Allow apexd to configure /sys/block/dm-
To configure readahead for APEX dm-verity devices.
Bug: 117823094
Test: apexd can change readahead
Change-Id: Ie0396d59ef758ad55f499f65957697d26a48aae9
diff --git a/private/apexd.te b/private/apexd.te
index ab136eb..61e099b 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -43,6 +43,10 @@
# Unmount and mount filesystems
allow apexd labeledfs:filesystem { mount unmount };
+# Configure read-ahead of dm-verity devices
+allow apexd sysfs_dm:dir r_dir_perms;
+allow apexd sysfs_dm:file rw_file_perms;
+
# Spawning a libbinder thread results in a dac_override deny,
# /dev/cpuset/tasks is owned by system.
#