Allow `dex2oat` to read runtime native flag properties.
This is in prevision of future `dex2oat` feature / experiments flags
set in namespaces `runtime_native` and `runtime_native_boot`.
In Android S, ART is becoming an updatable Mainline module (which will
include `dex2oat`). In the future, we may want to run experiments or
test new features using the Android Experiments framework. Such
experiments/features are enabled via feature flags, implemented as
Android system properties for native code.
To be able to read such properties, we need to give the read
permission to the relevant binaries. At the moment, this can only be
done in the SELinux policy of the Android platform, which cannot be
updated via a Mainline update. To give us the opportunity to conduct
such experiments in `dex2oat` via an ART Mainline Module update after
Android S has shipped (e.g. by having `dex2oat` query a system
property in `persist.device_config.runtime_native.*` ), we need to
have this permission set in the Android S platform now.
Test: mmma system/sepolicy
Change-Id: I0a83e9f0ec19884a99ef9693d55084376bff8762
diff --git a/private/dex2oat.te b/private/dex2oat.te
index 27e4b0c..b71ede7 100644
--- a/private/dex2oat.te
+++ b/private/dex2oat.te
@@ -47,6 +47,10 @@
allow dex2oat apex_art_data_file:dir r_dir_perms;
allow dex2oat apex_art_data_file:file r_file_perms;
+# Allow dex2oat to read runtime native flag properties.
+get_prop(dex2oat, device_config_runtime_native_prop)
+get_prop(dex2oat, device_config_runtime_native_boot_prop)
+
##################
# A/B OTA Dexopt #
##################