Allow appdomain to read dir and files under vendor_microdroid_file am: 01c4f57431 am: ec2735ac6a
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2960542
Change-Id: Ic955ed19db22984e84b63026b795c18626963b78
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/private/app.te b/private/app.te
index b5bb474..1ef6ceb 100644
--- a/private/app.te
+++ b/private/app.te
@@ -146,6 +146,9 @@
r_dir_file({ appdomain -ephemeral_app -sdk_sandbox_all }, vendor_app_file)
allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_app_file:file execute;
+# Allow apps to read microdroid related files in vendor partition for CTS purpose.
+r_dir_file({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, vendor_microdroid_file)
+
# Perform binder IPC to sdk sandbox.
binder_call(appdomain, sdk_sandbox_all)