sepolicy: Allow system_app to run su_exec()

Change-Id: I56f83cc4896de75165e010d12ff38525015e8e54

1 files changed, 1 insertions, 1 deletions

diff --git a/domain.te b/domain.te
index db19da3..8f600ae 100644
--- a/domain.te
+++ b/domain.te
@@ -401,7 +401,7 @@ neverallow domain { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file
 # Nobody should be able to execute su on user builds.
 # On userdebug/eng builds, only dumpstate, shell, and
 # su itself execute su.
-neverallow { domain userdebug_or_eng(`-dumpstate -shell -su -init -untrusted_app -sudaemon') } su_exec:file no_x_file_perms;
+neverallow { domain userdebug_or_eng(`-dumpstate -shell -su -init -untrusted_app -system_app -sudaemon') } su_exec:file no_x_file_perms;
 
 # Do not allow the introduction of new execmod rules. Text relocations
 # and modification of executable pages are unsafe.