allow run-as to access /data/local/tmp
Otherwise denials like the following occur:
avc: denied { write } for path="/data/local/tmp/foo" dev="dm-0" ino=325769 scontext=u:r:runas:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file
avc: denied { read } for path="/data/local/tmp/foo" dev="dm-0" ino=325769 scontext=u:r:runas:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file
Steps to reproduce:
$ run-as com.google.android.talk id > /data/local/tmp/id.out
$ run-as com.google.android.talk cat < /data/local/tmp/id.out
Change-Id: I68a7b804336a3d5776dcc31622f1279380282030
diff --git a/runas.te b/runas.te
index 1ce8e64..97f31f7 100644
--- a/runas.te
+++ b/runas.te
@@ -7,6 +7,7 @@
allow runas shell:fd use;
allow runas shell:fifo_file { read write };
allow runas devpts:chr_file { read write ioctl };
+allow runas shell_data_file:file { read write };
# run-as reads package information.
allow runas system_data_file:file r_file_perms;