Merge "Sepolicy: ART APEX boot integrity"
diff --git a/private/art_apex_postinstall.te b/private/art_apex_postinstall.te
index 314fb7c..40b09d2 100644
--- a/private/art_apex_postinstall.te
+++ b/private/art_apex_postinstall.te
@@ -17,6 +17,7 @@
# Required for relabel.
allow art_apex_postinstall file_contexts_file:file r_file_perms;
+allow art_apex_postinstall self:global_capability_class_set sys_admin;
# Script helpers.
allow art_apex_postinstall shell_exec:file rx_file_perms;
diff --git a/private/mini_keyctl.te b/private/mini_keyctl.te
index c81a17c..53dbfce 100644
--- a/private/mini_keyctl.te
+++ b/private/mini_keyctl.te
@@ -8,7 +8,7 @@
# Kernel only prints the keys that can be accessed and only kernel keyring is needed here.
dontaudit mini-keyctl init:key view;
dontaudit mini-keyctl vold:key view;
-allow mini-keyctl kernel:key { view search write };
+allow mini-keyctl kernel:key { view search write setattr };
allow mini-keyctl mini-keyctl:key { view search write };
# When kernel requests an algorithm, the crypto API first looks for an