Sepolicy: Give sys_admin for relabel
This requirement slipped through.
Bug: 125474642
Test: m
Test: manual
Change-Id: I8b31bda519632a549574d3057bc49a158e796e2e
diff --git a/private/art_apex_postinstall.te b/private/art_apex_postinstall.te
index 314fb7c..40b09d2 100644
--- a/private/art_apex_postinstall.te
+++ b/private/art_apex_postinstall.te
@@ -17,6 +17,7 @@
# Required for relabel.
allow art_apex_postinstall file_contexts_file:file r_file_perms;
+allow art_apex_postinstall self:global_capability_class_set sys_admin;
# Script helpers.
allow art_apex_postinstall shell_exec:file rx_file_perms;