init: Allow SETPCAP for dropping bounding set.
This is required for https://android-review.googlesource.com/#/c/295748
so that init can drop the capability bounding set for services.
Bug: 32438163
Test: With 295748 and a test service using ambient capabilities.
Change-Id: I57788517cfe2ef0e7a2f1dfab94d0cb967ede065
diff --git a/public/init.te b/public/init.te
index 16bafc3..a029219 100644
--- a/public/init.te
+++ b/public/init.te
@@ -246,8 +246,8 @@
allow init shell_data_file:dir { open create read getattr setattr search };
allow init shell_data_file:file { getattr };
-# Set UID and GID for services.
-allow init self:capability { setuid setgid };
+# Set UID, GID, and adjust capability bounding set for services.
+allow init self:capability { setuid setgid setpcap };
# For bootchart to read the /proc/$pid/cmdline file of each process,
# we need to have following line to allow init to have access