commit a907d15ba179376ff87eb39ab3a9101b3dc22d0d
author Treehugger Robot <treehugger-gerrit@google.com> Thu Mar 14 17:20:18 2019 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Thu Mar 14 17:20:18 2019 +0000
tree 839d0c0b8934223741b65b45647a5f5314040dd4
parent ecc7e8cacb6277f1a98c6af87d255e9aa6651cad
parent 6cd179f99258b19cc9ba75c64d1450fc72a479b8

Merge "Sepolicy: Fix APEX boot integrity"

private/art_apex_boot_integrity.te

diff --git a/private/art_apex_boot_integrity.te b/private/art_apex_boot_integrity.te
index 14feee6..2ac9140 100644
--- a/private/art_apex_boot_integrity.te
+++ b/private/art_apex_boot_integrity.te
@@ -1,5 +1,5 @@
-# This command set moves the artifact corresponding to the current slot
-# from /data/ota to /data/dalvik-cache.
+# This command set checks the integrity of boot classpath ART
+# artifacts in /data, potentially removing them.
 
 type art_apex_boot_integrity, domain, coredomain;
 type art_apex_boot_integrity_exec, system_file_type, exec_type, file_type;
@@ -23,7 +23,7 @@
 # Fsverity in the same domain.
 allow art_apex_boot_integrity system_file:file execute_no_trans;
 # Fsverity work.
-allowxperm art_apex_boot_integrity ota_data_file:file ioctl {
+allowxperm art_apex_boot_integrity dalvikcache_data_file:file ioctl {
   FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
 };