Merge "add selinux rules for mini-keyctl"
diff --git a/private/zygote.te b/private/zygote.te
index 9f8a348..ab86f89 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -97,7 +97,10 @@
# Allowed to mount user-specific storage into place
allow zygote storage_file:dir { search mounton };
# Allow mounting on sdcardfs dirs
-allow zygote sdcardfs:dir { search mounton };
+# TODO: reduce this back to only sdcardfs once b/123533205 is root-caused
+# (Technically "sdcardfs" and "media_rw_data_file" are equivalent, since
+# sdcardfs simply wraps files stored under /data/media.)
+allow zygote { sdcardfs media_rw_data_file }:dir { search mounton };
# Handle --invoke-with command when launching Zygote with a wrapper command.
allow zygote zygote_exec:file rx_file_perms;