Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fee250d2 authored by repo sync's avatar repo sync
Browse files

Reload policy after setting up the data partition. 

This forces a policy reload + fixcon to deal with dynamically
delivered policy changing labels on device nodes.

It's implemented as a new keyword in init.

Bug: 8702843
Change-Id: I803cf1ecf6ff8318ce25dcc5cda4f292adc9738c
parent 538b5d4e

init/builtins.c

+6 −0
Original line number Diff line number Diff line
@@ -515,6 +515,12 @@ int do_mount_all(int nargs, char **args) 
    return ret;

}



int do_selinux_reload(int nargs, char **args) {

    if (is_selinux_enabled() <= 0)

        return 0;

    return selinux_reload_policy();

}



int do_setcon(int nargs, char **args) {

    if (is_selinux_enabled() <= 0)

        return 0;

init/init_parser.c

+1 −0
Original line number Diff line number Diff line
@@ -138,6 +138,7 @@ int lookup_keyword(const char *s) 
        break;

    case 's':

        if (!strcmp(s, "eclabel")) return K_seclabel;

        if (!strcmp(s, "elinux_reload_policy")) return K_selinux_reload_policy;

        if (!strcmp(s, "ervice")) return K_service;

        if (!strcmp(s, "etcon")) return K_setcon;

        if (!strcmp(s, "etenforce")) return K_setenforce;

init/keywords.h

+2 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ int do_restart(int nargs, char **args); 
int do_restorecon(int nargs, char **args);

int do_rm(int nargs, char **args);

int do_rmdir(int nargs, char **args);

int do_selinux_reload(int nargs, char **args);

int do_setcon(int nargs, char **args);

int do_setenforce(int nargs, char **args);

int do_setkey(int nargs, char **args);
@@ -71,6 +72,7 @@ enum { 
    KEYWORD(rm,          COMMAND, 1, do_rm)

    KEYWORD(rmdir,       COMMAND, 1, do_rmdir)

    KEYWORD(seclabel,    OPTION,  0, 0)

    KEYWORD(selinux_reload_policy,    COMMAND, 0, do_selinux_reload)

    KEYWORD(service,     SECTION, 0, 0)

    KEYWORD(setcon,      COMMAND, 1, do_setcon)

    KEYWORD(setenforce,  COMMAND, 1, do_setenforce)

init/property_service.c

+0 −3
Original line number Diff line number Diff line
@@ -384,9 +384,6 @@ int property_set(const char *name, const char *value) 
         * to prevent them from being overwritten by default values.

         */

        write_persistent_property(name, value);

    } else if (strcmp("selinux.reload_policy", name) == 0 &&

               strcmp("1", value) == 0) {

        selinux_reload_policy();

    }

    property_changed(name, value);

    return 0;

rootdir/init.rc

+4 −0
Original line number Diff line number Diff line
@@ -177,6 +177,9 @@ on post-fs 
    mkdir /cache/lost+found 0770 root root



on post-fs-data

    # reload SELinux based on what we find on the data partition

    selinux_reload_policy



    # We chown/chmod /data again so because mount is run as root + defaults

    chown system system /data

    chmod 0771 /data
@@ -410,6 +413,7 @@ service ueventd /sbin/ueventd 
    seclabel u:r:ueventd:s0



on property:selinux.reload_policy=1

    selinux_reload_policy

    restart ueventd

    restart installd