From 7263cb46039ee87c34163dd2e2de295f29eb8152 Mon Sep 17 00:00:00 2001
From: Andreas Gampe <agampe@google.com>
Date: Tue, 12 Mar 2019 10:49:16 -0700
Subject: [PATCH] Sepolicy: Give sys_admin for relabel

This requirement slipped through.

Bug: 125474642
Test: m
Test: manual
Change-Id: I8b31bda519632a549574d3057bc49a158e796e2e
---
 private/art_apex_postinstall.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/private/art_apex_postinstall.te b/private/art_apex_postinstall.te
index 314fb7c9e..40b09d21a 100644
--- a/private/art_apex_postinstall.te
+++ b/private/art_apex_postinstall.te
@@ -17,6 +17,7 @@ allow art_apex_postinstall dalvikcache_data_file:file { r_file_perms unlink rela
 
 # Required for relabel.
 allow art_apex_postinstall file_contexts_file:file r_file_perms;
+allow art_apex_postinstall self:global_capability_class_set sys_admin;
 
 # Script helpers.
 allow art_apex_postinstall shell_exec:file rx_file_perms;