Allow snapuserd to inotify watch /dev/socket.
snapuserd uses an inotify watch to detect when /dev/socket/snapuserd has
been created.
Bug: N/A
Test: no denials after applying OTA on cuttlefish
Change-Id: I2ca16aee84ce7648bceea5c5de32a561b932f528
diff --git a/private/snapuserd.te b/private/snapuserd.te
index 2956891..ade77dd 100644
--- a/private/snapuserd.te
+++ b/private/snapuserd.te
@@ -30,7 +30,7 @@
set_prop(snapuserd, snapuserd_prop)
# For inotify watching for /dev/socket/snapuserd_proxy to appear.
-allow snapuserd tmpfs:dir read;
+allow snapuserd tmpfs:dir { read watch };
# Forbid anything other than snapuserd and init setting snapuserd properties.
neverallow {