Allow typical app domains to measure fs-verity on data file
Bug: 285185747
Test: Call installd from a local client
Change-Id: I93a9ffae5d1530dd9ddbc9504784701c7f962445
diff --git a/private/app.te b/private/app.te
index 3f8560a..466986c 100644
--- a/private/app.te
+++ b/private/app.te
@@ -259,6 +259,7 @@
# App sandbox file accesses.
allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } { app_data_file privapp_data_file }:dir create_dir_perms;
allow { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } { app_data_file privapp_data_file }:file create_file_perms;
+allowxperm { appdomain -isolated_app_all -mlstrustedsubject -sdk_sandbox_all } { app_data_file privapp_data_file }:file ioctl FS_IOC_MEASURE_VERITY;
# Access via already open fds is ok even for mlstrustedsubject.
allow { appdomain -isolated_app_all -sdk_sandbox_all } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write };