Allow shell to read /vendor/apex/*
It is used for future xTS tests to read the raw files.
Bug: 190858091
Test: m
Change-Id: If1c7fd92772ff84d92a95fbee74f6c1f8d1cd365
diff --git a/private/shell.te b/private/shell.te
index 26f6d95..6ff5056 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -114,8 +114,10 @@
allow shell self:perf_event { open read write kernel };
neverallow shell self:perf_event ~{ open read write kernel };
-# Allow shell to read /apex/apex-info-list.xml
+# Allow shell to read /apex/apex-info-list.xml and the vendor apexes
allow shell apex_info_file:file r_file_perms;
+allow shell vendor_apex_file:file r_file_perms;
+allow shell vendor_apex_file:dir r_dir_perms;
# Set properties.
set_prop(shell, shell_prop)