Update OTA to understand SELinux labels and capabilities
Update the OTA generation script to understand SELinux file
labels and file capabilities.
Make fs_config aware of SELinux labels and file capabilities, and
optionally output those elements whenever we output the
UID / GID / file perms. The information is emitted as a key=value pair
to allow for future extensibility.
Pass the SELinux file label and capabilities to the newly created
set_metadata() and set_metadata_recursive() calls. When the OTA
script fixes up filesystem permissions, it will also fix up the SELinux
labels and file capabilities.
If no SELinux label and capabilities are available for the file, use
the old set_perm and set_perm_recursive calls.
Bug: 8985290
Bug: 10183961
Bug: 10186213
Change-Id: I4fcfb2c234dbfb965cee9e62f060092a4274d22d
diff --git a/tools/releasetools/edify_generator.py b/tools/releasetools/edify_generator.py
index 9ef1926..2c3b9e7 100644
--- a/tools/releasetools/edify_generator.py
+++ b/tools/releasetools/edify_generator.py
@@ -217,14 +217,33 @@
else:
raise ValueError("don't know how to write \"%s\" partitions" % (p.fs_type,))
- def SetPermissions(self, fn, uid, gid, mode):
+ def SetPermissions(self, fn, uid, gid, mode, selabel, capabilities):
"""Set file ownership and permissions."""
- self.script.append('set_perm(%d, %d, 0%o, "%s");' % (uid, gid, mode, fn))
+ if not self.info.get("use_set_metadata", False):
+ self.script.append('set_perm(%d, %d, 0%o, "%s");' % (uid, gid, mode, fn))
+ else:
+ if capabilities is None: capabilities = "0x0"
+ cmd = 'set_metadata("%s", "uid", %d, "gid", %d, "mode", 0%o, ' \
+ '"capabilities", %s' % (fn, uid, gid, mode, capabilities)
+ if selabel is not None:
+ cmd += ', "selabel", "%s"' % ( selabel )
+ cmd += ');'
+ self.script.append(cmd)
- def SetPermissionsRecursive(self, fn, uid, gid, dmode, fmode):
+ def SetPermissionsRecursive(self, fn, uid, gid, dmode, fmode, selabel, capabilities):
"""Recursively set path ownership and permissions."""
- self.script.append('set_perm_recursive(%d, %d, 0%o, 0%o, "%s");'
- % (uid, gid, dmode, fmode, fn))
+ if not self.info.get("use_set_metadata", False):
+ self.script.append('set_perm_recursive(%d, %d, 0%o, 0%o, "%s");'
+ % (uid, gid, dmode, fmode, fn))
+ else:
+ if capabilities is None: capabilities = "0x0"
+ cmd = 'set_metadata_recursive("%s", "uid", %d, "gid", %d, ' \
+ '"dmode", 0%o, "fmode", 0%o, "capabilities", %s' \
+ % (fn, uid, gid, dmode, fmode, capabilities)
+ if selabel is not None:
+ cmd += ', "selabel", "%s"' % ( selabel )
+ cmd += ');'
+ self.script.append(cmd)
def MakeSymlinks(self, symlink_list):
"""Create symlinks, given a list of (dest, link) pairs."""