title: Changing SELinux Context of a file on Android not working properly
body: <p>Currently I am trying to figure out what SELinux is capable of doing on Android and I ran into this problem. Basically I want to see if I can prohibit the access to a .jpeg file with the album app. I could obtain both, the context of the image and the context of the album app process. Via reflection I was able to invoke the setFileContext(String path, String context) method from android.os.SELinux.java but it returned false.</p>
  
  <p>So, I tried "chcon" command via adb shell which basically got the same result.</p>
  
  <pre><code>chcon -v u:object_r:fuse:s1 ./storage/emulated/0/DCIM/100MEDIA/IMAG0001.jpg
  
  chcon './storage/emulated/0/DCIM/100MEDIA/IMAG0001.jpg' to u:object_r:fuse:s1
  chcon: './storage/emulated/0/DCIM/100MEDIA/IMAG0001.jpg' to u:object_r:fuse:s1: 
  Operation not supported on transport endpoint
  </code></pre>
  
  <p>After a little bit of research, I found that I can change context only if the file is on an ext4 file system, but the image was under the fuse file system. But when I put the image to an ext4 formatted partition, change context there(which does work) and put it back to the original directory, the old context is back.</p>
  
  <p>Can someone please explain to me why that is the case? Why can the context not be changed under the fuse file system and why does the new context not survive, using the method above? Is there a solution or workaround?</p>
  
  <p>EDIT: </p>
  
  <p>So I figured out that SELinux context is an extention for the file and that fuse filesystem does not support those. When I try to get the context, I get a default context for that file. Does this default context come from a list or some other file or ist there just one default context that comes out of the SELinux.java?<br>
  EDIT over.</p>
  
  <p>My testing device is an HTC M8 with Android 6 and root access.</p>
  
  <p>Thanks in advance, your efforts are very appreciated!</p>