commit 34145c751eff4c5aa61379bea8bfadeb03f27bc0
author android-build-prod (mdb) <android-build-team-robot@google.com> Fri Jun 15 21:50:30 2018 +0000
committer android-build-prod (mdb) <android-build-team-robot@google.com> Fri Jun 15 21:50:30 2018 +0000
tree d8f75fb8207504414c683f9b35762a77011df545
parent 40dcb852998e9717736e9b6614cba867ed0d392a
parent d53f0737d145ff064314082b6cd818e1bb439b73

Snap for 4841225 from d53f0737d145ff064314082b6cd818e1bb439b73 to oreo-cts-release

Change-Id: I87f8d5fff724688a8fec42c7335fa41001f5d033

public/domain.te

diff --git a/public/domain.te b/public/domain.te
index d2b370a..acbae69 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -691,6 +691,7 @@
         -installd
         -postinstall_dexopt
         -system_server
+        -mediaserver
     } vendor_app_file:{ file lnk_file } r_file_perms;
 
     # Limit access to /vendor/overlay

public/mediaserver.te

diff --git a/public/mediaserver.te b/public/mediaserver.te
index 6efaf0f..93783fb 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -102,6 +102,9 @@
 allow mediaserver oemfs:dir search;
 allow mediaserver oemfs:file r_file_perms;
 
+# /vendor apk access
+allow mediaserver vendor_app_file:file r_file_perms;
+
 use_drmservice(mediaserver)
 allow mediaserver drmserver:drmservice {
     consumeRights