[MTE] Allow system_app to write memtag property.
Bug: 206895651
Change-Id: I6463965c094b9b3c4f3f70929a09e109ee9c84b9
diff --git a/private/property.te b/private/property.te
index 7033a06..91e8bb2 100644
--- a/private/property.te
+++ b/private/property.te
@@ -412,10 +412,12 @@
# Allow the shell to set MTE props, so that non-root users with adb shell
# access can control the settings on their device.
+# Allow system apps to set MTE props, so Developer Options can set them.
neverallow {
domain
-init
-shell
+ -system_app
} {
arm64_memtag_prop
}:property_service set;
diff --git a/private/system_app.te b/private/system_app.te
index ce76b69..460ad4b 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -34,6 +34,7 @@
allow system_app icon_file:file r_file_perms;
# Write to properties
+set_prop(system_app, arm64_memtag_prop)
set_prop(system_app, bluetooth_a2dp_offload_prop)
set_prop(system_app, bluetooth_audio_hal_prop)
set_prop(system_app, bluetooth_prop)