From cc4b0c7560ebc7f9a9252f8da03bd0c703e3be40 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <natechancellor@gmail.com>
Date: Sun, 20 Nov 2016 01:17:22 -0700
Subject: [PATCH] Allow apps in /system/priv-app to call and execute su commands

This is needed for an app like masquerade on CM's su or phh's Superuser

Change-Id: I09b646535ab71e26c7eed346bdb15b1d2c8fae60
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
---

diff --git a/su.te b/su.te
index 291d30b..8558964 100644
--- a/su.te
+++ b/su.te
@@ -20,6 +20,10 @@
   # su is also permissive to permit setenforce.
   permissive su;
 
+  # Allow priv apps (like masquerade) to use su
+  allow priv_app su_exec:file { execute_no_trans getattr open read execute };
+  allow platform_app su_exec:file { execute_no_trans getattr open read execute };
+
   # Add su to various domains
   net_domain(su)
   app_domain(su)