GitLab

Commit bf9441e in bionic introduced a new scheme for naming system uids
as secondary users (as part of multi-user support).  Update the libselinux
logic to correctly map these identities for lookup purposes in the
seapp_contexts configuration file.

This is not needed when used within the reload scenerio. We
actually need the file_contexts to be read multiple times.

These changes reflect changes made to init.
The sepolicy reload now happens in libselinux.

Allows the zygote to still spawn apps in the zygote's
context when no match is found in seapp_contexts. In
enforcing mode, apps that are not matched will not be
spawned. A "No match" message will (still) be printed
to logcat.

Change-Id: Ibe362cc8e168be7acae5162c9ff6a310233fcbe6

The seapp rule will containing an sebool clause will
ONLY be applied on a match to that boolean,
and only if the boolean is set to true.

Change-Id: Ifdba35cd3a78ce1c8173786514db649203018e28
Signed-off-by: William Roberts <w.roberts@sta.samsung.com>

This reverts commit 0beab968.

This patch will allow non-matched apps in seapp_contexts to
still be spawned via the zygote. An error message will be sent
to logcat.

Change-Id: I9fb5dcfeb384a26e6a01d69bffd2ef14af74c51c
Signed-off-by: William Roberts <w.roberts@sta.samsung.com>

Add function selinux_android_file_context_handle
that opens the correct file_contexts policy file
and returns the available sehandle object.

Change-Id: I1fd35714001e3fcf9022756334cbb89611ce5c66

We need to always build libselinux even if it's not being used by
anything in the system image. This makes sure some unrelated change
doesn't accidentally break libselinux.

This reverts commit 6670f53f.

seapp_contexts configuration upon updates, and introduce support for
loading it from /data/system or /.