Merge "DO NOT MERGE. Remove isolated_app's ability to read sysfs." into nyc-dev

1a5fcecc · TreeHugger Robot · Android (Google) Code Review · 95fd3816 · b84c86b2 · 1a5fcecc
Commit 1a5fcecc authored 8 years ago by TreeHugger Robot Committed by Android (Google) Code Review 8 years ago
--- a/domain_deprecated.te
+++ b/domain_deprecated.te
@@ -54,7 +54,7 @@ allow domain_deprecated ion_device:chr_file rw_file_perms;

 # Read access to pseudo filesystems.
 r_dir_file(domain_deprecated, proc)
-r_dir_file(domain_deprecated, sysfs)
+r_dir_file({ domain_deprecated -isolated_app }, sysfs)
 r_dir_file(domain_deprecated, inotify)
 r_dir_file(domain_deprecated, cgroup)
 allow domain_deprecated proc_meminfo:file r_file_perms;