Allow composd to run odrefresh
Also allow odrefresh to run pvm_exec to talk to the CompOS VM.
And I moved the dontaudit & neverallow rules to the bottom while I was here.
Bug: 186126194
Test: adb shell apex/com.android.compos/bin/composd_cmd
Change-Id: I6f06dd6467a8eb59123d06c7179a86d9287e7f2f
diff --git a/private/composd.te b/private/composd.te
index 725e79e..4f85125 100644
--- a/private/composd.te
+++ b/private/composd.te
@@ -13,3 +13,6 @@
allow composd apex_module_data_file:dir search;
allow composd apex_compos_data_file:dir create_dir_perms;
allow composd apex_compos_data_file:file create_file_perms;
+
+# Run odrefresh to refresh ART artifacts
+domain_auto_trans(composd, odrefresh_exec, odrefresh)