Allow MM to open/syncfs/close encryptedstore dir
Microdroid Manager needs these permissions to sync the encryptedstore
filesystem.
Test: Builds
Test: Check selinux denials in logs
Change-Id: Iee020ae653f5d42af086ca91068e3df52c992305
diff --git a/microdroid/system/private/microdroid_manager.te b/microdroid/system/private/microdroid_manager.te
index a5b71f0..9e3df3b 100644
--- a/microdroid/system/private/microdroid_manager.te
+++ b/microdroid/system/private/microdroid_manager.te
@@ -45,6 +45,9 @@
# Allow microdroid_manager to start encryptedstore binary
domain_auto_trans(microdroid_manager, encryptedstore_exec, encryptedstore)
+# Microdroid Manager needs read related permission for syncing encrypted storage fs
+allow microdroid_manager encryptedstore_file:dir r_dir_perms;
+
# Allow microdroid_manager to run kexec to load crashkernel
domain_auto_trans(microdroid_manager, kexec_exec, kexec)