Add functionfs access to system_server.

am: 1d401545

Change-Id: I7502e6ff1e45c12340b9f830bcc245fd2c80996e

private/domain.te

@@ -105,7 +105,8 @@ full_treble_only(`
     -adbd
     -init
     -mediaprovider
-  }functionfs:file no_rw_file_perms;
+    -system_server
+  } functionfs:file no_rw_file_perms;
 
   # usbfs and binfmt_miscfs
   neverallow {

private/system_server.te

@@ -761,6 +761,10 @@ userdebug_or_eng(`
   allow system_server mediaextractor_update_service:service_manager find;
 ')
 
+# UsbDeviceManager uses /dev/usb-ffs
+allow system_server functionfs:dir search;
+allow system_server functionfs:file rw_file_perms;
+
 ###
 ### Neverallow rules
 ###