Sync internal master and AOSP sepolicy.
Bug: 37916906
Test: Builds 'n' boots.
Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668
Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
diff --git a/private/priv_app.te b/private/priv_app.te
index 109c869..60fb411 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -27,7 +27,6 @@
allow priv_app mediacodec_service:service_manager find;
allow priv_app mediametrics_service:service_manager find;
allow priv_app mediadrmserver_service:service_manager find;
-allow priv_app mediacasserver_service:service_manager find;
allow priv_app mediaextractor_service:service_manager find;
allow priv_app mediaserver_service:service_manager find;
allow priv_app nfc_service:service_manager find;
@@ -108,8 +107,14 @@
# Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
allow priv_app keystore:keystore_key gen_unique_id;
+# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
+allow priv_app selinuxfs:file r_file_perms;
+
read_runtime_log_tags(priv_app)
+# suppress denials when safetynet scans /system
+dontaudit priv_app exec_type:file getattr;
+
###
### neverallow rules
###