Mount encrypted storage with dedicated context
mount crypt device with dedidated fscontext/context. This is required to
restrict the payload from executing something from the directory.
Another use is restricting relabeling from this fscontext.
Bug: 261477008
Test: atest MicrodroidTests#encryptedStorageAvailable
Change-Id: I69445fc16306f7c97b8d4241db34ef92c16e456a
diff --git a/encryptedstore/src/main.rs b/encryptedstore/src/main.rs
index 9c8311d..7140ae2 100644
--- a/encryptedstore/src/main.rs
+++ b/encryptedstore/src/main.rs
@@ -137,7 +137,10 @@
fn mount(source: &Path, mountpoint: &Path) -> Result<()> {
create_dir_all(mountpoint).context(format!("Failed to create {:?}", &mountpoint))?;
- let mount_options = CString::new("").unwrap();
+ let mount_options = CString::new(
+ "fscontext=u:object_r:encryptedstore_fs:s0,context=u:object_r:encryptedstore_file:s0",
+ )
+ .unwrap();
let source = CString::new(source.as_os_str().as_bytes())?;
let mountpoint = CString::new(mountpoint.as_os_str().as_bytes())?;
let fstype = CString::new("ext4").unwrap();