Merge "Ensure /sys restrictions for isolated_apps" am: eb1ae188 am: a2cf96bc am: 1e6ca6fa

am: 91f41549

Change-Id: Ibf551367a0a6393ddf45c1e347e011a8a24627d4

private/isolated_app.te

@@ -103,3 +103,11 @@ neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;
 
 # Restrict the webview_zygote control socket.
 neverallow isolated_app webview_zygote_socket:sock_file write;
+
+# Limit the /sys files which isolated_app can access. This is important
+# for controlling isolated_app attack surface.
+neverallow isolated_app {
+  sysfs_type
+  -sysfs_devices_system_cpu
+  -sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
+}:file no_rw_file_perms;