Merge "sepolicy: Allow postinstall_dexopt /vendor/app access" into oc-dev

am: 35d2a46a

Change-Id: I730360302ac12367607aa5ca8266413812ca82ab

public/domain.te

@@ -686,6 +686,7 @@ full_treble_only(`
         -idmap
         -init
         -installd
+        -postinstall_dexopt
         -system_server
     } vendor_app_file:dir { open read getattr search };
 
@@ -696,6 +697,7 @@ full_treble_only(`
         -idmap
         -init
         -installd
+        -postinstall_dexopt
         -system_server
     } vendor_app_file:{ file lnk_file } r_file_perms;
 

public/postinstall_dexopt.te

@@ -17,6 +17,8 @@ allow postinstall_dexopt tmpfs:file read;
 
 # Read app data (APKs) as input to dex2oat.
 r_dir_file(postinstall_dexopt, apk_data_file)
+# Read vendor app data (APKs) as input to dex2oat.
+r_dir_file(postinstall_dexopt, vendor_app_file)
 # Access to app oat directory.
 r_dir_file(postinstall_dexopt, dalvikcache_data_file)