SELinux denials after migrating application data between devices

Question

I'm trying to migrate application data between devices. The application was installed to the work profile using Shelter The steps I did were:

1. On source phone, tar cvf appdata.tar.gz /data/user/10/com.appname
2. Copy the tarball from the source phone to the target phone
3. On the target phone, install the applications to the work profile. Note the username of the /data/user/10/com.appname on the target phone, which is of the form u10_aXXX
4. On the target phone, chown -R u10_aXXX:u10_aXXX /data/user/10/com.appname

When I'm trying to use the app, it receives a lot of SELinux AVC denials and ends up crashing because it's unable to open /data/user/10/com.appname/databases/database.db:

10-18 16:23:28.485  4120  4120 W SharedPreferenc: type=1400 audit(0.0:889): avc: denied { search } for name="shared_prefs" dev="dm-0" ino=860652 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:app_data_file:s0 tclass=dir permissive=0

What am I missing? Application works after setting SELinux to permissive.

Answer 1

On newer Android versions the process mentioned in the question and comment is not sufficient. In my experience on LineageOS 20 (that is Android 13), the following changes were needed:

1. The cache and code_cache directories must be owned by uX_aYYY_cache
2. restorecon requires the -D parameter to touch files in /data/data

So the full process would be as follows:

1. Unpack the files to /data/somewhere/com.appname. somewhere depends on the system profile, the default is simply /data/data
2. chown -R uX_aYYY:uX_aYYY com.appname
3. chown -R uX_aYYY:uX_aYYY_cache com.appname/cache
4. chown -R uX_aYYY:uX_aYYY_cache com.appname/code_cache
5. restorecon -DR com.appname