tree ccd1231aac44bfab3e7b1e433ab32b0618256339
parent ff40f150e847033dfcef5e631d34f068cc3a2bc8
author Mike Ma <yanmin@google.com> 1581454596 -0800
committer Mike Ma <yanmin@google.com> 1582091500 -0800

Fix selinux denials for incidentd

This is to fix selinux denials on incident-helper-cmd.
incident-helper-cmd is a Java program spawn from app_process. There are
currently some selinux denials because app_process tries to read boot
flags, read dalvik cache, run JIT and exec from JIT cache.

This change:
- allows incidentd to read the runtime feature flag properties. This is
a normal behavior during app_process startup
- allows incidentd to lock a few java libraries under
/apex/com.android.art. Again, this is normal when ART starts
- mutes denial of writing to and exec from dalvik cache / JIT cache

Fixes: 149011438
Test: Run $ incident 1116, and verify there's no selinux denial
Change-Id: I95a6b93e6a5510c749bebe7ecbcab9a803be0801