commit 3dc88adfb91778eb43fc508b37a36837d6349120
author Joel Galenson <jgalenson@google.com> Wed Feb 05 14:58:27 2020 -0800
committer android-build-team Robot <android-build-team-robot@google.com> Thu Feb 06 05:31:35 2020 +0000
tree a822c7f2557c5340e378f89e8e26f750d63b166a
parent 46612e64f99342cbdcc3dd5646a995880bbc2feb

Allow init to set the encryption policy on unlabeled directories.

This fixes a bug where a directory's label was removed, causing it to
be unlabeled, and we crashed on trying to set its encryption policy.

Fixes: 148923156
Test: Successfully update from build with the deleted label.
Change-Id: I69c3707e3e66d9e44a22b0783d3016c8ddab6b8f
(cherry picked from commit 5e175476f21adae5b0a14604198ca69d71ae68cf)

public/init.te

diff --git a/public/init.te b/public/init.te
index cc60b5a..19c7e4b 100644
--- a/public/init.te
+++ b/public/init.te
@@ -546,7 +546,7 @@
 allow init unencrypted_data_file:dir create_dir_perms;
 
 # Set encryption policy on dirs in /data
-allowxperm init data_file_type:dir ioctl {
+allowxperm init { data_file_type unlabeled }:dir ioctl {
   FS_IOC_GET_ENCRYPTION_POLICY
   FS_IOC_SET_ENCRYPTION_POLICY
 };