commit 54a420013492504ee277d4ebf850724923a031b3
author Sandeep Patil <sspatil@google.com> Fri Mar 24 10:22:14 2017 -0700
committer Sandeep Patil <sspatil@google.com> Wed Mar 29 10:10:32 2017 -0700
tree aaa56265d061e0b9ed6067322f9c1c54670e42dc
parent 4a478c47f464f0f49f8802b3f49d03744450ac15

prop_context: correctly label all property_context files

split property context file in vendor and sytem were left untouched by
the recent changes. This was working accidentally because they were
still accessible to all domains as 'system_file'.

Bug: 36002573
Test: Boot sailfish to observe no new denials.
Test: 'adb sideload' OTA on sailfish successfully

Change-Id: I5bec058b59db83d2a431e9f7e91c5a09af7d2942
Signed-off-by: Sandeep Patil <sspatil@google.com>

private/file_contexts

diff --git a/private/file_contexts b/private/file_contexts
index 1db5210..5c0bc67 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -44,8 +44,8 @@
 /mapping_sepolicy\.cil   u:object_r:rootfs:s0
 /nonplat_sepolicy\.cil   u:object_r:rootfs:s0
 /plat_sepolicy\.cil      u:object_r:rootfs:s0
-/plat_property_contexts  u:object_r:property_contexts:s0
-/nonplat_property_contexts  u:object_r:property_contexts:s0
+/plat_property_contexts  u:object_r:property_contexts_file:s0
+/nonplat_property_contexts  u:object_r:property_contexts_file:s0
 /seapp_contexts     u:object_r:rootfs:s0
 /nonplat_seapp_contexts     u:object_r:rootfs:s0
 /plat_seapp_contexts     u:object_r:rootfs:s0
@@ -249,11 +249,13 @@
 /system/bin/virtual_touchpad     u:object_r:virtual_touchpad_exec:s0
 /system/bin/vr_wm                u:object_r:vr_wm_exec:s0
 /system/bin/hw/android\.hidl\.allocator@1\.0-service          u:object_r:hal_allocator_default_exec:s0
+/system/etc/selinux/plat_property_contexts  u:object_r:property_contexts_file:s0
 
 #############################
 # Vendor files
 #
 /vendor(/.*)?		u:object_r:system_file:s0
+/vendor/etc/selinux/nonplat_property_contexts   u:object_r:property_contexts_file:s0
 
 #############################
 # OEM and ODM files

public/domain.te

diff --git a/public/domain.te b/public/domain.te
index 3ed451a..2febffb 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -89,7 +89,7 @@
 # messages to logd.
 get_prop(domain, log_property_type)
 dontaudit domain property_type:file audit_access;
-allow domain property_contexts:file r_file_perms;
+allow domain property_contexts_file:file r_file_perms;
 
 allow domain init:key search;
 allow domain vold:key search;

public/file.te

diff --git a/public/file.te b/public/file.te
index 21d5744..1ef7a35 100644
--- a/public/file.te
+++ b/public/file.te
@@ -257,7 +257,7 @@
 type gps_control, file_type;
 
 # property_contexts file
-type property_contexts, file_type;
+type property_contexts_file, file_type;
 
 # Allow files to be created in their appropriate filesystems.
 allow fs_type self:filesystem associate;