Update SELinux policy for Pre-reboot Dexopt.
- Add pm.dexopt.* properties.
- Add rules for running artd in chroot.
Bug: 311377497
Test: manual - Run Pre-reboot Dexopt and see no denial.
Change-Id: If5ff9b23e99be033f19ab257c90e0f52bf250ccf
diff --git a/private/derive_classpath.te b/private/derive_classpath.te
index 4f15d5a..8dd6572 100644
--- a/private/derive_classpath.te
+++ b/private/derive_classpath.te
@@ -24,3 +24,9 @@
allow derive_classpath postinstall_dexopt:file read;
allow derive_classpath postinstall_dexopt:lnk_file read;
allow derive_classpath postinstall_dexopt_tmpfs:file rw_file_perms;
+
+# Allow to be called by artd in Pre-reboot Dexopt.
+allow derive_classpath artd:fd use;
+
+# Allow writing to Pre-reboot Dexopt temp files.
+allow derive_classpath pre_reboot_dexopt_artd_file:file { open read write };