Only restorecon CE storage after unlocked.
On FBE devices, the filenames inside credential-encrypted directories
are mangled until the key is installed. This means the initial
restorecon at boot needs to skip these directories until the keys
are installed.
This CL uses an existing facility to request that init run a
recursive restorecon over a given path, and it requests that
operation for the CE directories that would have been omitted by
the SKIPCE flag earlier during boot.
Bug: 30126557
Change-Id: I8c7abea27215075a091f615a7185a82a2f4a4a95
diff --git a/PrivateVolume.cpp b/PrivateVolume.cpp
index 21746b2..e5809fb 100644
--- a/PrivateVolume.cpp
+++ b/PrivateVolume.cpp
@@ -137,23 +137,7 @@
return -EIO;
}
- LOG(VERBOSE) << "Starting restorecon of " << mPath;
-
- // TODO: find a cleaner way of waiting for restorecon to finish
- property_set("selinux.restorecon_recursive", "");
- property_set("selinux.restorecon_recursive", mPath.c_str());
-
- char value[PROPERTY_VALUE_MAX];
- while (true) {
- property_get("selinux.restorecon_recursive", value, "");
- if (strcmp(mPath.c_str(), value) == 0) {
- break;
- }
- sleep(1);
- LOG(VERBOSE) << "Waiting for restorecon...";
- }
-
- LOG(VERBOSE) << "Finished restorecon of " << mPath;
+ RestoreconRecursive(mPath);
// Verify that common directories are ready to roll
if (PrepareDir(mPath + "/app", 0771, AID_SYSTEM, AID_SYSTEM) ||