[OnePlus 3 & 3T Cross Device Development] :
changing encyption passphrase

[MENTION=5091734]dianlujitao[/MENTION]:

Back in february changing the encryption passphrase on ext4 data was working. Now it's broken. I think that's exactly what's called a "regression".

If you look at this (rejected) regression https://jira.lineageos.org/browse/REGRESSION-1882 it clearly states it is broken, but it was working on build 0223. But it is rejected.

This one https://jira.lineageos.org/browse/BUGBASH-1587 (exactly the same topic and thensame reporter) may be an regression (we all know it is, but no working build is given) or not, but it's not rejected...

May be they mixed that up.

Anyway: do you know if anybody is feeling responsible to work on that?

Intried to shine some light on this:

Since I don't think some of your oneplus3 device tree commits has broken encryption, the error should be found elsewhere outside the device tree. But if so, why is only 3/t effected (telling from jira searches).

I tried to fix it, but this seems to be behind my abilities. What I found is this: Every time I try to change the encryption passphrase, I see these denials in my log:

05-03 12:35:47.183 9654 9654 W secdiscard: type=1400 audit(0.0:7): avc: denied { open } for path="/data/system_de/0/spblob/7aad7bccc7beef4a.spblob" dev="dm-0" ino=3188651 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0
05-03 12:35:47.183 9654 9654 W secdiscard: type=1400 audit(0.0:8): avc: denied { unlink } for name="7aad7bccc7beef4a.spblob" dev="dm-0" ino=3188651 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0
05-03 12:35:47.210 9657 9657 W secdiscard: type=1400 audit(0.0:9): avc: denied { open } for path="/data/system_de/0/spblob/7aad7bccc7beef4a.secdis" dev="dm-0" ino=3188649 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0
05-03 12:35:47.210 9657 9657 W secdiscard: type=1400 audit(0.0:10): avc: denied { unlink } for name="7aad7bccc7beef4a.secdis" dev="dm-0" ino=3188649 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0
05-03 12:35:47.230 9660 9660 W secdiscard: type=1400 audit(0.0:11): avc: denied { open } for path="/data/system_de/0/spblob/7aad7bccc7beef4a.pwd" dev="dm-0" ino=3188650 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0
05-03 12:35:47.230 9660 9660 W secdiscard: type=1400 audit(0.0:12): avc: denied { unlink } for name="7aad7bccc7beef4a.pwd" dev="dm-0" ino=3188650 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0

But if I try to add

allow vold system_data_file:file { open unlink };

to vold.te (inside the device tree), I get:

neverallow check failed at /mnt/export/data/src/los15/out/target/product/oneplus3/obj/ETC/nonplat_sepolicy.cil_intermediates/nonplat_sepolicy.cil:4130
(neverallow base_typeattr_50_27_0 system_data_file_27_0 (file (write create setattr relabelfrom append unlink link rename)))
<root>
allow at /mnt/export/data/src/los15/out/target/product/oneplus3/obj/ETC/nonplat_sepolicy.cil_intermediates/nonplat_sepolicy.cil:13637
(allow vold_27_0 system_data_file_27_0 (file (unlink open)))

neverallow check failed at /mnt/export/data/src/los15/out/target/product/oneplus3/obj/ETC/plat_sepolicy.cil_intermediates/plat_sepolicy.cil:4674 from system/sepolicy/public/domain.te:872
(neverallow base_typeattr_50 system_data_file (file (write create setattr relabelfrom append unlink link rename)))
<root>
allow at /mnt/export/data/src/los15/out/target/product/oneplus3/obj/ETC/nonplat_sepolicy.cil_intermediates/nonplat_sepolicy.cil:13637
(allow vold_27_0 system_data_file_27_0 (file (unlink open)))

If I set the device to peemissive I still get

05-04 12:03:49.200 13273 13273 E secdiscard: Unable to BLKSECDISCARD /data/system_de/0/spblob/938b90d45bc825e6.pwd: Operation not supported on transport endpoint

So sepolicy seems to be only a part of the issue.

Hope this helps a little bit.