diff options
| author | Nick Kralevich <nnk@google.com> | 2019-04-04 15:54:58 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2019-04-04 16:11:37 -0700 |
| commit | cb1dddad27b86e675f7141ca429e9bb8ab8ac410 (patch) | |
| tree | 333bc9b5792a95325c79b89110af2c275f9ff64c /rs/java/android/renderscript/ProgramFragmentFixedFunction.java | |
| parent | 37f662002956ba0cf7a86ccba543611e31a16b14 (diff) | |
Don't set sehash when calling restoreconRecursive
restorecon_recursive updates the SELinux label of the files in the
filesystem, and then attempts to write the xattr "security.sehash" as an
optimization for future restorecons. Writing security.* extended
attributes requires CAP_SYS_ADMIN, which system_server doesn't have (and
shouldn't have).
Suppress the computation and writing of the hash value. It's not
needed.
This bug has been around for a long time, but due to the fix for
bug 62302954, the error message is being generated more frequently
now.
TODO: It would be better if the default for restorecon was to suppress
the hash computation, since otherwise it encourages programs to be
overprivileged with CAP_SYS_ADMIN. I'll plan on doing that in a followup
commit.
Bugs where this error message has been called out:
Bug: 129766333
Bug: 129271240
Bug: 128700692
Bug: 129925723
Test: install an APK and ensure that no "SELinux: setxattr failed"
error messages are generated.
Change-Id: I83f4f225e4e73453daea42dbcabf0f8a06d320d6
Diffstat (limited to 'rs/java/android/renderscript/ProgramFragmentFixedFunction.java')
0 files changed, 0 insertions, 0 deletions