commit 939d16b59f08c083c026899550d0128dfe49072a
author Sandeep Patil <sspatil@google.com> Fri Mar 24 12:24:43 2017 -0700
committer Sandeep Patil <sspatil@google.com> Wed Mar 29 10:13:34 2017 -0700
tree fb8020f1521963af0d8198cccefd1c8093f42875
parent 54a420013492504ee277d4ebf850724923a031b3

service_contexts: label service_contexts explicitly

The label applies to all service_contexts regardless of their location.
This also lets us track the service_contexts usage and limit access to
the files for the corresponding object manager alone.

Bug: 36002427
Test: Boot sailfish and observe no denials for 'serice_contexts'
Test: cts-tradefed run singleCommand cts --skip-device-info \
          --skip-preconditions --skip-connectivity-check \
          --abi arm64-v8a --module CtsSecurityHostTestCases \
          -t android.security.cts.SELinuxHostTest#testAospServiceContexts

Change-Id: I97fc8b24bc99ca5c00d010fb522cd39a35572858
Signed-off-by: Sandeep Patil <sspatil@google.com>

private/file_contexts

diff --git a/private/file_contexts b/private/file_contexts
index 5c0bc67..90df77c 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -50,8 +50,8 @@
 /nonplat_seapp_contexts     u:object_r:rootfs:s0
 /plat_seapp_contexts     u:object_r:rootfs:s0
 /sepolicy           u:object_r:rootfs:s0
-/plat_service_contexts   u:object_r:rootfs:s0
-/nonplat_service_contexts   u:object_r:rootfs:s0
+/plat_service_contexts   u:object_r:service_contexts_file:s0
+/nonplat_service_contexts   u:object_r:service_contexts_file:s0
 
 ##########################
 # Devices
@@ -250,12 +250,14 @@
 /system/bin/vr_wm                u:object_r:vr_wm_exec:s0
 /system/bin/hw/android\.hidl\.allocator@1\.0-service          u:object_r:hal_allocator_default_exec:s0
 /system/etc/selinux/plat_property_contexts  u:object_r:property_contexts_file:s0
+/system/etc/selinux/plat_service_contexts  u:object_r:service_contexts_file:s0
 
 #############################
 # Vendor files
 #
 /vendor(/.*)?		u:object_r:system_file:s0
 /vendor/etc/selinux/nonplat_property_contexts   u:object_r:property_contexts_file:s0
+/vendor/etc/selinux/nonplat_service_contexts    u:object_r:service_contexts_file:s0
 
 #############################
 # OEM and ODM files