commit 61f28b33a477ce3be0e086753bf8e1c3b00e9f53
author Treehugger Robot <treehugger-gerrit@google.com> Wed Apr 03 01:58:26 2019 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Apr 03 01:58:26 2019 +0000
tree bedc98768a1717ae2b643837ad004e309cf0fe3f
parent 99a51035858f555049fef6ab3277c7f76cfdb67c
parent c9aba1200294601631e97d30af63f094277c5e8e

Merge "Allow execmod for apps with targetSdkVersion=26-28"

private/rs.te

diff --git a/private/rs.te b/private/rs.te
index 7fbea8c..bf10841 100644
--- a/private/rs.te
+++ b/private/rs.te
@@ -27,7 +27,7 @@
 allow rs same_process_hal_file:file { r_file_perms execute };
 
 # File descriptors passed from app to renderscript
-allow rs untrusted_app_all:fd use;
+allow rs { untrusted_app_all ephemeral_app }:fd use;
 
 # rs can access app data, so ensure it can only be entered via an app domain and cannot have
 # CAP_DAC_OVERRIDE.