Check for SELinux labelling errors
It's essential that files created by vold get the correct SELinux
labels, so make sure to check for errors when setting them.
ENOENT (no label defined) is expected on some files such as
/mnt/appfuse/*, so allow ENOENT but log a DEBUG message.
This will help debug b/269567270. This is not a fix for b/269567270.
Bug: 269567270
Test: Created user and checked SELinux labels of user's directories
Test: atest CtsBlobStoreHostTestCases
Change-Id: Ife005bdd896952653943c57336deb33456f7c5d8
diff --git a/vold_prepare_subdirs.cpp b/vold_prepare_subdirs.cpp
index 6ad3c6f..60e82f5 100644
--- a/vold_prepare_subdirs.cpp
+++ b/vold_prepare_subdirs.cpp
@@ -58,32 +58,32 @@
const std::string& path, uid_t user_id) {
auto clearfscreatecon = android::base::make_scope_guard([] { setfscreatecon(nullptr); });
auto secontext = std::unique_ptr<char, void (*)(char*)>(nullptr, freecon);
- if (sehandle) {
- char* tmp_secontext;
+ char* tmp_secontext;
- if (selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) == 0) {
- secontext.reset(tmp_secontext);
-
- if (user_id != (uid_t)-1) {
- if (selinux_android_context_with_level(secontext.get(), &tmp_secontext, user_id,
- (uid_t)-1) != 0) {
- PLOG(ERROR) << "Unable to create context with level for: " << path;
- return false;
- }
- secontext.reset(tmp_secontext); // Free the context
+ if (selabel_lookup(sehandle, &tmp_secontext, path.c_str(), S_IFDIR) == 0) {
+ secontext.reset(tmp_secontext);
+ if (user_id != (uid_t)-1) {
+ if (selinux_android_context_with_level(secontext.get(), &tmp_secontext, user_id,
+ (uid_t)-1) != 0) {
+ PLOG(ERROR) << "Unable to create context with level for: " << path;
+ return false;
}
+ secontext.reset(tmp_secontext);
}
+ if (setfscreatecon(secontext.get()) != 0) {
+ LOG(ERROR) << "Failed to setfscreatecon for directory " << path;
+ return false;
+ }
+ } else if (errno == ENOENT) {
+ LOG(DEBUG) << "No selabel defined for directory " << path;
+ } else {
+ PLOG(ERROR) << "Failed to look up selabel for directory " << path;
+ return false;
}
LOG(DEBUG) << "Setting up mode " << std::oct << mode << std::dec << " uid " << uid << " gid "
<< gid << " context " << (secontext ? secontext.get() : "null")
<< " on path: " << path;
- if (secontext) {
- if (setfscreatecon(secontext.get()) != 0) {
- PLOG(ERROR) << "Unable to setfscreatecon for: " << path;
- return false;
- }
- }
if (fs_prepare_dir(path.c_str(), mode, uid, gid) != 0) {
return false;
}
@@ -168,6 +168,10 @@
static bool prepare_subdirs(const std::string& volume_uuid, int user_id, int flags) {
struct selabel_handle* sehandle = selinux_android_file_context_handle();
+ if (!sehandle) {
+ LOG(ERROR) << "Failed to get SELinux file contexts handle";
+ return false;
+ }
if (flags & android::os::IVold::STORAGE_FLAG_DE) {
auto user_de_path = android::vold::BuildDataUserDePath(volume_uuid, user_id);