From dcec3ee905fce89317d77baf314e235036c39b69 Mon Sep 17 00:00:00 2001
From: Jeff Vander Stoep <jeffv@google.com>
Date: Wed, 19 Jul 2017 12:54:59 -0700
Subject: [PATCH] runas: grant access to seapp_contexts files

To be replaced by commit 1e149967a
seapp_context: explicitly label all seapp context files

Test: build policy
Change-Id: I8d30bd1d50b9e4a55f878c25d134907d4458cf59
Merged-In: I0f0e937e56721d458e250d48ce62f80e3694900f
---
 public/runas.te | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/public/runas.te b/public/runas.te
index e56a9e76b..54c94c26b 100644
--- a/public/runas.te
+++ b/public/runas.te
@@ -25,6 +25,10 @@ selinux_check_context(runas) # validate context
 allow runas self:process setcurrent;
 allow runas non_system_app_set:process dyntransition; # setcon
 
+# Grant access to seapp_contexts files
+# To be replaced by seapp_contexts_file label from commit 1e149967a
+allow runas rootfs:file r_file_perms;
+
 ###
 ### neverallow rules
 ###