sepolicy/private/priv_app.te

allow priv_app ota_package_file:dir create_dir_perms;
allow priv_app kernel:system syslog_read;

allow priv_app update_engine_service:service_manager find;
allow priv_app update_engine:binder { call transfer };