Fix libprocessgroup SELinux denials.
libprocessgroup checks whether it can use memory
cgroups for keeping track of forked processes by
seeing whether /dev/memcg/apps is writable. However,
on systems with memory cgroups disabled, SELinux
(correctly) no longer classifies this directory as a cgroup,
and starts denying zygote access. To fix this,
first check whether /dev/memcg/apps/tasks exists to
see if the cgroup is mounted; only then check whether
we can write to the directory.
Bug: 27046965
Change-Id: I6e44cd62d8c396e20ceb162c50606b3e86f2cb3e
diff --git a/rootdir/init.rc b/rootdir/init.rc
index e2ffe5d..faae48e 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -85,7 +85,7 @@
# root memory control cgroup, used by lmkd
mkdir /dev/memcg 0700 root system
mount cgroup none /dev/memcg memory
- # app mem cgroups, used by activity manager and lmkd
+ # app mem cgroups, used by activity manager, lmkd and zygote
mkdir /dev/memcg/apps/ 0755 system system
write /proc/sys/kernel/panic_on_oops 1