Update SELinux policy for Pre-reboot Dexopt.
- Add pm.dexopt.* properties.
- Add rules for running artd in chroot.
Bug: 311377497
Test: manual - Run Pre-reboot Dexopt and see no denial.
Change-Id: If5ff9b23e99be033f19ab257c90e0f52bf250ccf
diff --git a/private/linkerconfig.te b/private/linkerconfig.te
index bd46ca4..ce26fd2 100644
--- a/private/linkerconfig.te
+++ b/private/linkerconfig.te
@@ -27,4 +27,13 @@
allow linkerconfig postinstall_apex_mnt_dir:dir r_dir_perms;
allow linkerconfig postinstall_apex_mnt_dir:file r_file_perms;
-neverallow { domain -init -linkerconfig -otapreopt_chroot } linkerconfig_exec:file no_x_file_perms;
+# Allow for use in Pre-reboot Dexopt.
+allow linkerconfig dexopt_chroot_setup:fd use;
+
+neverallow {
+ domain
+ -dexopt_chroot_setup
+ -init
+ -linkerconfig
+ -otapreopt_chroot
+} linkerconfig_exec:file no_x_file_perms;