Use NULL instead of 0 as terminator to array

Change-Id: I034fb304145529791f275db568cd8ce29748a9fd
am 8ed42427: Use NULL instead of 0 as terminator to array

* commit '8ed42427deec178494a1de79dae6f9cae43dd005':
  Use NULL instead of 0 as terminator to array
seapp_contexts support for prefix matching on name

A package name specifed in seapp_contexts ending with a * will
perform a prefix match.

Ex)
name=com.test*

Will match:
com.test.me
com.test.foo.bar

Change-Id: I0dfb4584579945a7c444b40bb732d2d530dddb3a
am e3615f9d: seapp_contexts support for prefix matching on name

* commit 'e3615f9d90e9b37c84b00d1830121fb21e6981f7':
  seapp_contexts support for prefix matching on name
Merge tag 'android-4.4_r1' into cm-11.0

Android 4.4 Release 1.0
Clean up some (void *) assignments.

Do casting when using the result of a malloc / realloc. This allows
this code to be compiled using c++, if needed.

Change-Id: I4f38b6747216548effb8b4edad77ee54de386a81
am 5b91e629: Clean up some (void *) assignments.

* commit '5b91e6297719ee29fc4d3795a4bc9d7343b30fb0':
  Clean up some (void *) assignments.
Clean up more c++ errors

Modify android.c so it compiles under C++.

Change-Id: I6770a46ee1ccfd6e08fb4c92de94a4adc3084fcc
Merge commit 'f1fdbaf056cc644e1e551870dc9b2846f8a388b0' into HEAD
Remove dead code

This code isn't being used.

Change-Id: I8113e16717dfbaa42913ee8e3c7fc7d2c9b36660
Use a fixed string for the level rather than the caller's range.

Otherwise we can get an unexpected result if the caller is already
running with categories set.

Change-Id: I9146a202b3175a75aecd0b38939b44cec63a67f2
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge commit 'aaccaa4db629cb4f4dc0fd01a93c8f348a5a57da' into HEAD
Fix a bug in the userspace AVC that broke per-domain permissive mode.

Failure to copy the entire av_decision structure, including the
flags field, would prevent preservation of the SELINUX_AVD_FLAGS_PERMISSIVE
flag and thus cause per-domain permissive to not be honored for userspace
permission checks.

Also ensure that we clear the entire structure.

Change-Id: I92fcb2522d05094a9583b0035bbe1f94cb289ecd
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Remove unused structure and code.

Seems to have been leftover from some prior work on policy update support.

Change-Id: Id5c5772a370a5a79de8f910decf938106a9c0718
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Move restorecon and restorecon_recursive code to libselinux.

This requires telling libselinux to use the sehandle already
obtained by init rather than re-acquiring it internally.  init
retains ownership of the sehandle because it performs the
initial load, uses the sehandle for other purposes (e.g. labeling
of directories created via mkdir and labeling of socket files),
and handles the policy reload property trigger.

Unify the restorecon code previously duplicated between init and libselinux.

Change-Id: I4a380caab7f8481c33eb64fcdb16b6cabe918ebd
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Only apply restorecon_recursive when file_contexts changes.

For any persistent directory (e.g. /data, /persist), we only want
to apply restorecon_recursive when there is a change to the
file_contexts mapping on an update.  Avoid repeatedly walking the
directory tree on each boot by setting a security.restorecon_last
xattr on each directory during a restorecon_recursive tree walk
to a hash of the file_contexts file and skipping the traversal if
the xattr is already set and matches the hash of the current file_contexts
file.

For /sys, the attempt to get and set the xattr will fail but this
is harmless.

Change-Id: I77bf2a0c4c34b1feef6fdf4d6c3bd92dbf32f4a1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Do not log the file_contexts digest/hash value.

Change-Id: I3ce2e803b53b99a9442b123f41b0966857da66b6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Fix return value of selinux_android_restorecon.

Change I4a380caab7f8481c33eb64fcdb16b6cabe918ebd unified
the init and libselinux restorecon code but introduced a bug
by changing the return value of selinux_android_restorecon
on errors from -1 (as in libselinux) to -errno (as in the init
built-in command).  Change it back as there are various callers
assuming the libselinux behavior and init does not actually rely
on the -errno behavior in the utils code and handles it correctly
in the built-in command functions themselves.

Change-Id: I6ed5b644820eb07c061d8a2a116511aeb7401df4
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Unify toolbox restorecon and libselinux restorecon implementations.

Extend the libselinux restorecon implementation to allow reuse
by the toolbox restorecon command.  This simply requires adding
support for the nochange (-n) and verbose (-v) options to the
libselinux functions and rewriting the toolbox restorecon command
to use the libselinux functions.  Also add a force (-F) option to
support forcing a restorecon_recursive even if the restorecon_last
attribute matches the current file_contexts hash so that we can
continue to force a restorecon via the toolbox command for testing
or when we know something else has changed (e.g. for when we support
relabeling /data/data and package information has changed).

Change-Id: I92bb3259790a7195ba56a5e9555c3b6c76ceb862
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Extend restorecon to handle app data directories correctly.

App data directories are labeled by installd at creation time
based on package information, seapp_contexts, and file_contexts.
Prior to this change, restorecon and restorecon_recursive did not
know how to label app data directories and would merely label
them based on file_contexts, causing them to be (mis)labeled with
a single security context if restorecon was applied to /data/data/<pkgname>
or /data/user/N/<pkgname>.  Extend restorecon to correctly handle app data
directories based on all of the relevant information.

After applying this change and its dependencies (including rewriting
toolbox restorecon to use libselinux), a restorecon -Rv /data/data
only relabels the lib symlinks in the app data directories, which I
believe is harmless and arguably is a bug in installd.  Originally
when the lib subdirectories were created in each app data directory
we labeled them with system_data_file to distinguish them from
app data, prevent direct writes by apps, and allow execute by apps.
However, when the lib directories were moved under /data/app-lib and only the
symlink was left behind, it continued to be labeled system_data_file
as a side effect of the fact that it is created before installd
calls selinux_android_setfilecon2() on the package directory and
thus inherits the original parent directory security context.  Offhand,
I don't see a real reason to not just label the symlinks with the app data
directory context even though the symlinks do have a different UID (install)
since the containing directory is owned by the app UID so apps
can already unlink and re-create the symlink at will.  So I think this
change by restorecon is harmless and we could switch installd to
applying the setfilecon2 first before creating the symlinks so that
they are originally labeled this way.

Change-Id: I698b1b2c3f00f31fbb2015edf23d33b51aa5bba1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>