Allow system_server read access to SurfaceFlinger
This change gives system_server read permissions to SurfaceFlinger in
order to pin it with PinnerService.
Bug: 176197656
Test: adb shell dumpsys pinner
/system/bin/surfaceflinger was successfully pinned.
Change-Id: Ic845eebe298ec2d602b86003c07889f37fc44159
diff --git a/private/system_server.te b/private/system_server.te
index bf5c8e8..f2e336c 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1181,6 +1181,9 @@
allow system_server watchdog_metadata_file:dir rw_dir_perms;
allow system_server watchdog_metadata_file:file create_file_perms;
+# Allow system server r access to /system/bin/surfaceflinger for PinnerService.
+allow system_server surfaceflinger_exec:file r_file_perms;
+
# Allow init to set sysprop used to compute stats about userspace reboot.
set_prop(system_server, userspace_reboot_log_prop)