Repository navigation
Relabel otp/ before the Android run-as ERTS probe (MOB-478) - #138
Merged
Merged
Conversation
After an APK reinstall on a rooted emulator the app runs under new SELinux MCS categories, but the otp/ tree mix mob.deploy --native pushed as root kept the previous install's. The run-as ERTS probe couldn't read it and the deploy failed with "OTP runtime missing on device" before its only relabel, which ran last. Relabel before the probe too; the final relabel after every write stays.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes MOB-478.
mix mob.deploy --native --androidfailed on a rooted (userdebug) emulator after the app was reinstalled: "OTP runtime missing on device". The reinstalled app runs under new SELinux MCS categories, but theotp/tree--nativepushed as root (afteradb uninstall, so these are fresh files) came out with the previous install's (observed:otp/s0:c210,...,otp/erts-17.0s0:c209,...). Therun-asERTS probe couldn't read it, and the deploy stopped beforerelabel_otp_android/1, which ran only last.deploy_android/3now relabelsotp/before the probe too. The final relabel after every write stays. Without root thechconfails silently, as before.Test:
test/mob_dev/deployer_android_relabel_test.exsrunsDeployer.deploy_all/1against a fakeadbon PATH that hides ERTS from the probe until achconhas run. It asserts the deploy succeeds, a relabel runs before the probe, and the last adb call is the final relabel. It fails with the early relabel removed (the "OTP runtime missing" error).Device (Scene3d_arm, android-35 google_apis arm64, userdebug, throwaway
mix mob.new --blank --localapp): deploy--native,adb uninstall, deploy--nativeagain.✗ OTP runtime missing on device emulator-5620;run-as ... ls otp/erts-*/bin/erl_child_setup→ No such file (cachec210, erts-17.0c209).✓ Deployed to 1 device(s), erts-17.0 relabelled to the app'sc211, BEAM started (Mob.Dist: distribution started). No manual chcon.Gates:
mix test3065 passed (11 excluded); format,credo --strictclean,compile --warnings-as-errors, erlfmt.mix mob.security_scan --strict: 4 HIGH bundled-tarball drift findings for ios_device/ios_sim (Elixir, exqlite beam), from the local OTP cache vspriv/security/bundled_versions.exs; this PR touches neither.Review: reviewer subagent (Codex rate-limited until 6:25 PM): SHIP, two test nitpicks fixed, re-review SHIP; pre-merge: MERGE (CHANGELOG wording fixed after it).