commit ac097ac4c7718f8593f2b6b96a93a776984ec7c4
author Martijn Coenen <maco@google.com> Fri Aug 17 09:35:42 2018 +0200
committer Martijn Coenen <maco@google.com> Thu Oct 04 07:06:45 2018 +0000
tree 01e707bc3af4c5792d81372a35e7abc12d5e41ee
parent d115b8ed246a03e364933f0b906354041962a4ec

Add policy for apexd.

apexd is a new daemon for managing APEX packages installed
on the device. It hosts a single binder service, "apexservice".

Bug: 112455435
Test: builds, binder service can be registered,
      apexes can be accessed, verified and mounted
Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97

private/system_app.te

diff --git a/private/system_app.te b/private/system_app.te
index 4ed1982..245496f 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -70,6 +70,7 @@
 # TODO: scope this down? Too broad?
 allow system_app {
   service_manager_type
+  -apex_service
   -dumpstate_service
   -installd_service
   -netd_service