Allow odsign to rename & unlink CompOS files.
Write access is still denied.
Bug: 194654666
Test: No denials when testing odsign.
Change-Id: Ia9ca85e4008a1a69da0943793d310b974a8484db
diff --git a/private/odsign.te b/private/odsign.te
index 0b2f187..3297af7 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -44,9 +44,9 @@
allow odsign apex_art_data_file:dir { rw_dir_perms rmdir rename };
allow odsign apex_art_data_file:file { rw_file_perms unlink };
-# For CompOS pending key files
-allow odsign apex_compos_data_file:dir { getattr search write remove_name };
-allow odsign apex_compos_data_file:file { r_file_perms unlink };
+# For CompOS instance & key files
+allow odsign apex_compos_data_file:dir rw_dir_perms;
+allow odsign apex_compos_data_file:file { r_file_perms unlink rename };
# Run odrefresh to refresh ART artifacts
domain_auto_trans(odsign, odrefresh_exec, odrefresh)