Allow apexd to talk to vold.
To query filesystem checkpointing state.
Bug: 126740531
Test: no denials
Change-Id: I28a68b9899d7cb42d7e557fb904a2bf8fa4ecf66
diff --git a/private/apexd.te b/private/apexd.te
index 3282cfc..4f2a093 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -80,6 +80,10 @@
# not covered by rollback manager.
set_prop(apexd, powerctl_prop)
+# Find the vold service, and call into vold to manage FS checkpoints
+allow apexd vold_service:service_manager find;
+binder_call(apexd, vold)
+
# Apex pre- & post-install permission.
# Allow self-execute for the fork mount helper.
diff --git a/public/vold.te b/public/vold.te
index cb21b83..c7d69be 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -290,8 +290,15 @@
neverallow { domain -vold -init } restorecon_prop:property_service set;
-# Only system_server and vdc can interact with vold over binder
-neverallow { domain -system_server -vdc -vold -update_verifier } vold_service:service_manager find;
+neverallow {
+ domain
+ -system_server
+ -vdc
+ -vold
+ -update_verifier
+ -apexd
+} vold_service:service_manager find;
+
neverallow vold {
domain
-ashmemd