ac571ee966
The restorecon_recursive directive in init is only applied if the file_contexts file changed between builds, but not necessarily if any file or folder inside /mnt/vendor/persist/ has changed. The restorecon code checks whether an xattr named "security.sehash" contains a string that matches the current combined hashes of the SELinux context files and skips restoring labels if there is a match, see https://android.googlesource.com/platform/external/selinux/+/refs/tags/android-9.0.0_r35/libselinux/src/android/android_platform.c#1546 Force wiping that xattr so that restorecon always runs since it's not very expensive (there are currently only about 50 files on /persist). The restorecon is needed to fix issues such as wrong stock labels on /mnt/vendor/persist/sensors/: sensors_persist_file -> persist_sensors_file Change-Id: Ic0cd848836ee550499d9236f56ed6e939e35f01e
29 lines
1.1 KiB
Text
29 lines
1.1 KiB
Text
#============= vendor_init ==============
|
|
typeattribute vendor_init data_between_core_and_vendor_violators;
|
|
|
|
allow vendor_init {
|
|
media_rw_data_file
|
|
system_data_file
|
|
tombstone_data_file
|
|
camera_data_file
|
|
}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };
|
|
|
|
allow vendor_init unlabeled:{ dir file } { getattr relabelfrom };
|
|
|
|
set_prop(vendor_init, camera_prop)
|
|
allow vendor_init media_rw_data_file:file { getattr relabelfrom };
|
|
|
|
allow vendor_init rootfs:dir { add_name create setattr write };
|
|
allow vendor_init persist_debug_prop:property_service set;
|
|
allow vendor_init persist_dpm_prop:property_service set;
|
|
allow vendor_init qcom_ims_prop:property_service set;
|
|
allow vendor_init thermal_engine_prop:property_service set;
|
|
allow vendor_init vendor_ssr_prop:property_service set;
|
|
allow vendor_init audio_prop:property_service set;
|
|
allow vendor_init vendor_fp_prop:property_service set;
|
|
|
|
allow vendor_init rootfs:dir { add_name write };
|
|
allow vendor_init rootfs:lnk_file setattr;
|
|
allow vendor_init fingerprint_data_file:dir setattr;
|
|
set_prop(vendor_init, camera_prop)
|
|
set_prop(vendor_init, vendor_camera_prop)
|