commit 66ef8f01ee74fc9ffba75bcab70f5e4ed6898dbc
author Eric Rahm <erahm@google.com> Thu Apr 20 15:06:22 2023 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Thu Apr 20 15:06:22 2023 +0000
tree 8cc6aa68ac454d10f4ea85886cc2498f7a5ffff7
parent e46266d2ce48fb53690ee976c1c53a3b2301034c
parent 588d537f0bcddfd31c3598b8bca4fee308c0c416

Merge changes from topic "cherrypicker-L58100000960054695:N31200001359782734"

* changes:
  Allow system_server to verify installed apps
  Fix denial for ioctl FS Verity

private/system_server.te

diff --git a/private/system_server.te b/private/system_server.te
index 553e0a4..df0dfa7 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1108,6 +1108,8 @@
 
 # Allow system process to measure fs-verity for apps, apps being installed and system files
 allowxperm system_server { apk_data_file apk_tmp_file system_file }:file ioctl FS_IOC_MEASURE_VERITY;
+allowxperm system_server apk_tmp_file:file ioctl FS_IOC_SETFLAGS;
+allow system_server system_file:file ioctl;
 
 # Postinstall
 #