selinux_android_setfilecon() API used by installd to
label newly created package directories but can be used to
recursively restorecon existing package directories.  By
passing the seinfo and uid information directly, we avoid the
need to rely upon packages.list for this purpose and can
perform the relabeling on a per-directory basis before each app
is loaded.

Also if we are not provided with a seinfo value and we cannot
lookup the package name in packages.list, log a warning and
return an error condition rather than silently ignoring the failure.
This avoids mislabeling the file by restorecon and provides a warning
if any future bugs arise in this area.

Change-Id: Ie440cba2c96f0907458086348197e1506d31c1b6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

am b7cc6d09: am 8b476094: DO NOT MERGE: Fix a bug in the userspace AVC that broke per-domain permissive mode.

* commit 'b7cc6d09':
  DO NOT MERGE: Fix a bug in the userspace AVC that broke per-domain permissive mode.

* commit '8b476094':
  DO NOT MERGE: Fix a bug in the userspace AVC that broke per-domain permissive mode.

* commit '8b476094':
  DO NOT MERGE: Fix a bug in the userspace AVC that broke per-domain permissive mode.

Failure to copy the entire av_decision structure, including the
flags field, would prevent preservation of the SELINUX_AVD_FLAGS_PERMISSIVE
flag and thus cause per-domain permissive to not be honored for userspace
permission checks.

Also ensure that we clear the entire structure.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

(cherry picked from commit 0dbac4ea)

Bug: 13450413
Change-Id: I36c7445dc385e647e4f0f4a2dee04723d1b7c9bc

* commit 'db21feb2':
  Don't read selinux policies from /data

* commit 'db21feb2':
  Don't read selinux policies from /data

Bug: 12613118

(cherry picked from commit c661446c)

Change-Id: I5114c9dde5edc3365cfb6e98ec2c0cd6a249cf8f

* commit '833cbd68':
  Disable restorecon_last usage for restorecon /data/data.

* commit '274e0f64':
  Add support for path= specifier in seapp_contexts.

* commit '027670de':
  Only restorecon /data/data if passed an explicit flag.

* commit 'ab40ea9b':
  Get rid of security_context_t and fix const declarations.

* commit '4abb4b98':
  Apply const to SELboolean array and name field.

* commit '1b478ead':
  Convert all selinux_android_restorecon and _setfilecon calls to new API.

* commit 'f61f9792':
  Replace obsolete selinux_android_restorecon* functions with macros.

* commit 'e183cec0':
  Extend restorecon to handle app data directories correctly.

* commit '08587cfb':
  Unify toolbox restorecon and libselinux restorecon implementations.

* commit 'b77c0360':
  Fix return value of selinux_android_restorecon.

* commit '0a10104a':
  Do not log the file_contexts digest/hash value.

* commit '2df3611d':
  Don't read selinux policies from /data

Change-Id: I42443bfe245d7756d5666773cb8644bb1549a1de

Bug: 12613118
Change-Id: I9b2dfeeda4135762ed418ec6e29e39fa2a8328e5
(cherry picked from commit c661446c)

* commit '833cbd68':
  Disable restorecon_last usage for restorecon /data/data.