Add apexd_payload_metadata_prop
This should be read-only and corresponds to apexd.payload_metadata.path
Bug: 191097666
Test: android-sh -c 'setprop apexd.payload_metadata.path'
See permission denied
atest MicrodroidHostTestCases
Change-Id: Ifcb7da1266769895974d4fef86139bad5891a4ec
diff --git a/microdroid/system/private/property.te b/microdroid/system/private/property.te
index c36875c..7911753 100644
--- a/microdroid/system/private/property.te
+++ b/microdroid/system/private/property.te
@@ -41,3 +41,9 @@
-microdroid_manager
-apkdmverity
} microdroid_manager_roothash_prop:file no_rw_file_perms;
+
+# apexd_payload_metadata_prop can only set by init
+neverallow {
+ domain
+ -init
+} apexd_payload_metadata_prop:property_service set;