Sync internal master and AOSP sepolicy.

Bug: 37916906
Test: Builds 'n' boots.
Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668
Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
diff --git a/prebuilts/api/26.0/private/postinstall_dexopt.te b/prebuilts/api/26.0/private/postinstall_dexopt.te
new file mode 100644
index 0000000..ff5fe87
--- /dev/null
+++ b/prebuilts/api/26.0/private/postinstall_dexopt.te
@@ -0,0 +1,5 @@
+typeattribute postinstall_dexopt coredomain;
+
+# Run dex2oat/patchoat in its own sandbox.
+# We have to manually transition, as we don't have an entrypoint.
+domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)