Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 731d2473 authored by Yi-Yo Chiang's avatar Yi-Yo Chiang
Browse files

Load *_compat_cil_file from system_ext as well 

So we can extend platform policies with target specific compat rules.
This use case surface in the context of system only upgrade, when the
vendor policy cannot be updated, then the system_ext partition can
contain target specific compat policies.

Bug: 183362912
Test: Presubmit
Change-Id: Ic6436eb8a269f07f932331dedf7dbaa629538ade
parent 12744bd2

init/selinux.cpp

+9 −0
Original line number Diff line number Diff line
@@ -372,6 +372,12 @@ bool OpenSplitPolicy(PolicyFile* policy_file) { 
        system_ext_mapping_file.clear();

    }



    std::string system_ext_compat_cil_file("/system_ext/etc/selinux/mapping/" + vend_plat_vers +

                                           ".compat.cil");

    if (access(system_ext_compat_cil_file.c_str(), F_OK) == -1) {

        system_ext_compat_cil_file.clear();

    }



    std::string product_policy_cil_file("/product/etc/selinux/product_sepolicy.cil");

    if (access(product_policy_cil_file.c_str(), F_OK) == -1) {

        product_policy_cil_file.clear();
@@ -426,6 +432,9 @@ bool OpenSplitPolicy(PolicyFile* policy_file) { 
    if (!system_ext_mapping_file.empty()) {

        compile_args.push_back(system_ext_mapping_file.c_str());

    }

    if (!system_ext_compat_cil_file.empty()) {

        compile_args.push_back(system_ext_compat_cil_file.c_str());

    }

    if (!product_policy_cil_file.empty()) {

        compile_args.push_back(product_policy_cil_file.c_str());

    }