commit 3ca356b7df0e777515e519c89cc1264b5f98e3bc
author Treehugger Robot <treehugger-gerrit@google.com> Wed Dec 21 01:24:43 2022 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Dec 21 01:24:43 2022 +0000
tree 442dbaec9fc4002b44c6d170bc2f5d912e78da29
parent b6066c2261a8d1c2502a46a4b8a046de4b6c0dab
parent ff577a00b845ea51bca74869cab37bfb6de9da27

Merge "Allow system_server to enable fs-verity."

private/system_server.te

diff --git a/private/system_server.te b/private/system_server.te
index 1a19a77..f85237f 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1087,7 +1087,7 @@
 allow system_server toolbox_exec:file rx_file_perms;
 
 # Allow system process to setup fs-verity
-allowxperm system_server apk_data_file:file ioctl FS_IOC_ENABLE_VERITY;
+allowxperm system_server { apk_data_file system_data_file apex_system_server_data_file }:file ioctl FS_IOC_ENABLE_VERITY;
 
 # Allow system process to measure fs-verity for apps, apps being installed and system files
 allowxperm system_server { apk_data_file apk_tmp_file system_file }:file ioctl FS_IOC_MEASURE_VERITY;