Give map permission to viewcompiler
On cuttlefish devices, the resource loading code apparently maps the file rather
than just reading it.
Denial log:
viewcompiler: type=1400 audit(0.0:308): avc: denied { map } for
path="/data/app/android.startop.test-Z2JxVhtKPw2wx4o-nmo5NA==/base.apk"
dev="vdb" ino=139269 scontext=u:r:viewcompiler:s0
tcontext=u:object_r:apk_data_file:s0 tclass=file permissive=0
app=android.startop.test
Bug: 139018973
Change-Id: I4bbbc44abc3c4315137f76a0be737236cf10f4ef
diff --git a/private/viewcompiler.te b/private/viewcompiler.te
index 3c9c1ee..d1f0964 100644
--- a/private/viewcompiler.te
+++ b/private/viewcompiler.te
@@ -17,7 +17,7 @@
allow viewcompiler app_data_file:file { getattr write };
# Allow the view compiler to read resources from the apps APK.
-allow viewcompiler apk_data_file:file read;
+allow viewcompiler apk_data_file:file { read map };
# priv-apps are moving to a world where they can only execute
# signed code. Make sure viewcompiler never can write to privapp