Suppress denials for apps accessing storage too early

The recommended solution is to not access encrypted storage until
after the ACTION_USER_UNLOCKED intent is delivered.

Test: build
Fixes: 72811052
Fixes: 72550646
Change-Id: I80eb743e26047b7864de983c5a46c28b6f753a59

private/bug_map

@@ -29,7 +29,6 @@ platform_app nfc_data_file dir 74331887
 postinstall postinstall capability 77958490
 postinstall_dexopt postinstall_dexopt capability 77958490
 postinstall_dexopt user_profile_data_file file 77958490
-priv_app system_data_file dir 72811052
 profman apk_data_file dir 77922323
 radio statsdw_socket sock_file 78456764
 statsd hal_health_default binder 77919007
@@ -38,7 +37,5 @@ system_server crash_dump process 73128755
 system_server logd_socket sock_file 64734187
 system_server sdcardfs file 77856826
 system_server zygote process 77856826
-untrusted_app_25 system_data_file dir 72550646
-untrusted_app_27 system_data_file dir 72550646
 usbd usbd capability 72472544
 zygote untrusted_app_25 process 77925912

private/priv_app.te

@@ -182,6 +182,12 @@ dontaudit priv_app { wifi_prop exported_wifi_prop }:file read;
 allow priv_app system_server:udp_socket {
         connect getattr read recvfrom sendto write getopt setopt };
 
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Suppress this
+# denial to prevent apps from spamming the logs.
+dontaudit priv_app system_data_file:dir write;
+
 ###
 ### neverallow rules
 ###

private/untrusted_app_all.te

@@ -150,3 +150,9 @@ userdebug_or_eng(`
     -proc_net_vpn
   }:{ dir file lnk_file } { getattr open read };
 ')
+
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Suppress this
+# denial to prevent third party apps from spamming the logs.
+dontaudit untrusted_app_all system_data_file:dir write;