Put dex2oat in it's own sandbox
Currently, dex2oat runs in the installd sandbox, and has
all the SELinux capabilities that installd does. That's too
excessive.
dex2oat handles untrusted user data, so we want to put it in
it's own tighter sandbox.
Bug: 15358102
Change-Id: I08083b84b9769e24d6dad6dbd12401987cb006be
diff --git a/file_contexts b/file_contexts
index 57fc1f2..def1e53 100644
--- a/file_contexts
+++ b/file_contexts
@@ -160,6 +160,7 @@
/system/bin/logwrapper u:object_r:system_file:s0
/system/bin/vdc u:object_r:vdc_exec:s0
/system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
+/system/bin/dex2oat u:object_r:dex2oat_exec:s0
#############################
# Vendor files