Allow linkerconfig to be executed with logwrap
As part of extending linkerconfig execution based on mount namespace and
APEX status, linkerconfig will be executed from init with logwrap. To
support this there should be an extra sepolicy to allow linkerconfig to
be executed with logwrap.
Bug: 144664390
Test: m -j passed & cuttlefish booted
Change-Id: Ia8b970a1c396a769eff4b102afbf4d33802923cf
diff --git a/private/linkerconfig.te b/private/linkerconfig.te
index 01a9fbf..f82e05d 100644
--- a/private/linkerconfig.te
+++ b/private/linkerconfig.te
@@ -10,4 +10,7 @@
# Allow linkerconfig to log to the kernel.
allow linkerconfig kmsg_device:chr_file w_file_perms;
+# Allow linkerconfig to be invoked with logwrapper from init.
+allow linkerconfig devpts:chr_file { read write };
+
neverallow { domain -init -linkerconfig } linkerconfig_exec:file no_x_file_perms;