Sepolicy: Add base runtime APEX preinstall policies
Add art_apex_preinstall domain that is allowed to create AoT
artifacts in /data/ota.
Bug: 125474642
Test: m
Change-Id: Ia091d8df34c4be4f84c2052d3c333a0e36bcb036
diff --git a/private/dex2oat.te b/private/dex2oat.te
index c529d11..47c78a0 100644
--- a/private/dex2oat.te
+++ b/private/dex2oat.te
@@ -68,6 +68,16 @@
# create them itself (and make them world-readable).
allow dex2oat ota_data_file:file { create w_file_perms setattr };
+###############
+# APEX Update #
+###############
+
+# /dev/zero is inherited.
+allow dex2oat apexd:fd use;
+
+# Allow dex2oat to use file descriptors from preinstall.
+allow dex2oat art_apex_preinstall:fd use;
+
##############
# Neverallow #
##############