# Allow update_engine to call the callback function provided by updater_app
binder_call(update_engine, updater_app)

# Read updates from storage data
r_dir_file(update_engine, mnt_user_file)
r_dir_file(update_engine, storage_file)

# Allow mount and unmount of system partition
allow update_engine labeledfs:filesystem { mount unmount };

# Allow transition to backuptool domain
allow update_engine self:process setexec;
domain_trans(update_engine, otapreopt_chroot_exec, backuptool)