Reload policy after setting up the data partition.

This forces a policy reload + fixcon to deal with dynamically
delivered policy changing labels on device nodes.

It's implemented as a new keyword in init.

Bug: 8702843
Change-Id: I803cf1ecf6ff8318ce25dcc5cda4f292adc9738c

init/builtins.c

@@ -515,6 +515,12 @@ int do_mount_all(int nargs, char **args)
     return ret;
 }
 
+int do_selinux_reload(int nargs, char **args) {
+    if (is_selinux_enabled() <= 0)
+        return 0;
+    return selinux_reload_policy();
+}
+
 int do_setcon(int nargs, char **args) {
     if (is_selinux_enabled() <= 0)
         return 0;

init/init_parser.c

@@ -138,6 +138,7 @@ int lookup_keyword(const char *s)
         break;
     case 's':
         if (!strcmp(s, "eclabel")) return K_seclabel;
+        if (!strcmp(s, "elinux_reload_policy")) return K_selinux_reload_policy;
         if (!strcmp(s, "ervice")) return K_service;
         if (!strcmp(s, "etcon")) return K_setcon;
         if (!strcmp(s, "etenforce")) return K_setenforce;

init/keywords.h

@@ -18,6 +18,7 @@ int do_restart(int nargs, char **args);
 int do_restorecon(int nargs, char **args);
 int do_rm(int nargs, char **args);
 int do_rmdir(int nargs, char **args);
+int do_selinux_reload(int nargs, char **args);
 int do_setcon(int nargs, char **args);
 int do_setenforce(int nargs, char **args);
 int do_setkey(int nargs, char **args);
@@ -71,6 +72,7 @@ enum {
     KEYWORD(rm,          COMMAND, 1, do_rm)
     KEYWORD(rmdir,       COMMAND, 1, do_rmdir)
     KEYWORD(seclabel,    OPTION,  0, 0)
+    KEYWORD(selinux_reload_policy,    COMMAND, 0, do_selinux_reload)
     KEYWORD(service,     SECTION, 0, 0)
     KEYWORD(setcon,      COMMAND, 1, do_setcon)
     KEYWORD(setenforce,  COMMAND, 1, do_setenforce)

init/property_service.c

@@ -384,9 +384,6 @@ int property_set(const char *name, const char *value)
          * to prevent them from being overwritten by default values.
          */
         write_persistent_property(name, value);
-    } else if (strcmp("selinux.reload_policy", name) == 0 &&
-               strcmp("1", value) == 0) {
-        selinux_reload_policy();
     }
     property_changed(name, value);
     return 0;

rootdir/init.rc

@@ -177,6 +177,9 @@ on post-fs
     mkdir /cache/lost+found 0770 root root
 
 on post-fs-data
+    # reload SELinux based on what we find on the data partition
+    selinux_reload_policy
+
     # We chown/chmod /data again so because mount is run as root + defaults
     chown system system /data
     chmod 0771 /data
@@ -410,6 +413,7 @@ service ueventd /sbin/ueventd
     seclabel u:r:ueventd:s0
 
 on property:selinux.reload_policy=1
+    selinux_reload_policy
     restart ueventd
     restart installd