Merge "snapuserd: Add selinux policy"
diff --git a/microdroid/system/private/keystore.te b/microdroid/system/private/keystore.te
index ac3ada1..be211a3 100644
--- a/microdroid/system/private/keystore.te
+++ b/microdroid/system/private/keystore.te
@@ -13,3 +13,6 @@
# microdroid doesn't use keymaster HAL
dontaudit keystore hal_keymaster_hwservice:hwservice_manager find;
+
+# microdroid isn't related to F2FS, but sqlite3 tries to query F2FS features.
+dontauditxperm keystore keystore_data_file:file ioctl F2FS_IOC_GET_FEATURES;
diff --git a/private/shell.te b/private/shell.te
index dc820bd..bd4e5c0 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -187,6 +187,11 @@
# Allow shell to access the keystore2_key namespace shell_key. Mainly used for native tests.
allow shell shell_key:keystore2_key { delete rebind use get_info update };
+# Allow shell to open and execute memfd files for minijail unit tests.
+userdebug_or_eng(`
+ allow shell appdomain_tmpfs:file { open execute_no_trans };
+')
+
# Allow shell to write db.log.detailed, db.log.slow_query_threshold*
set_prop(shell, sqlite_log_prop)