Ensure vendor seapp contexts can't use coredomain
Bug: 280547417
Test: build
Change-Id: Iadff17523767f91f073c6569400e17f1da55fbdc
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index 2416dc9..644a2dd 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -434,12 +434,16 @@
Text("|| true)") // to make ninja happy even when result is empty
rule.Temporary(neverallowFile)
- rule.Command().BuiltTool("checkseapp").
+ checkCmd := rule.Command().BuiltTool("checkseapp").
FlagWithInput("-p ", android.PathForModuleSrc(ctx, proptools.String(m.seappProperties.Sepolicy))).
FlagWithOutput("-o ", ret).
Inputs(inputs).
Input(neverallowFile)
+ if ctx.SocSpecific() || ctx.DeviceSpecific() {
+ checkCmd.Flag("-c") // check coredomain
+ }
+
rule.Build("seapp_contexts", "Building seapp_contexts: "+m.Name())
return ret
}