openkylin
/
platform_system_core
mirror of https://gitee.com/openkylin/platform_system_core.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

/postinstall/* does not search for a lib in /vendor or /odm 

There has been no section in the linker config file for the binaries
under /postinstall. As a result, the binaries were run with the legacy
default config where /vendor/lib and /odm/lib are added to the search
paths. This is causing selinux denials as the binaries for OTA are not
allowed to access /vendor/lib or /odm/lib, but the dynamic linker calls
realpath(3) on the paths to canonicalize them.

Fixing the issue by letting /postinstall/* binaries to run with a
dedicated linker namespace config, where /vendor/lib and /odm/lib are
not added to the search paths. Not having the paths is okay because
he OTA binaries should not have dependency to the libs there.

Bug: 75287236
Test: do the OTA, selinux denials on postinstall_file is not shown
Test: above test should pass on  wahoo, marlin and pre-treble devices
Change-Id: I49c11a0929002adfef667890c0a375c2b41054f4
This commit is contained in:
Jiyong Park 2018-03-20 01:12:31 +09:00
parent 4fa763290e
commit d7e6cb27b6
3 changed files with 43 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
rootdir/etc/ld.config.legacy.txt
View File

@ -10,6 +10,9 @@ dir.legacy = /vendor
dir.legacy = /odm
dir.legacy = /sbin
# Except for /postinstall, where only /system is searched
dir.postinstall = /postinstall
[legacy]
namespace.default.isolated = false
@ -23,3 +26,15 @@ namespace.default.asan.search.paths += /data/asan/odm/${LIB}
namespace.default.asan.search.paths += /odm/${LIB}
namespace.default.asan.search.paths += /data/asan/vendor/${LIB}
namespace.default.asan.search.paths += /vendor/${LIB}
###############################################################################
# Namespace config for binaries under /postinstall.
# Only one default namespace is defined and it has no directories other than
# /system/lib in the search paths. This is because linker calls realpath on the
# search paths and this causes selinux denial if the paths (/vendor, /odm) are
# not allowed to the poinstall binaries. There is no reason to allow the
# binaries to access the paths.
###############################################################################
[postinstall]
namespace.default.isolated = false
namespace.default.search.paths = /system/${LIB}

14
rootdir/etc/ld.config.txt
View File

@ -24,6 +24,8 @@ dir.system = /data/nativetest64
dir.system = /data/benchmarktest
dir.system = /data/benchmarktest64
dir.postinstall = /postinstall
[system]
additional.namespaces = sphal,vndk,rs
@ -315,3 +317,15 @@ namespace.system.search.paths = /system/${LIB}
namespace.system.asan.search.paths = /data/asan/system/${LIB}
namespace.system.asan.search.paths += /system/${LIB}
###############################################################################
# Namespace config for binaries under /postinstall.
# Only one default namespace is defined and it has no directories other than
# /system/lib in the search paths. This is because linker calls realpath on the
# search paths and this causes selinux denial if the paths (/vendor, /odm) are
# not allowed to the poinstall binaries. There is no reason to allow the
# binaries to access the paths.
###############################################################################
[postinstall]
namespace.default.isolated = false
namespace.default.search.paths = /system/${LIB}

14
rootdir/etc/ld.config.vndk_lite.txt
View File

@ -24,6 +24,8 @@ dir.system = /data/nativetest64
dir.system = /data/benchmarktest
dir.system = /data/benchmarktest64
dir.postinstall = /postinstall
[system]
additional.namespaces = sphal,vndk,rs
@ -222,3 +224,15 @@ namespace.default.asan.search.paths += /data/asan/system/${LIB}/vndk-sp%VNDK_VER
namespace.default.asan.search.paths += /system/${LIB}/vndk-sp%VNDK_VER%
namespace.default.asan.search.paths += /data/asan/system/${LIB}
namespace.default.asan.search.paths += /system/${LIB}
###############################################################################
# Namespace config for binaries under /postinstall.
# Only one default namespace is defined and it has no directories other than
# /system/lib in the search paths. This is because linker calls realpath on the
# search paths and this causes selinux denial if the paths (/vendor, /odm) are
# not allowed to the poinstall binaries. There is no reason to allow the
# binaries to access the paths.
###############################################################################
[postinstall]
namespace.default.isolated = false
namespace.default.search.paths = /system/${LIB}