Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fbbd7953 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

Update OTA to understand SELinux filesystem labels 

Make fs_config aware of SELinux contexts, and output the context
whenever we output the UID / GID / file perms.

Pass the selinux context to the set_perm2() and set_perm2_recursive()
calls. When the OTA script fixes up filesystem permissions, it will
also fix up the SELinux context on the files.

Bug: 8985290
Change-Id: I6419b64c06309a93ac6b2f2cf9fc7f8815adeaf3
parent 0a2c858b

core/Makefile

+4 −3
Original line number Diff line number Diff line
@@ -1142,6 +1142,7 @@ $(BUILT_TARGET_FILES_PACKAGE): \ 
		$(INSTALLED_CACHEIMAGE_TARGET) \

		$(INSTALLED_VENDORIMAGE_TARGET) \

		$(INSTALLED_ANDROID_INFO_TXT_TARGET) \

		$(SELINUX_FC) \

		$(built_ota_tools) \

		$(APKCERTS_FILE) \

		$(HOST_OUT_EXECUTABLES)/fs_config \
@@ -1233,9 +1234,9 @@ endif 
	@# Zip everything up, preserving symlinks

	$(hide) (cd $(zip_root) && zip -qry ../$(notdir $@) .)

	@# Run fs_config on all the system, boot ramdisk, and recovery ramdisk files in the zip, and save the output

	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="SYSTEM/" } /^SYSTEM\// {print "system/" $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config > $(zip_root)/META/filesystem_config.txt

	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="BOOT/RAMDISK/" } /^BOOT\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config > $(zip_root)/META/boot_filesystem_config.txt

	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="RECOVERY/RAMDISK/" } /^RECOVERY\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config > $(zip_root)/META/recovery_filesystem_config.txt

	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="SYSTEM/" } /^SYSTEM\// {print "system/" $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -S $(SELINUX_FC) > $(zip_root)/META/filesystem_config.txt

	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="BOOT/RAMDISK/" } /^BOOT\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -S $(SELINUX_FC) > $(zip_root)/META/boot_filesystem_config.txt

	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="RECOVERY/RAMDISK/" } /^RECOVERY\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -S $(SELINUX_FC) > $(zip_root)/META/recovery_filesystem_config.txt

	$(hide) (cd $(zip_root) && zip -q ../$(notdir $@) META/*filesystem_config.txt)



.PHONY: target-files-package

tools/fs_config/Android.mk

+1 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ include $(CLEAR_VARS) 


LOCAL_SRC_FILES := fs_config.c

LOCAL_MODULE := fs_config

LOCAL_STATIC_LIBRARIES := libselinux

LOCAL_FORCE_STATIC_EXECUTABLE := true



include $(BUILD_HOST_EXECUTABLE)

tools/fs_config/fs_config.c

+75 −5
Original line number Diff line number Diff line
@@ -15,11 +15,16 @@ 
 */



#include <stdio.h>

#include <stdlib.h>

#include <sys/stat.h>

#include <errno.h>

#include <unistd.h>

#include <string.h>



#include <selinux/selinux.h>

#include <selinux/label.h>

#include <selinux/android.h>



#include "private/android_filesystem_config.h"



// This program takes a list of files and directories (indicated by a
@@ -37,11 +42,48 @@ 
//      system/etc/dbus.conf 1002 1002 440

//      data/app 1000 1000 771

//

//   or if -S is used:

//

//      system/etc/dbus.conf 1002 1002 440 u:object_r:system_file:s0

//      data/app 1000 1000 771 u:object_r:apk_data_file:s0

//

// Note that the output will omit the trailing slash from

// directories.



static struct selabel_handle* get_sehnd(const char* context_file) {

  struct selinux_opt seopts[] = { { SELABEL_OPT_PATH, context_file } };

  struct selabel_handle* sehnd = selabel_open(SELABEL_CTX_FILE, seopts, 1);



  if (!sehnd) {

    perror("error running selabel_open");

    exit(EXIT_FAILURE);

  }

  return sehnd;

}



static void usage() {

  fprintf(stderr, "Usage: fs_config [-S context_file]\n");

}



int main(int argc, char** argv) {

  char buffer[1024];

  const char* context_file = NULL;

  struct selabel_handle* sehnd = NULL;

  int opt;

  while((opt = getopt(argc, argv, "S:")) != -1) {

    switch(opt) {

    case 'S':

      context_file = optarg;

      break;

    default:

      usage();

      exit(EXIT_FAILURE);

