Could we set them as "mlstrustedsubject"?

[Haiqing Jiang <hqjiang1988@xxxxxxxxx>]

Hi, all

Currently I am testing Android CTS in SEAndroid. I find several denials are related to MLS constraints. The key-signed apps, like "platform_app", "release_app",

"browser_app", "shared_app" and "media_app", need to open app_data_file. But because of MLS, they cannot do that. So, could we sign them as mlstrusted? 

Currently only daemons are set "mlstrustedsubject". Do you have any ideas? Or the better solutions to solve the denials? 

Thanks,

--

-----------------------------------

Haiqing Jiang, PH.D student

Computer Science Department, North Carolina State University