I solved this issue.
In addition to the setup I had in my description, I had to do the following to get my script to work:
- In device/myvendor/mydevice/sepolicy/file_contexts I added:
/vendor/bin/init\.cancfg\.sh u:object_r:init-cancfg-sh_exec:s0
- In device/myvendor/mydevice/sepolicy/init-cancfg-sh.te I added a new domain:
type init-cancfg-sh, domain;
type init-cancfg-sh_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(init-cancfg-sh)
allow init-cancfg-sh vendor_shell_exec:file rx_file_perms;
allow init-cancfg-sh vendor_toolbox_exec:file rx_file_perms;
- Copy the script in the device.mk file:
PRODUCT_COPY_FILES += \
$(IMX_DEVICE_PATH)/init.cancfg.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.cancfg.sh