    }

  }



  if (context_file != NULL) {

    sehnd = get_sehnd(context_file);

  }



  while (fgets(buffer, 1023, stdin) != NULL) {

    int is_dir = 0;
@@ -64,7 +106,35 @@ int main(int argc, char** argv) { 
    unsigned uid = 0, gid = 0, mode = 0;

    uint64_t capabilities;

    fs_config(buffer, is_dir, &uid, &gid, &mode, &capabilities);

    printf("%s %d %d %o\n", buffer, uid, gid, mode);

    printf("%s %d %d %o", buffer, uid, gid, mode);



    if (sehnd != NULL) {

      size_t buffer_strlen = strnlen(buffer, sizeof(buffer));

      if (buffer_strlen >= sizeof(buffer)) {

        fprintf(stderr, "non null terminated buffer, aborting\n");

        exit(EXIT_FAILURE);

      }

      size_t full_name_size = buffer_strlen + 2;

      char* full_name = (char*) malloc(full_name_size);

      if (full_name == NULL) {

        perror("malloc");

        exit(EXIT_FAILURE);

      }



      full_name[0] = '/';

      strncpy(full_name + 1, buffer, full_name_size - 1);

      full_name[full_name_size - 1] = '\0';



      char* secontext;

      if (selabel_lookup(sehnd, &secontext, full_name, ( mode | (is_dir ? S_IFDIR : S_IFREG)))) {

        secontext = strdup("u:object_r:unlabeled:s0");

      }



      printf(" %s", secontext);

      free(full_name);

      freecon(secontext);

    }

    printf("\n");

  }

  return 0;

}

tools/releasetools/edify_generator.py

+5 −5
Original line number Diff line number Diff line
@@ -217,14 +217,14 @@ class EdifyGenerator(object): 
      else:

        raise ValueError("don't know how to write \"%s\" partitions" % (p.fs_type,))



  def SetPermissions(self, fn, uid, gid, mode):

  def SetPermissions(self, fn, uid, gid, mode, secontext):

    """Set file ownership and permissions."""

    self.script.append('set_perm(%d, %d, 0%o, "%s");' % (uid, gid, mode, fn))

    self.script.append('set_perm2(%d, %d, 0%o, "%s", "%s");' % (uid, gid, mode, secontext, fn))



  def SetPermissionsRecursive(self, fn, uid, gid, dmode, fmode):

  def SetPermissionsRecursive(self, fn, uid, gid, dmode, fmode, secontext):

    """Recursively set path ownership and permissions."""

    self.script.append('set_perm_recursive(%d, %d, 0%o, 0%o, "%s");'

                       % (uid, gid, dmode, fmode, fn))

    self.script.append('set_perm2_recursive(%d, %d, 0%o, 0%o, "%s", "%s");'

                       % (uid, gid, dmode, fmode, secontext, fn))



  def MakeSymlinks(self, symlink_list):

    """Create symlinks, given a list of (dest, link) pairs."""

tools/releasetools/ota_from_target_files

+23 −19
Original line number Diff line number Diff line
@@ -117,6 +117,7 @@ class Item: 
    self.uid = None

    self.gid = None

    self.mode = None

    self.secontext = None

    self.dir = dir



    if name:
@@ -166,63 +167,66 @@ class Item: 


    for line in output.split("\n"):

      if not line: continue

      name, uid, gid, mode = line.split()

      name, uid, gid, mode, secontext = line.split()

      i = cls.ITEMS.get(name, None)

      if i is not None:

        i.uid = int(uid)

        i.gid = int(gid)

        i.mode = int(mode, 8)

        i.secontext = secontext

        if i.dir:

          i.children.sort(key=lambda i: i.name)



    # set metadata for the files generated by this script.

    i = cls.ITEMS.get("system/recovery-from-boot.p", None)

    if i: i.uid, i.gid, i.mode = 0, 0, 0644

    if i: i.uid, i.gid, i.mode, i.secontext = 0, 0, 0644, "u:object_r:system_file:s0"

    i = cls.ITEMS.get("system/etc/install-recovery.sh", None)

    if i: i.uid, i.gid, i.mode = 0, 0, 0544

    if i: i.uid, i.gid, i.mode, i.secontext = 0, 0, 0544, "u:object_r:system_file:s0"



  def CountChildMetadata(self):

    """Count up the (uid, gid, mode) tuples for all children and

    """Count up the (uid, gid, mode, secontext) tuples for all children and

    determine the best strategy for using set_perm_recursive and

    set_perm to correctly chown/chmod all the files to their desired

    values.  Recursively calls itself for all descendants.



