tree 058ddc855e32430113f430655b0a7eaa616a740a
parent a1bc50fde53cc8582142ee360ee3abcb5505ca98
author Felix <google@ix5.org> 1547592215 +0100
committer Felix <google@ix5.org> 1547592215 +0100

sepolicy: Fix init denials

init.local.rc(a.k.a. init.omni.rc on-device) needs to write disk
schedulers.
It also wants mount debugfs, but only allow that on debug builds.

avc: denied { mounton } for comm="init" path="/sys/kernel/debug" \
  dev="debugfs" ino=1 scontext=u:r:init:s0 tcontext=u:object_r:debugfs:s0 tclass=dir
avc: denied { setattr } for name="scheduler" dev="sysfs" ino=45146 \
  scontext=u:r:init:s0 tcontext=u:object_r:sysfs:s0 tclass=file

Change-Id: I68e8dd982504c4673947d73119fa342f7fcd943b