commit 714b99d9da5641483be0f801a6e1b565c0167772
author Eric Biggers <ebiggers@google.com> Thu Jun 08 21:33:49 2023 +0000
committer Eric Biggers <ebiggers@google.com> Thu Jun 08 22:16:25 2023 +0000
tree dd33285b2b63eb5216eb57d297a7acbcf629344b
parent 39f11368a501306ff537f4ec97ad84da2fc59381

Remove write permission from file mode of top-level user dirs

https://r.android.com/2620458 is removing the write mode bit from the
top-level user directories on internal storage, in order to make the DAC
consistent with the SELinux policy.

This commit makes the corresponding change to adoptable storage.

Bug: 285239971
Test: sm set-virtual-disk true; sm partition disk:7,392 private
Change-Id: I17dfbe10909b34c2046a4d5b4ffd7764d5ae083b

model/PrivateVolume.cpp

diff --git a/model/PrivateVolume.cpp b/model/PrivateVolume.cpp
index a692ea9..55b8d0b 100644
--- a/model/PrivateVolume.cpp
+++ b/model/PrivateVolume.cpp
@@ -171,11 +171,11 @@
 
     // Verify that common directories are ready to roll
     if (PrepareDir(mPath + "/app", 0771, AID_SYSTEM, AID_SYSTEM) ||
-        PrepareDir(mPath + "/user", 0711, AID_SYSTEM, AID_SYSTEM) ||
-        PrepareDir(mPath + "/user_de", 0711, AID_SYSTEM, AID_SYSTEM) ||
-        PrepareDir(mPath + "/misc_ce", 0711, AID_SYSTEM, AID_SYSTEM) ||
-        PrepareDir(mPath + "/misc_de", 0711, AID_SYSTEM, AID_SYSTEM) ||
-        PrepareDir(mPath + "/media", 0770, AID_MEDIA_RW, AID_MEDIA_RW, attrs) ||
+        PrepareDir(mPath + "/user", 0511, AID_SYSTEM, AID_SYSTEM) ||
+        PrepareDir(mPath + "/user_de", 0511, AID_SYSTEM, AID_SYSTEM) ||
+        PrepareDir(mPath + "/misc_ce", 0511, AID_SYSTEM, AID_SYSTEM) ||
+        PrepareDir(mPath + "/misc_de", 0511, AID_SYSTEM, AID_SYSTEM) ||
+        PrepareDir(mPath + "/media", 0550, AID_MEDIA_RW, AID_MEDIA_RW, attrs) ||
         PrepareDir(mPath + "/media/0", 0770, AID_MEDIA_RW, AID_MEDIA_RW) ||
         PrepareDir(mPath + "/local", 0751, AID_ROOT, AID_ROOT) ||
         PrepareDir(mPath + "/local/tmp", 0771, AID_SHELL, AID_SHELL)) {