commit 356b339b0dd98d410a5866530f38fe36c4b19a20
author Treehugger Robot <treehugger-gerrit@google.com> Sat Dec 17 00:17:12 2016 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Sat Dec 17 00:17:13 2016 +0000
tree 76afaf07f4df522a1fce42c44455983f328d6f89
parent 94dd4b74100aedc4d04a46c6853bfa866679e2f5
parent 2fae5d65d503a9487438a107caa01265c61d23c5

Merge "Compile sepolicy on-device at early boot."

init/Android.mk

diff --git a/init/Android.mk b/init/Android.mk
index ecdf5db..4999e58 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -95,6 +95,7 @@
     libext4_utils_static \
     libbase \
     libc \
+    libsepol \
     libselinux \
     liblog \
     libcrypto_utils \

init/init.cpp

diff --git a/init/init.cpp b/init/init.cpp
index 2d474c7..5bf8069 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -36,6 +36,8 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
+#include <cil/android.h>
+#include <cil/cil.h>
 #include <selinux/selinux.h>
 #include <selinux/label.h>
 #include <selinux/android.h>
@@ -517,6 +519,13 @@
     return 0;
 }
 
+/* policy is a combination of platform, non-platform and mapping policy files */
+static constexpr const char* pol_files[]  = {
+    "/plat_sepolicy.cil",
+    "/mapping_sepolicy.cil",
+    "/nonplat_sepolicy.cil"  // TODO, switch to different partition when final.
+};
+
 static void selinux_initialize(bool in_kernel_domain) {
     Timer t;
 
@@ -525,13 +534,24 @@
     selinux_set_callback(SELINUX_CB_LOG, cb);
     cb.func_audit = audit_callback;
     selinux_set_callback(SELINUX_CB_AUDIT, cb);
+    cil_set_log_handler((void (*)(int, char*))selinux_klog_callback);
 
     if (in_kernel_domain) {
+        void* pol_data = NULL;
+        size_t pol_len = 0;
+
+        LOG(INFO) << "Compiling SELinux policy...";
+        if (cil_android_compile_policy(&pol_data, &pol_len, pol_files,
+                arraysize(pol_files)) < 0) {
+            LOG(ERROR) << "failed to compile policy";
+            security_failure();
+        }
         LOG(INFO) << "Loading SELinux policy...";
-        if (selinux_android_load_policy() < 0) {
+        if (selinux_android_load_policy(pol_data, pol_len) < 0) {
             PLOG(ERROR) << "failed to load policy";
             security_failure();
         }
+        free(pol_data);
 
         bool kernel_enforcing = (security_getenforce() == 1);
         bool is_enforcing = selinux_is_enforcing();