Allow system_server access to aconfigd_mainline socket as well
Now that there are two aconfigds. System server needs to route flag
override request based on the ownership of the flag. If the flag
belongs to a mainline module, it should be routed to aconfigd_mainline
socket. Add this permission to system_server.
Test: verified via ABTD, https://android-build.corp.google.com/abtd/run/L43600030008182325/
Bug: b/382482452
Change-Id: Ie8ee055734a2af46a50307744afca5b107760b0f
diff --git a/private/system_server.te b/private/system_server.te
index a764df4..8b2dbb5 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1530,8 +1530,11 @@
allow system_server watchdog_metadata_file:dir rw_dir_perms;
allow system_server watchdog_metadata_file:file create_file_perms;
-allow system_server aconfigd_socket:sock_file {read write};
-allow system_server aconfigd:unix_stream_socket connectto;
+# allow system_server write to aconfigd socket
+unix_socket_connect(system_server, aconfigd, aconfigd);
+
+# allow system_server write to aconfigd_mainline socket
+unix_socket_connect(system_server, aconfigd_mainline, aconfigd_mainline);
allow system_server repair_mode_metadata_file:dir rw_dir_perms;
allow system_server repair_mode_metadata_file:file create_file_perms;