Sepolicy: Add runtime APEX preinstall fsverity permissions
Add rights to create and install fsverity data.
Bug: 125474642
Test: m
Change-Id: I752c40c7b396b2da082cb17641702a2c5c11b9c3
diff --git a/private/art_apex_preinstall.te b/private/art_apex_preinstall.te
index 438340b..99341ec 100644
--- a/private/art_apex_preinstall.te
+++ b/private/art_apex_preinstall.te
@@ -24,3 +24,16 @@
# Run dex2oat.
domain_auto_trans(art_apex_preinstall, dex2oat_exec, dex2oat)
+
+# Fsverity in the same domain.
+allow art_apex_preinstall system_file:file execute_no_trans;
+# Fsverity work.
+allowxperm art_apex_preinstall ota_data_file:file ioctl {
+ FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
+};
+
+allow art_apex_preinstall kernel:key search;
+# For testing purposes, allow keys installed with su.
+userdebug_or_eng(`
+ allow art_apex_preinstall su:key search;
+')