commit 4ba548d845c0306a46d7cc8cf483caac5756159c
author Jiyong Park <jiyong@google.com> Fri Feb 22 16:04:35 2019 +0900
committer Jiyong Park <jiyong@google.com> Mon Mar 04 16:22:41 2019 +0900
tree 21b36e029b81ad8918d89dd0cd15d3bb04ea3984
parent bc6372103ae969f70b8e6a293280145c8a467abc

mount /apex during first_stage init

/apex is not mounted via init.rc but directly by the first_stage init
before the mount namespaces are configured.

This allows us to change the propagation type for /apex mount point to
private to isolate APEX activatesions across post- and pre-apexd
processes.

Bug: 125549215
Test: m; device boots to the UI

Change-Id: I10e056cd30d64cb702b6c237acd8dab326162884

init/selinux.cpp

diff --git a/init/selinux.cpp b/init/selinux.cpp
index ee302c1..3fadfed 100644
--- a/init/selinux.cpp
+++ b/init/selinux.cpp
@@ -459,6 +459,8 @@
 
     selinux_android_restorecon("/dev/block", SELINUX_ANDROID_RESTORECON_RECURSE);
     selinux_android_restorecon("/dev/device-mapper", 0);
+
+    selinux_android_restorecon("/apex", 0);
 }
 
 int SelinuxKlogCallback(int type, const char* fmt, ...) {