Add search capability to sysfs for mpdecision sepolicy.
A prior patch forgot to include the ability to search
the parent directories for certain sysfs_devices_system_cpu
labeled files. The addition to the policy addresses the
following denial.
denied { search } for pid=204 comm="mpdecision" name="rq-stats" dev="sysfs" ino=17679 scontext=u:r:mpdecision:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir
Change-Id: I8ea94711a31690289ea1cd37e622508ecebc0d2f
diff --git a/sepolicy/mpdecision.te b/sepolicy/mpdecision.te
index e6f39c3..593d92b 100644
--- a/sepolicy/mpdecision.te
+++ b/sepolicy/mpdecision.te
@@ -18,4 +18,5 @@
# By-product of setting owner on sock_file (don't allow)
dontaudit mpdecision self:capability fsetid;
+allow mpdecision sysfs_devices_system_cpu:dir search;
allow mpdecision sysfs_devices_system_cpu:file { open read write getattr };
