Revert "Add /system_ext/etc/selinux/ to the debug policy search ..."
Revert "Add a copy of debug policy to GSI system image"
Revert "Add PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT"
Revert "Add system_ext_userdebug_plat_sepolicy.cil for GSI"
Revert submission 1824717-gsi_debug_policy
Reason for revert: Breaks the build (see b/200933187).
Reverted Changes:
I37ef02628:Add a copy of debug policy to GSI system image
I9c3dad8bb:Add PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT
I43adc6ada:Add system_ext_userdebug_plat_sepolicy.cil for GSI...
I4d6235c73:Add /system_ext/etc/selinux/ to the debug policy s...
Change-Id: I2eb3b00abb981c25514b75b2e7b4b7b203653390
diff --git a/init/selinux.cpp b/init/selinux.cpp
index 29c0ff3..42d3023 100644
--- a/init/selinux.cpp
+++ b/init/selinux.cpp
@@ -295,25 +295,6 @@
return access(plat_policy_cil_file, R_OK) != -1;
}
-std::optional<const char*> GetUserdebugPlatformPolicyFile() {
- // See if we need to load userdebug_plat_sepolicy.cil instead of plat_sepolicy.cil.
- const char* force_debuggable_env = getenv("INIT_FORCE_DEBUGGABLE");
- if (force_debuggable_env && "true"s == force_debuggable_env && AvbHandle::IsDeviceUnlocked()) {
- const std::vector<const char*> debug_policy_candidates = {
-#if INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT == 1
- "/system_ext/etc/selinux/userdebug_plat_sepolicy.cil",
-#endif
- kDebugRamdiskSEPolicy,
- };
- for (const char* debug_policy : debug_policy_candidates) {
- if (access(debug_policy, F_OK) == 0) {
- return debug_policy;
- }
- }
- }
- return std::nullopt;
-}
-
struct PolicyFile {
unique_fd fd;
std::string path;
@@ -329,10 +310,13 @@
// secilc is invoked to compile the above three policy files into a single monolithic policy
// file. This file is then loaded into the kernel.
- const auto userdebug_plat_sepolicy = GetUserdebugPlatformPolicyFile();
- const bool use_userdebug_policy = userdebug_plat_sepolicy.has_value();
+ // See if we need to load userdebug_plat_sepolicy.cil instead of plat_sepolicy.cil.
+ const char* force_debuggable_env = getenv("INIT_FORCE_DEBUGGABLE");
+ bool use_userdebug_policy =
+ ((force_debuggable_env && "true"s == force_debuggable_env) &&
+ AvbHandle::IsDeviceUnlocked() && access(kDebugRamdiskSEPolicy, F_OK) == 0);
if (use_userdebug_policy) {
- LOG(INFO) << "Using userdebug system sepolicy " << *userdebug_plat_sepolicy;
+ LOG(WARNING) << "Using userdebug system sepolicy";
}
// Load precompiled policy from vendor image, if a matching policy is found there. The policy
@@ -429,7 +413,7 @@
// clang-format off
std::vector<const char*> compile_args {
"/system/bin/secilc",
- use_userdebug_policy ? *userdebug_plat_sepolicy : plat_policy_cil_file,
+ use_userdebug_policy ? kDebugRamdiskSEPolicy: plat_policy_cil_file,
"-m", "-M", "true", "-G", "-N",
"-c", version_as_string.c_str(),
plat_mapping_file.c_str(),