Skip to content

Commit 487e835

Browse files
committed
Properly set SELinux context after reboot
After reboot, the SELinux context labels for files located in `/data/adb` are reset to `u:object_r:adb_data_file:s0`. To fully address the issue in ed1f61d, we should always compare the SELinux context and reset it when necessary.
1 parent b270bd5 commit 487e835

2 files changed

Lines changed: 32 additions & 9 deletions

File tree

daemon/src/main/java/org/lsposed/lspd/service/ConfigFileManager.java

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@
7070
import java.util.HashSet;
7171
import java.util.List;
7272
import java.util.Locale;
73+
import java.util.stream.Stream;
7374
import java.util.zip.Deflater;
7475
import java.util.zip.ZipEntry;
7576
import java.util.zip.ZipFile;
@@ -454,20 +455,38 @@ static void ensureModuleFilePath(String path) throws RemoteException {
454455

455456
static Path resolveModuleDir(String packageName, String dir, int userId, int uid) throws IOException {
456457
var path = modulePath.resolve(String.valueOf(userId)).resolve(packageName).resolve(dir).normalize();
457-
if (uid != -1) {
458-
if (path.toFile().mkdirs()) {
459-
try {
460-
SELinux.setFileContext(path.toString(), "u:object_r:xposed_data:s0");
461-
Os.chown(path.toString(), uid, uid);
462-
Os.chmod(path.toString(), 0755);
463-
} catch (ErrnoException e) {
464-
throw new IOException(e);
465-
}
458+
// Ensure the directory and any necessary parent directories exist.
459+
path.toFile().mkdirs();
460+
461+
if (SELinux.getFileContext(path.toString()) != "u:object_r:xposed_data:s0") {
462+
// SELinux label could be reset after a reboot.
463+
try {
464+
setSelinuxContextRecursive(path, "u:object_r:xposed_data:s0");
465+
Os.chown(path.toString(), uid, uid);
466+
Os.chmod(path.toString(), 0755);
467+
} catch (ErrnoException e) {
468+
throw new IOException(e);
466469
}
467470
}
468471
return path;
469472
}
470473

474+
private static void setSelinuxContextRecursive(Path path, String context) throws IOException {
475+
try {
476+
SELinux.setFileContext(path.toString(), context);
477+
478+
if (Files.isDirectory(path)) {
479+
try (Stream<Path> stream = Files.list(path)) {
480+
for (Path entry : (Iterable<Path>) stream::iterator) {
481+
setSelinuxContextRecursive(entry, context);
482+
}
483+
}
484+
}
485+
} catch (Exception e) {
486+
throw new IOException("Failed to recursively set SELinux context for " + path, e);
487+
}
488+
}
489+
471490
private static class FileLocker {
472491
private final FileChannel lockChannel;
473492
private final FileLock locker;

hiddenapi/stubs/src/main/java/android/os/SELinux.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ public static boolean setFileContext(String path, String context) {
99
throw new UnsupportedOperationException("Stub");
1010
}
1111

12+
public static String getFileContext(String path) {
13+
throw new UnsupportedOperationException("Stub");
14+
}
15+
1216
public static boolean setFSCreateContext(String context){
1317
throw new UnsupportedOperationException("Stub");
1418
}

0 commit comments

Comments
 (0)