omni: Make A/B backuptool permissive

Change-Id: Ib1f52f40dab26ac4575e06bfd54b88809b00f8d3
diff --git a/sepolicy/private/update_engine.te b/sepolicy/private/update_engine.te
index 912729d..e5f7152 100644
--- a/sepolicy/private/update_engine.te
+++ b/sepolicy/private/update_engine.te
@@ -39,3 +39,6 @@
 allow update_engine update_engine:capability { kill };
 allow update_engine otadexopt_service:service_manager find;
 binder_call(update_engine, platform_app)
+
+# Allow transition to backuptool domain
+domain_trans(update_engine, otapreopt_chroot_exec, backuptool)