Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11f214d8 authored by Bo Hu's avatar Bo Hu
Browse files

Revert "Add odm sepolicy support to SELinuxMMAC.java" 

This reverts commit fffa6d23.

Reason for revert: broke mac build

b/70273082

FAILED: out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_sepolicy.cil
/bin/bash -c "(out/host/darwin-x86/bin/version_policy -b out/target/product/generic_x86/obj/FAKE/selinux_policy_intermediates/plat_pub_policy.cil -t out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_policy_raw.cil -n 10000.0 -o out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_sepolicy.cil.tmp ) && (grep -Fxv -f out/target/product/generic_x86/obj/ETC/plat_pub_versioned.cil_intermediates/plat_pub_versioned.cil out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_sepolicy.cil.tmp > out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_sepolicy.cil ) && (out/host/darwin-x86/bin/secilc -m -M true -G -N -c 30 		out/target/product/generic_x86/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil out/target/product/generic_x86/obj/ETC/plat_pub_versioned.cil_intermediates/plat_pub_versioned.cil out/target/product/generic_x86/obj/ETC/10000.0.cil_intermediates/10000.0.cil out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_sepolicy.cil -o /dev/null -f /dev/null )"
Parsing out/target/product/generic_x86/obj/FAKE/selinux_policy_intermediates/plat_pub_policy.cil
Parsing out/target/product/generic_x86/obj/ETC/vendor_sepolicy.cil_intermediates/vendor_policy_raw.cil
grep: out of memory

Change-Id: I186f7bc68a76d7b2d717875791ee2fe1828c3598
parent d18ed49f

services/core/java/com/android/server/pm/SELinuxMMAC.java

+13 −43
Original line number Diff line number Diff line
@@ -60,8 +60,10 @@ public final class SELinuxMMAC { 
    // to synchronize access during policy load and access attempts.

    private static List<Policy> sPolicies = new ArrayList<>();



    // Required MAC permissions files.

    private static List<File> sMacPermissions = new ArrayList<>();

    /** Path to MAC permissions on system image */

    private static final File[] MAC_PERMISSIONS =

    { new File(Environment.getRootDirectory(), "/etc/selinux/plat_mac_permissions.xml"),

      new File(Environment.getVendorDirectory(), "/etc/selinux/nonplat_mac_permissions.xml") };



    // Append privapp to existing seinfo label

    private static final String PRIVILEGED_APP_STR = ":privapp";
@@ -74,11 +76,11 @@ public final class SELinuxMMAC { 


    /**

     * Load the mac_permissions.xml file containing all seinfo assignments used to

     * label apps. The loaded mac_permissions.xml files are plat_mac_permissions.xml and

     * vendor_mac_permissions.xml, on /system and /vendor partitions, respectively.

     * odm_mac_permissions.xml on /odm partition is optional. For further guidance on

     * label apps. The loaded mac_permissions.xml file is determined by the

     * MAC_PERMISSIONS class variable which is set at class load time which itself

     * is based on the USE_OVERRIDE_POLICY class variable. For further guidance on

     * the proper structure of a mac_permissions.xml file consult the source code

     * located at system/sepolicy/private/mac_permissions.xml.

     * located at system/sepolicy/mac_permissions.xml.

     *

     * @return boolean indicating if policy was correctly loaded. A value of false

     *         typically indicates a structural problem with the xml or incorrectly
@@ -91,42 +93,10 @@ public final class SELinuxMMAC { 


        FileReader policyFile = null;

        XmlPullParser parser = Xml.newPullParser();



        synchronized (sMacPermissions) {

            // Only initialize it once.

            if (sMacPermissions.isEmpty()) {

                // Platform mac permissions.

                sMacPermissions.add(new File(

                    Environment.getRootDirectory(), "/etc/selinux/plat_mac_permissions.xml"));



                // Vendor mac permissions.

                // The filename has been renamed from nonplat_mac_permissions to

                // vendor_mac_permissions. Either of them should exist.

                File vendorMacPermission = new File(

                    Environment.getVendorDirectory(), "/etc/selinux/vendor_mac_permissions.xml");

                if (vendorMacPermission.exists()) {

                    sMacPermissions.add(vendorMacPermission);

                } else {

                    // For backward compatibility.

                    sMacPermissions.add(new File(Environment.getVendorDirectory(),

                                                 "/etc/selinux/nonplat_mac_permissions.xml"));

                }



                // ODM mac permissions (optional).

                File odmMacPermission = new File(

                    Environment.getOdmDirectory(), "/etc/selinux/odm_mac_permissions.xml");

                if (odmMacPermission.exists()) {

                    sMacPermissions.add(odmMacPermission);

                }

            }

        }



        final int count = sMacPermissions.size();

        for (int i = 0; i < count; ++i) {

            File macPermission = sMacPermissions.get(i);

        for (int i = 0; i < MAC_PERMISSIONS.length; i++) {

            try {

                policyFile = new FileReader(macPermission);

                Slog.d(TAG, "Using policy file " + macPermission);

                policyFile = new FileReader(MAC_PERMISSIONS[i]);

                Slog.d(TAG, "Using policy file " + MAC_PERMISSIONS[i]);



                parser.setInput(policyFile);

                parser.nextTag();
@@ -150,13 +120,13 @@ public final class SELinuxMMAC { 
                StringBuilder sb = new StringBuilder("Exception @");

                sb.append(parser.getPositionDescription());

                sb.append(" while parsing ");

                sb.append(macPermission);

                sb.append(MAC_PERMISSIONS[i]);

                sb.append(":");

                sb.append(ex);

                Slog.w(TAG, sb.toString());

                return false;

            } catch (IOException ioe) {

                Slog.w(TAG, "Exception parsing " + macPermission, ioe);

                Slog.w(TAG, "Exception parsing " + MAC_PERMISSIONS[i], ioe);

                return false;

            } finally {

                IoUtils.closeQuietly(policyFile);