Change priv-apps /home/home labels to privapp_data_file
Currently, both untrusted apps and priv-apps use the SELinux file label "app_data_file" for files in their /data/data directory. This is problematic, as we really want different rules for such files. For example, we may want to allow untrusted apps to load executable code from priv-app directories, but disallow untrusted apps from loading executable code from their own home directories. Commit 23c9d91b introduced a new type called privapp_data_file and added rules necessary to preserve compatibility. However, that change did not relabel any existing files, so effectively the change was a no-op. This change performs the switch, relabeling priv-app's /data/data files from app_data_file to privapp_data_file. Due to the compatibility rules added in 23c9d91b, there should be no noticeable effect from this change. Test: Factory reset and boot - no problems on fresh install. Test: Upgrade to new version and test. No compatibility problems on filesystem upgrade. Merged-In: I9a476726bf01f4bcc7952d11fd57dba803a9fd8d Change-Id: I23a26cd3906fc43cbd225c05c3a2abd3cab8bd06
Loading
Please register or sign in to comment