magisk, selinux, symlinks and stuff...

[DocMAX]

I have setup an interesting scenario. I use Syncthing (with root privileges) to sync /data/data/com.termux/files across 4 phones. While 2 of my phones run SElinux in permissive mode 2 are in enforcing mode. Now i have noticed that if Syncthing syncs a symlink (and probably normal files), the symlinks can't be accessed by the termux user (u0_xxx). They have the correct owner, not root. I checked the symlinks with ls -Z and these have missing selinux contexts. Now how can i overcome this issue? I think Magisk has tools to fix (supolicy?) this but i don't know exactly how. Anyone? Thx.

[agnostic-apollo]

Termux ls will show ? instead of context. Use /system/bin/ls.

After sync, to restore ownership and context, check #2080 (comment)

[agnostic-apollo]

Also check with stat on symlink file if target is correct after syncing.

[DocMAX]

this is how it looks like now. libXRes.so is the problematic file.
is there a way to automatically write with the right context without fixing manually?

u0_a380@jelly2 ~/.../usr/lib $ sudo /system/bin/ls -Z libX11.so
u:object_r:app_data_file:s0:c124,c257,c512,c768 libX11.so
u0_a380@jelly2 ~/.../usr/lib $ sudo /system/bin/ls -Z libXRes.so
u:object_r:app_data_file:s0 libXRes.so
u0_a380@jelly2 ~/.../usr/lib $ sudo stat libXRes.so
  File: libXRes.so -> libXRes.so.1.0.0
  Size: 18        	Blocks: 8          IO Block: 4096   symbolic link
Device: 259,25	Inode: 4759811     Links: 1
Access: (0777/lrwxrwxrwx)  Uid: (10380/ u0_a380)   Gid: (10380/ u0_a380)
Access: 2024-01-12 11:18:08.973852818 +0100
Modify: 2024-01-12 11:18:08.973852818 +0100
Change: 2024-01-12 18:47:32.897854425 +0100
 Birth: -

[agnostic-apollo]

u:object_r:app_data_file:s0 libXRes.so

MCS is missing.

https://github.com/agnostic-apollo/Android-Docs/blob/master/site/pages/en/projects/docs/os/selinux/security-context.md#categories

Report such issues to syncthing, not an issue with termux.

rsync over ssh with root seems to work fine for me.

[DocMAX]

It happens everytime root (magisksu) is writing into termux's data folder. not a termux or syncthing issue. also happens with rsync if you use --rsync-path="sudo rsync" so that rsync writes as root on the remote side. so my question was if magisk can do something about it? else i have to run syncthing in termux itself. thats the closest fix i can think of right now.
Edit: And also use rsync's --chown switch with target user id.

[DocMAX]

OK sorry, seems like Syncthing has a switch to sync special permissions, too. Will have a look.