a13246a7fc
The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
42 lines
1.2 KiB
Plaintext
42 lines
1.2 KiB
Plaintext
type vendor_toolbox, domain;
|
|
|
|
init_daemon_domain(vendor_toolbox)
|
|
|
|
# Allow vendor_toolbox to use sys_admin capability
|
|
allow vendor_toolbox self:capability sys_admin;
|
|
|
|
# Allow vendor_toolbox to execute /vendor/bin/toybox_vendor
|
|
allow vendor_toolbox vendor_toolbox_exec:file execute_no_trans;
|
|
|
|
# Allow vendor_toolbox to read directories in rootfs
|
|
allow vendor_toolbox rootfs:dir r_dir_perms;
|
|
|
|
# Allow vendor_toolbox to remove "security.*" xattrs from /mnt/vendor/persist
|
|
allow vendor_toolbox {
|
|
mnt_vendor_file
|
|
persist_block_device
|
|
unlabeled
|
|
vendor_persist_alarm_file
|
|
vendor_persist_audio_file
|
|
vendor_persist_bluetooth_file
|
|
vendor_persist_camera_file
|
|
vendor_persist_data_file
|
|
vendor_persist_display_file
|
|
vendor_persist_drm_file
|
|
vendor_persist_elabel_file
|
|
vendor_persist_feature_enabler_file
|
|
vendor_persist_file
|
|
vendor_persist_haptics_file
|
|
vendor_persist_hvdcp_file
|
|
vendor_persist_iar_db_file
|
|
vendor_persist_mmi_file
|
|
vendor_persist_qti_fp_file
|
|
vendor_persist_rfs_file
|
|
vendor_persist_rfs_shared_hlos_file
|
|
vendor_persist_secnvm_file
|
|
vendor_persist_sensors_file
|
|
vendor_persist_time_file
|
|
vendor_persist_vpp_file
|
|
vendor_persist_wcnss_service_file
|
|
}:dir { r_dir_perms setattr };
|