commit b1fa082a8818f6eb451940d5e083fc01e69f018d
author Nick Kralevich <nnk@google.com> Wed Oct 04 13:16:09 2017 -0700
committer Nick Kralevich <nnk@google.com> Wed Oct 04 13:16:09 2017 -0700
tree 6f257b05fa84e92a549bb5022cbf37dd4f62f206
parent 44063c647bdd327ec5213f9c86b1cd28e198c1dc

Remove sysfs_soc from isolated_app

isolated_apps are strictly limited in the /sys files which can be read.
Remove isolated_app access to a disallowed /sys file.

Test: policy compiles.
Change-Id: I04163253d1c004b714da3fb8b23419c8e802f15e

sepolicy/app.te

diff --git a/sepolicy/app.te b/sepolicy/app.te
index 4286547..b099712 100644
--- a/sepolicy/app.te
+++ b/sepolicy/app.te
@@ -2,5 +2,5 @@
 allowxperm { appdomain -isolated_app } gpu_device:chr_file
   ioctl { gpu_ioctls unpriv_tty_ioctls };
 
-allow appdomain sysfs_soc:dir search;
-allow appdomain sysfs_soc:file r_file_perms;
+allow { appdomain -isolated_app } sysfs_soc:dir search;
+allow { appdomain -isolated_app } sysfs_soc:file r_file_perms;