Policy for overlay_remounter
Note - type definitions moved outside the userdebug_or_eng macro to
avoid breaking user builds. User build (lynx-trunk_staging-user) built
and flashed to avoid a repeat of b/392686305
Test: system/core/fs_mgr/tests/adb-remount-test.sh
Bug: 388912628
Change-Id: Ice404a0b798a4dcbfcafb10d5b114807b21dca10
diff --git a/private/incident_helper.te b/private/incident_helper.te
index b453855..cdaf144 100644
--- a/private/incident_helper.te
+++ b/private/incident_helper.te
@@ -11,4 +11,13 @@
allow incident_helper incidentd:unix_stream_socket { read write };
# only allow incidentd and shell to call incident_helper
-neverallow { domain -incidentd -incident_helper -shell } incident_helper_exec:file { execute execute_no_trans };
+neverallow {
+ domain
+ -incidentd
+ -incident_helper
+ -shell
+ userdebug_or_eng(`-overlay_remounter')
+} incident_helper_exec:file {
+ execute
+ execute_no_trans
+};