tree 5e2a489fa67f0b3ef28f267d72215f7589e4ca8d
parent 5e33b84202984df2ba41a3499fd3e6d4c595939c
author Felix <google@ix5.org> 1547592215 +0100
committer Jon West <electrikjesus@gmail.com> 1549225434 -0500

sepolicy: Fix init denials

init.local.rc(a.k.a. init.omni.rc on-device) needs to write disk
schedulers.
It also wants mount debugfs, but only allow that on debug builds.

avc: denied { mounton } for comm="init" path="/sys/kernel/debug" \
  dev="debugfs" ino=1 scontext=u:r:init:s0 tcontext=u:object_r:debugfs:s0 tclass=dir
avc: denied { setattr } for name="scheduler" dev="sysfs" ino=45146 \
  scontext=u:r:init:s0 tcontext=u:object_r:sysfs:s0 tclass=file

Change-Id: I68e8dd982504c4673947d73119fa342f7fcd943b