Allow app_zygote to map memfd backed memeory as PROT_EXEC
Binary translation maps these regions to install translated code,
see linked bug for more context.
Bug: http://b/189502716
Test: run cts -m CtsExternalServiceTestCases -t android.externalservice.cts.ExternalServiceTest#testBindExternalServiceWithZygote
in binary translated enviroment.
Change-Id: I3bc978b9013e9fc5cf700d1efca769331ec395b0
diff --git a/private/app_zygote.te b/private/app_zygote.te
index 6552d63..841c0a1 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -20,6 +20,9 @@
# For JIT
allow app_zygote self:process execmem;
+# Allow exec mapping from tmpfs (memfds) for binary translation
+allow app_zygote app_zygote_tmpfs:file execute;
+
# Allow app_zygote to stat the files that it opens. It must
# be able to inspect them so that it can reopen them on fork
# if necessary: b/30963384.