9.0 ota user版本升级失败，debug升级成功

公司自己做的ota升级apk，下载升级包升级时，提示package compatibility verification failed；
不同的ota apk报的错可能不一样，log应该都是一样的；9.0对权限的管理比较严格。
avc: denied { read } for name=“config.gz” dev=“proc” ino=4026532109 scontext=u:r:system_app:s0 tcontext=u:object_r:config_gz:s0 tclass=file permissive=0

报的权限问题基本是一样的，但是object_r:config_gz ；config_gz 名称，还有 tclass=file的类型；scontext=u:r:system_app: 这个是需要在哪里加权限；上面这个是缺少read权限。
网上查看是在device/XXX/sepolicy/basic/non_plat/system_app.te 中；有些权限可以在这里加，但是上面config_gz和 selinuxfs可能是私有的，不能在device下面定义；

正确是 在system/sepolicy/private/system_app.te
+allow system_app config_gz:file { read open };
+allow system_app selinuxfs:file { read open };

下面是报错的log

09-17 09:42:12.229  1352  1352 W View    : requestLayout() improperly called by android.widget.TextView{d12a5a7 V.ED..... ......ID 861,-198-1059,-155 #7f0a0354 app:id/system_year_day} during second layout pass: posting in next frame
09-17 09:42:12.236  2510  2839 E libvintf: Could not open /proc/config.gz: 13
09-17 09:42:12.236  2510  2839 W libvintf: Cannot fetch or parse /proc/config.gz: Permission denied
09-17 09:42:12.229  2510  2510 W RxCachedThreadS: type=1400 audit(0.0:258): avc: denied { read } for name="config.gz" dev="proc" ino=4026532109 scontext=u:r:system_app:s0 tcontext=u:object_r:config_gz:s0 tclass=file permissive=0
09-17 09:42:12.236  2510  2839 W libvintf: Cannot fetch or parse kernel sepolicy version: Operation not permitted
09-17 09:42:12.233  2510  2510 W RxCachedThreadS: type=1400 audit(0.0:259): avc: denied { read } for name="policyvers" dev="selinuxfs" ino=10 scontext=u:r:system_app:s0 tcontext=u:object_r:selinuxfs:s0 tclass=file permissive=0
09-17 09:42:12.240  2510  2839 W VintfObject: VintfObject.verify() returns 1: Runtime info and framework compatibility matrix are incompatible: kernelSepolicyVersion = 0 but required >= 30
09-17 09:42:12.241  2510  2839 W System.err: java.security.SignatureException: package compatibility verification failed
09-17 09:42:12.241  2510  2839 W System.err: 	at android.os.RecoverySystem.verifyPackage(RecoverySystem.java:352)
09-17 09:42:12.241  2510  2839 W System.err: 	at com.neostra.systemsettiing.ui.service.DownloadService.verify(DownloadService.java:181)
09-17 09:42:12.241  2510  2839 W System.err: 	at com.neostra.systemsettiing.ui.service.DownloadService.access$1100(DownloadService.java:50)
09-17 09:42:12.241  2510  2839 W System.err: 	at com.neostra.systemsettiing.ui.service.DownloadService$5.accept(DownloadService.java:237)
09-17 09:42:12.241  2510  2839 W System.err: 	at com.neostra.systemsettiing.ui.service.DownloadService$5.accept(DownloadService.java:231)
09-17 09:42:12.241  2510  2839 W System.err: 	at io.reactivex.internal.subscribers.LambdaSubscriber.onNext(LambdaSubscriber.java:62)
09-17 09:42:12.241  2510  2839 W System.err: 	at io.reactivex.internal.operators.flowable.FlowableObserveOn$ObserveOnSubscriber.runAsync(FlowableObserveOn.java:400)
09-17 09:42:12.241  2510  2839 W System.err: 	at io.reactivex.internal.operators.flowable.FlowableObserveOn$BaseObserveOnSubscriber.run(FlowableObserveOn.java:176)
09-17 09:42:12.241  2510  2839 W System.err: 	at io.reactivex.internal.schedulers.ScheduledRunnable.run(ScheduledRunnable.java:61)
09-17 09:42:12.241  2510  2839 W System.err: 	at io.reactivex.internal.schedulers.ScheduledRunnable.call(ScheduledRunnable.java:52)
09-17 09:42:12.241  2510  2839 W System.err: 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
09-17 09:42:12.241  2510  2839 W System.err: 	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:301)
09-17 09:42:12.241  2510  2839 W System.err: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
09-17 09:42:12.241  2510  2839 W System.err: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
09-17 09:42:12.241  2510  2839 W System.err: 	at java.lang.Thread.run(Thread.java:764)