From de41b3d900976abb8351fdb09ec7f474fd892c85 Mon Sep 17 00:00:00 2001
From: Calin Juravle <calin@google.com>
Date: Tue, 12 Jan 2016 11:15:55 -0800
Subject: [PATCH] Allow dex2oat to acess profile files

Bug: 26080105
Change-Id: I8075d093bb5adc3d856033be3b3aaa38254e8071
---
 dex2oat.te | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dex2oat.te b/dex2oat.te
index 83a7c8af5..42abb55d7 100644
--- a/dex2oat.te
+++ b/dex2oat.te
@@ -1,5 +1,5 @@
 # dex2oat
-type dex2oat, domain, domain_deprecated;
+type dex2oat, domain, mlstrustedsubject, domain_deprecated;
 type dex2oat_exec, exec_type, file_type;
 
 allow dex2oat dalvikcache_data_file:file write;
@@ -14,3 +14,6 @@ allow dex2oat asec_apk_file:file read;
 allow dex2oat unlabeled:file read;
 allow dex2oat oemfs:file read;
 allow dex2oat apk_tmp_file:file read;
+allow dex2oat app_data_file:file {read write lock};
+
+neverallow dex2oat app_data_file:notdevfile_class_set open;