Allow creating /data/tombstones files by system_server.
Needed for ag/18773746
Bug: 225173288
Test: atest ErrorsTest + manual
Change-Id: I31bab12a59babd9a197cfb03d2417b926e60af84
diff --git a/private/system_server.te b/private/system_server.te
index 85675de..762f136 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -601,12 +601,9 @@
allow system_server textclassifier_data_file:dir create_dir_perms;
allow system_server textclassifier_data_file:file create_file_perms;
-# Access /data/tombstones.
-allow system_server tombstone_data_file:dir r_dir_perms;
-allow system_server tombstone_data_file:file r_file_perms;
-
-# Allow write access to be able to truncate tombstones.
-allow system_server tombstone_data_file:file write;
+# Manage /data/tombstones.
+allow system_server tombstone_data_file:dir rw_dir_perms;
+allow system_server tombstone_data_file:file create_file_perms;
# Manage /data/misc/vpn.
allow system_server vpn_data_file:dir create_dir_perms;