Allow odsign to rename apex_art_data_file:dir
This is needed to allow us to promote pending artifacts from compos to
active, otherwise we get:
odsign : Can't rename /data/misc/apexdata/com.android.art/pending to /data/misc/apexdata/com.android.art/dalvik-cache: Permission denied
odsign : type=1400 audit(0.0:9): avc: denied { rename } for name="pending" dev="dm-35" ino=14965 scontext=u:r:odsign:s0 tcontext=u:object_r:apex_art_data_file:s0 tclass=dir permissive=0
Test: Manual, running modified odsign with (bogus) pending artfiacts
Bug: 190166662
Change-Id: I3efafa62d3444f967c0b5eab5516a00daf64f8ef
diff --git a/private/odsign.te b/private/odsign.te
index 0ff3b7b..57ca048 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -41,7 +41,7 @@
# For ART apex data dir access
allow odsign apex_module_data_file:dir { getattr search };
-allow odsign apex_art_data_file:dir { rw_dir_perms rmdir };
+allow odsign apex_art_data_file:dir { rw_dir_perms rmdir rename };
allow odsign apex_art_data_file:file { rw_file_perms unlink };
# Run odrefresh to refresh ART artifacts