Allow system_server to relabel files to staging_data_file (1/n)
This is required by ag/13090598 for restorecon to work correctly.
Bug: 168562373
Test: m
Change-Id: Ib319631ca6d7b3478ef39334a9772581cc97e507
diff --git a/private/system_server.te b/private/system_server.te
index a60c327..e9d8bd4 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -549,9 +549,11 @@
# Relabel apk files.
allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
-# Allow PackageManager to rename file from /data/app-staging folder to /data/app during
-# staged apk install.
-allow system_server { staging_data_file }:{ dir file } { relabelfrom };
+# Allow PackageManager to:
+# 1. rename file from /data/app-staging folder to /data/app
+# 2. relabel files (linked to /data/rollback) under /data/app-staging
+# during staged apk/apex install.
+allow system_server { staging_data_file }:{ dir file } { relabelfrom relabelto };
# Relabel wallpaper.
allow system_server system_data_file:file relabelfrom;