sepolicy: add missing denials for update_engine
Change-Id: Ia35ad4759ea6c8c5390657a536289cd0ccde0ba0
diff --git a/sepolicy/private/update_engine.te b/sepolicy/private/update_engine.te
index b1ca5d1..70c37ec 100644
--- a/sepolicy/private/update_engine.te
+++ b/sepolicy/private/update_engine.te
@@ -23,6 +23,7 @@
allow update_engine sepolicy_file:file { append };
allow update_engine gsi_metadata_file:dir search;
+allow update_engine metadata_file:dir search;
allow update_engine rootfs:file { create write };
#####
allow update_engine proc_filesystems:file { getattr open read };