Allow compos_fd_server to create artifacts
Previously this was always done by odrefresh. But now we are running
odrefresh in the VM we need to allow FD server to do it as its proxy.
Bug: 209572241
Bug: 209572296
Test: composd_cmd forced-oderefresh
Change-Id: I4bc10d6a3ec73789721a0541f04dd7e3865fe826
diff --git a/private/compos_fd_server.te b/private/compos_fd_server.te
index 72964c3..a1a8a64 100644
--- a/private/compos_fd_server.te
+++ b/private/compos_fd_server.te
@@ -4,15 +4,18 @@
# Allow access to open fds inherited from odrefresh - read inputs, generate outputs
# TODO(b/209008712): Remove once migration is done.
allow compos_fd_server odrefresh:fd use;
-allow compos_fd_server apex_art_data_file:file { getattr read };
# Allow access to open fds inherited from composd
allow compos_fd_server composd:fd use;
-# Allow creating new files and directory in the staging directory.
+# Allow creating new files and directories in the staging directory.
allow compos_fd_server apex_art_staging_data_file:dir create_dir_perms;
allow compos_fd_server apex_art_staging_data_file:file create_file_perms;
+# Allow creating new files and directories in the artifacts directory.
+allow compos_fd_server apex_art_data_file:dir create_dir_perms;
+allow compos_fd_server apex_art_data_file:file create_file_perms;
+
# Use a pipe to signal readiness
# TODO(b/205750213): Removed odrefresh when we run odrefresh in the VM
allow compos_fd_server odrefresh:fifo_file write;