commit beaf040024666b48d19329d6c5ec24c119430354
author Siqi Lin <siqilin@google.com> Tue Apr 11 12:40:53 2017 -0700
committer gitbuildkicker <android-build@google.com> Tue Apr 11 17:37:26 2017 -0700
tree 1c750176fc099e76ae0a7e877b29c8f71af60032
parent e29cb73fb2ee9b90ddc54aca6f6e32d3c47bdf8d

sepolicy: Allow ramdump_app to access surfaceflinger_service

Fixes the following denial which prevents Ramdump Uploader main
activity from displaying:

SELinux : avc:  denied  { find } for service=SurfaceFlinger pid=4901
uid=10120 scontext=u:r:ramdump_app:s0:c120,c256,c512,c768
tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager

Bug: 37209981
Test: manual - open Ramdump Uploader app, see no ANR
Change-Id: I3cf8ba627a7c850639d9f8a9aad0bd15ee77f0ee
(cherry picked from commit c3ae6531b9a5d304b5c836079fdc281de5e40e62)

sepolicy/ramdump_app.te

diff --git a/sepolicy/ramdump_app.te b/sepolicy/ramdump_app.te
index 91a957f..c76eaca 100644
--- a/sepolicy/ramdump_app.te
+++ b/sepolicy/ramdump_app.te
@@ -4,6 +4,7 @@
   app_domain(ramdump_app)
 
   allow ramdump_app app_api_service:service_manager find;
+  allow ramdump_app surfaceflinger_service:service_manager find;
 
   allow ramdump_app ramdump_vendor_data_file:file create_file_perms;
   allow ramdump_app ramdump_vendor_data_file:dir create_dir_perms;