Ensure labeling of /data/data and /data/user
On an upgrade, the *contents* of the /data/data and /data/user
directories are not labeled by init, because their labels are
managed by installd.
However, the /data/data and /data/user directories themselves are
never labeled, neither by init nor installd.
On an upgrade from an Android 4.2 system, it's possible for these
two directories to remain unlabeled, causing anything created
within these directories to also be unlabeled.
Make sure we label /data/data and /data/user (but not their contents)
from init's restorecon_recursive.
Change-Id: I65dcfa8e77a63cb61551a1010358f0e45956dbbf
diff --git a/src/android.c b/src/android.c
index a15c9ab..18c5da9 100644
--- a/src/android.c
+++ b/src/android.c
@@ -1172,16 +1172,17 @@
fts_set(fts, ftsent, FTS_SKIP);
continue;
case FTS_D:
- if (!datadata &&
- (!strcmp(ftsent->fts_path, DATA_DATA_PATH) ||
- !strcmp(ftsent->fts_path, DATA_USER_PATH))) {
- fts_set(fts, ftsent, FTS_SKIP);
- continue;
- }
if (issys && !selabel_partial_match(sehandle, ftsent->fts_path)) {
fts_set(fts, ftsent, FTS_SKIP);
continue;
}
+ if (!datadata &&
+ (!strcmp(ftsent->fts_path, DATA_DATA_PATH) ||
+ !strcmp(ftsent->fts_path, DATA_USER_PATH))) {
+ // Don't label anything below this directory.
+ fts_set(fts, ftsent, FTS_SKIP);
+ // but fall through and make sure we label the directory itself
+ }
/* fall through */
default:
(void) restorecon_sb(ftsent->fts_path, ftsent->fts_statp, true, nochange, verbose, seinfo, uid);