Merge "Constrain cgroups access."
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 79faafa..3b5c5eb 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -216,6 +216,7 @@
}:service_manager find;
# suppress denials for services dumpstate should not be accessing.
dontaudit dumpstate {
+ apex_service
dumpstate_service
gatekeeper_service
incident_service
@@ -272,6 +273,10 @@
# For when dumpstate runs df
dontaudit dumpstate mnt_vendor_file:dir search;
+dontaudit dumpstate apex_mnt_dir:dir getattr;
+
+# Allow dumpstate to talk to bufferhubd over binder
+binder_call(dumpstate, bufferhubd);
# Allow dumpstate to kill vendor dumpstate service by init
set_prop(dumpstate, ctl_dumpstate_prop)