Allow compos to getattr on authfs
Bug: 161471326
Bug: 196635431
Test: ComposTestCase
Change-Id: I3a4073726d31686c8eb945ba9417cb2afe238d79
diff --git a/microdroid/system/private/compos.te b/microdroid/system/private/compos.te
index 05936a6..b8ad335 100644
--- a/microdroid/system/private/compos.te
+++ b/microdroid/system/private/compos.te
@@ -24,5 +24,9 @@
# authfs_service.
allow compos authfs_fuse:file { read write };
+# Allow getattr (in fact, getxattr) as a workaround to retrieve fs-verity
+# metadata. See b/196635431.
+allow compos authfs_fuse:file getattr;
+
# Allow domain transition into dex2oat.
domain_auto_trans(compos, dex2oat_exec, dex2oat)