postinstall_dexopt: allow reading odsign.verification.status
Allows dexopt to read odsign verification status and use on-device
generated artifacts when dexopting after an OTA.
Bug: 194069492
Test: manually apply ota, see no denials for reading property
Change-Id: I97acfc17ffd9291d1a81906c75039f01624dff0f
diff --git a/private/postinstall_dexopt.te b/private/postinstall_dexopt.te
index 94af043..2fdc941 100644
--- a/private/postinstall_dexopt.te
+++ b/private/postinstall_dexopt.te
@@ -32,6 +32,9 @@
allow postinstall_dexopt tmpfs:file read;
+# Allow access odsign verification status
+get_prop(postinstall_dexopt, odsign_prop)
+
# Allow access to /postinstall/apex.
allow postinstall_dexopt postinstall_apex_mnt_dir:dir { getattr search };