commit 770a4f6539d0243be31d1788b98fe65f372c3e5a
author Yabin Cui <yabinc@google.com> Mon Jan 07 16:37:24 2019 -0800
committer Yabin Cui <yabinc@google.com> Wed Jan 09 17:24:31 2019 +0000
tree 1ec0bea7204fd47839d8edd924609e2ef517c0ad
parent 39b0b80c34ad0afa89d677576ceb7418adc7163c

Add permissions in runas_app domain to debug/profile debuggable apps.

runas_app domain is used by lldb/ndk-gdb/simpleperf to debug/profile
debuggable apps. But it misses permissions to ptrace app processes and
read /proc/<app_pid> directory.

Bug: none
Test: build and boot marlin.
Test: run lldb and simpleperf on apps with target sdk version 24-29.
Change-Id: I9e6f940ec81a8285eae8db3b77fb1251a25dedd0

private/seapp_contexts

diff --git a/private/seapp_contexts b/private/seapp_contexts
index 14a8bff..9fc6816 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -122,4 +122,5 @@
 user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
 user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
-user=_app fromRunAs=true domain=runas_app levelFrom=all
+user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
+user=_app fromRunAs=true domain=runas_app levelFrom=user