Allow binder services to r/w su:tcp_socket
Test: binderHostDeviceTest
Bug: 182914638
Change-Id: I128abb8f3c91c29b6222f9b72088503111fd91f8
diff --git a/microdroid/sepolicy/system/private/audioserver.te b/microdroid/sepolicy/system/private/audioserver.te
index 2d0b46d..feda8d4 100644
--- a/microdroid/sepolicy/system/private/audioserver.te
+++ b/microdroid/sepolicy/system/private/audioserver.te
@@ -95,7 +95,8 @@
# permissions and be isolated from the rest of the system and network.
# Lengthier explanation here:
# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
-neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
+neverallow audioserver domain:{ udp_socket rawip_socket } *;
+neverallow audioserver { domain userdebug_or_eng(`-su') }:tcp_socket *;
# Allow using wake locks
wakelock_use(audioserver)