Relabel /data/rollback files as enabling rollback (4/n)
We will link files under /data/apex/active and /data/app to
/data/rollback when enabling rollbacks to avoid copy.
When creating hard links, we have to enusre source and target have the
same label to avoid subtle bugs.
We will assign apk_data_file to *.apk files and
staging_data_file to *.apex files under /data/rollback.
Also allow system_server to link /data/apex/active files.
Bug: 168562373
Test: m
Change-Id: I4be38cc8c84494c4ddfa03e37f2af3958bff5dfb
diff --git a/private/file_contexts b/private/file_contexts
index 633a6ce..62ac7ad 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -543,6 +543,10 @@
/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
/data/server_configurable_flags(/.*)? u:object_r:server_configurable_flags_data_file:s0
/data/app-staging(/.*)? u:object_r:staging_data_file:s0
+# Ensure we have the same labels as /data/app or /data/apex/active
+# to avoid restorecon conflicts
+/data/rollback/\d+/[^/]+/.*\.apk u:object_r:apk_data_file:s0
+/data/rollback/\d+/[^/]+/.*\.apex u:object_r:staging_data_file:s0
# Misc data
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
diff --git a/private/system_server.te b/private/system_server.te
index 90061c6..b60740b 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -519,6 +519,9 @@
allow system_server staging_data_file:dir create_dir_perms;
allow system_server staging_data_file:file create_file_perms;
+# Manage /data/rollback.
+allow system_server staging_data_file:{ file lnk_file } { create_file_perms link };
+
# Walk /data/data subdirectories.
allow system_server app_data_file_type:dir { getattr read search };