    Returns a dict of {(uid, gid, dmode, fmode): count} counting up

    Returns a dict of {(uid, gid, dmode, fmode, secontext): count} counting up

    all descendants of this node.  (dmode or fmode may be None.)  Also

    sets the best_subtree of each directory Item to the (uid, gid,

    dmode, fmode) tuple that will match the most descendants of that

    dmode, fmode, secontext) tuple that will match the most descendants of that

    Item.

    """



    assert self.dir

    d = self.descendants = {(self.uid, self.gid, self.mode, None): 1}

    d = self.descendants = {(self.uid, self.gid, self.mode, None, self.secontext): 1}

    for i in self.children:

      if i.dir:

        for k, v in i.CountChildMetadata().iteritems():

          d[k] = d.get(k, 0) + v

      else:

        k = (i.uid, i.gid, None, i.mode)

        k = (i.uid, i.gid, None, i.mode, i.secontext)

        d[k] = d.get(k, 0) + 1



    # Find the (uid, gid, dmode, fmode) tuple that matches the most

    # Find the (uid, gid, dmode, fmode, secontext) tuple that matches the most

    # descendants.



    # First, find the (uid, gid) pair that matches the most

    # descendants.

    ug = {}

    for (uid, gid, _, _), count in d.iteritems():

    for (uid, gid, _, _, _), count in d.iteritems():

      ug[(uid, gid)] = ug.get((uid, gid), 0) + count

    ug = MostPopularKey(ug, (0, 0))



    # Now find the dmode and fmode that match the most descendants

    # Now find the dmode, fmode and secontext that match the most descendants

    # with that (uid, gid), and choose those.

    best_dmode = (0, 0755)

    best_fmode = (0, 0644)

    best_secontext = (0, "u:object_r:system_file:s0")

    for k, count in d.iteritems():

      if k[:2] != ug: continue

      if k[2] is not None and count >= best_dmode[0]: best_dmode = (count, k[2])

      if k[3] is not None and count >= best_fmode[0]: best_fmode = (count, k[3])

    self.best_subtree = ug + (best_dmode[1], best_fmode[1])

      if k[4] is not None and count >= best_secontext[0]: best_secontext = (count, k[4])

    self.best_subtree = ug + (best_dmode[1], best_fmode[1], best_secontext[1])



    return d
@@ -234,7 +238,7 @@ class Item: 
    self.CountChildMetadata()



    def recurse(item, current):

      # current is the (uid, gid, dmode, fmode) tuple that the current

      # current is the (uid, gid, dmode, fmode, secontext) tuple that the current

      # item (and all its children) have already been set to.  We only

      # need to issue set_perm/set_perm_recursive commands if we're

      # supposed to be something different.
@@ -244,17 +248,17 @@ class Item: 
          current = item.best_subtree



        if item.uid != current[0] or item.gid != current[1] or \

           item.mode != current[2]:

          script.SetPermissions("/"+item.name, item.uid, item.gid, item.mode)

           item.mode != current[2] or item.secontext != current[4]:

          script.SetPermissions("/"+item.name, item.uid, item.gid, item.mode, item.secontext)



        for i in item.children:

          recurse(i, current)

      else:

        if item.uid != current[0] or item.gid != current[1] or \

               item.mode != current[3]:

          script.SetPermissions("/"+item.name, item.uid, item.gid, item.mode)

               item.mode != current[3] or item.secontext != current[4]:

          script.SetPermissions("/"+item.name, item.uid, item.gid, item.mode, item.secontext)



    recurse(self, (-1, -1, -1, -1))

    recurse(self, (-1, -1, -1, -1, "u:object_r:unlabeled:s0"))





def CopySystemFiles(input_zip, output_zip=None,
@@ -733,7 +737,7 @@ def WriteIncrementalOTAPackage(target_zip, source_zip, output_zip): 
  for item in deferred_patch_list:

    fn, tf, sf, size, _ = item

    script.ApplyPatch("/"+fn, "-", tf.size, tf.sha1, sf.sha1, "patch/"+fn+".p")

  script.SetPermissions("/system/build.prop", 0, 0, 0644)

  script.SetPermissions("/system/build.prop", 0, 0, 0644, "u:object_r:system_file:s0")



  script.AddToZip(target_zip, output_zip)

  WriteMetadata(metadata, output_zip)