app_zygote need access to oem partition
app_zygote used by for example Google Chrome needs access
to at least search /oem partition.
Google chrome version: 76.0.3809.132 is running in app_zygote
and the following access is blocked by selinux causing Chrome
to hang.
avc: denied { search } for pid=813 comm="d.chrome_zygote"
name="/" dev="sda42" ino=2 scontext=u:r:app_zygote:s0:c214,c256,c512,c768
tcontext=u:object_r:oemfs:s0 tclass=dir permissive=0 ppid=798
pcomm="d.chrome_zygote" pgid=798 pgcomm="d.chrome_zygote"
Change-Id: Idcce1a5ad1a8be3d7bd057c12ec477baa9669235
diff --git a/private/app_zygote.te b/private/app_zygote.te
index e44c1be..fe7ded3 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -61,6 +61,9 @@
allow app_zygote apk_data_file:dir r_dir_perms;
allow app_zygote apk_data_file:file { r_file_perms execute };
+# /oem accesses.
+allow app_zygote oemfs:dir search;
+
# Allow app_zygote access to /vendor/overlay
r_dir_file(app_zygote, vendor_overlay_file)