Fix lock logspam for dexoptanalyzer.
Allow dexoptanalyzer(d) to lock `system_file` files, so that it can
lock `/system/framework/$ISA/*.art` files (which is harmless as these
files live in a read-only partition, but admittedly simplifies the
corresponding logic in ART).
Addresses denials of the form:
avc: denied { lock } for path="/system/framework/arm/boot.art"
dev="dm-0" ino=1330 scontext=u:r:dexoptanalyzer:s0
tcontext=u:object_r:system_file:s0 tclass=file permissive=0 […]
Test: Reproduce steps in bug 138683603 and check the absence of SELinux denials
Bug: 138683603
Change-Id: I8a08822b4908b3b37bd0e450dd1356ed92332327
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index 59554c8..a978af6 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -19,6 +19,9 @@
allow dexoptanalyzer installd:fd use;
allow dexoptanalyzer installd:fifo_file { getattr write };
+# Acquire advisory lock on /system/framework/arm/*
+allow dexoptanalyzer system_file:file lock;
+
# Allow reading secondary dex files that were reported by the app to the
# package manager.
allow dexoptanalyzer { privapp_data_file app_data_file }:dir { getattr search };