Add -m to setfiles for v2.7 to ignore /proc/mounts
Newer version of policyutils checks /proc/mounts to see if current
filesystem has seclabel flag before labeling files.
Chrome OS build bot won't mount system images with seclabel flag
since SELinux is not enabled on the build bot and developers'
workstation.
-m is necessary otherwise setfiles won't label any files.
BUG=b:116072767
TEST=build_images
CQ-DEPEND=CL:762729
Change-Id: I7d22cab4b4ec34bbd27f2eb41aa4d25dde6d2d65
Reviewed-on: https://chromium-review.googlesource.com/1235754
Commit-Ready: Kenny Root <kroot@google.com>
Tested-by: Kenny Root <kroot@google.com>
Reviewed-by: Kenny Root <kroot@google.com>
diff --git a/build_library/selinux_util.sh b/build_library/selinux_util.sh
index eefb73b..1201914 100644
--- a/build_library/selinux_util.sh
+++ b/build_library/selinux_util.sh
@@ -18,6 +18,6 @@
err_msg+="but an SELinux context file not found at ${file_contexts}."
die_notrace "${err_msg}"
fi
- sudo /sbin/setfiles -r "${rootfs}" "${file_contexts}" "${rootfs}"
+ sudo /sbin/setfiles -m -r "${rootfs}" "${file_contexts}" "${rootfs}"
fi
}
