Mount the new system as 'postinstall_file' in postinstall.
When mounting the new filesystem on /postinstall, we need to override
the file attributes from the new system (unknown to the current selinux
policies) with a consistent label that will be used only in the context
of postinstall. This patch passes an extra option to mount(2) in
Brillo and Android to achieve this.
Bug: 27177071
TEST=Deployed a postinstall script with `ls -laZ`, contents show "postinstall_file".
Change-Id: Ia43b45c92e4c4cd340a884818ac00f24a418f9e7
diff --git a/common/platform_constants_android.cc b/common/platform_constants_android.cc
index 4f55106..371fe26 100644
--- a/common/platform_constants_android.cc
+++ b/common/platform_constants_android.cc
@@ -31,6 +31,8 @@
// No deadline file API support on Android.
const char kOmahaResponseDeadlineFile[] = "";
const char kNonVolatileDirectory[] = "/data/misc/update_engine";
+const char kPostinstallMountOptions[] =
+ "context=u:object_r:postinstall_file:s0";
} // namespace constants
} // namespace chromeos_update_engine