commit 879909f4d6e803f74cb2c24ba24183ef05574aa7
author Paul Lawrence <paullawrence@google.com> Fri Jan 24 12:56:34 2025 -0800
committer Paul Lawrence <paullawrence@google.com> Mon Jan 27 12:39:07 2025 -0800
tree 4834e84ecff857a17a2f52a79a2c8c8fb1f2bc80
parent 1d45424c6a75cf46caaa8cc281ffbf2207d960bb

Policy for overlay_remounter

Test: Manual
Bug: 388912628
Change-Id: I9f27647f0e8d3ece229e7a46d50d54aa1f76fd76

private/init.te

diff --git a/private/init.te b/private/init.te
index 35d7647..6f0ee80 100644
--- a/private/init.te
+++ b/private/init.te
@@ -814,7 +814,7 @@
 # The init domain is only entered via an exec based transition from the
 # kernel domain, never via setcon().
 neverallow domain init:process dyntransition;
-neverallow { domain -kernel } init:process transition;
+neverallow { domain -kernel userdebug_or_eng(`-overlay_remounter') } init:process transition;
 neverallow init { file_type fs_type -init_exec }:file entrypoint;
 
 # Never read/follow symlinks created by shell or untrusted apps.