commit 45a462a11b92e959e7034c6a42265978f8273ad2
author Alex Klyubin <klyubin@google.com> Thu Mar 02 12:43:10 2017 -0800
committer Alex Klyubin <klyubin@google.com> Fri Mar 03 10:35:10 2017 -0800
tree ffdc1474f10660559534d8740a52e3f24a7e135d
parent 88b4b5e244615dcc984b072dd545f5844f5a2932

Track the move of split SELinux policy CIL files

The three CIL files comprising split sepolicy are being moved from the
root directory to system and vendor directories based on whether the
file is for platform/system policy or non-platform/vendor policy.

Test: Device boots, no additional SELinux denials. This test was run
      for a device which has split policy and for a device which has
      monolithic policy.
Bug: 31363362
Change-Id: Ica49f0beae56be0f1cea7117e48bf2f6af8b848b

init/init.cpp

diff --git a/init/init.cpp b/init/init.cpp
index 53e7482..28e6008 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -669,7 +669,7 @@
     }
 }
 
-static constexpr const char plat_policy_cil_file[] = "/plat_sepolicy.cil";
+static constexpr const char plat_policy_cil_file[] = "/system/etc/selinux/plat_sepolicy.cil";
 
 static bool selinux_is_split_policy_device() { return access(plat_policy_cil_file, R_OK) != -1; }
 
@@ -701,7 +701,8 @@
 
     const char* compile_args[] = {"/system/bin/secilc", plat_policy_cil_file, "-M", "true", "-c",
                                   "30",  // TODO: pass in SELinux policy version from build system
-                                  "/mapping_sepolicy.cil", "/nonplat_sepolicy.cil", "-o",
+                                  "/vendor/etc/selinux/mapping_sepolicy.cil",
+                                  "/vendor/etc/selinux/nonplat_sepolicy.cil", "-o",
                                   compiled_sepolicy,
                                   // We don't care about file_contexts output by the compiler
                                   "-f", "/sys/fs/selinux/null",  // /dev/null is not yet available