Add keystore2 grant capability to all apps to support key grants
To support apps granting access to keys they own in the Android
Keystore to other apps on the device, this commit adds the keystore2
grant capability to the appdomain. With this capability, apps can
call the new KeyStoreManager#grantKeyAccess to grant access to keys
they own to another app.
Bug: 351158708
Test: atest KeyStoreManagerTest
Change-Id: I2503614dc22e9398ea41b0690c7e6894f0abcf70
diff --git a/private/app.te b/private/app.te
index 6362c7d..b9a6d85 100644
--- a/private/app.te
+++ b/private/app.te
@@ -159,7 +159,7 @@
control_logd({ appdomain -ephemeral_app -sdk_sandbox_all })
# application inherit logd write socket (urge is to deprecate this long term)
-allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info rebind update };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info grant rebind update };
allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_maintenance_service:service_manager find;