Allow additional domains to set rkp properties
Varying properties under the remote_prov_prop SELinux label enable OEMs
to customize the behavior of the RKPD mainline module. The neverallow
policies being overly strict prevented OEMs from leveraging this
customizability though. This change exempts two requested domains from
the neverallow list.
Test: SEPolicy compiles when allowing keystore or system_server to set
the remote_prov_prop property.
Bug: 356772512
Change-Id: Ic8188834ceb7e8076fcb9867f86b97cc74629e99
diff --git a/private/property.te b/private/property.te
index 7907dbc..e66913f 100644
--- a/private/property.te
+++ b/private/property.te
@@ -752,7 +752,9 @@
neverallow {
domain
-init
+ -keystore
-shell
+ -system_server
-rkpdapp
} remote_prov_prop:property_service set;