Remove exemptions for domains accessing zoneinfo
/data/misc/zoneinfo is provided by libc and is considered to be
VNDK stable. Remove neverallow exemptions granted to domains
accessing zoneinfo since all domains may access it.
Bug: 36730929
Test: Marlin Policy builds
Change-Id: I88c8436b1a6df48a783bfac85cfb2f88b5c066a6
diff --git a/sepolicy/cnss_diag.te b/sepolicy/cnss_diag.te
index 031c4be..3efdef0 100644
--- a/sepolicy/cnss_diag.te
+++ b/sepolicy/cnss_diag.te
@@ -12,10 +12,6 @@
# b/35877764 suppress the udp_socket denial message temproarily
dontaudit cnss_diag self:udp_socket create;
-# TODO(b/36730929): Remove this once cnss_diag no longer accesses data outside
-# /data/vendor
-typeattribute cnss_diag coredata_in_vendor_violators;
-r_dir_file(cnss_diag, zoneinfo_data_file)
userdebug_or_eng(`
allow cnss_diag diag_device:chr_file rw_file_perms;
allow cnss_diag cnss_diag_data_file:dir create_dir_perms;
diff --git a/sepolicy/netmgrd.te b/sepolicy/netmgrd.te
index 620354c..0b9ceb7 100644
--- a/sepolicy/netmgrd.te
+++ b/sepolicy/netmgrd.te
@@ -21,7 +21,7 @@
allow netmgrd self:capability { net_admin net_raw setgid setpcap setuid };
-# TODO(b/36663482, b/36730929): Remove coredata_in_vendor_violators once
+# TODO(b/36663482): Remove coredata_in_vendor_violators once
# netmgrd no longer directly accesses /data outside
# /data/vendor.
typeattribute netmgrd coredata_in_vendor_violators;
@@ -33,7 +33,6 @@
allow netmgrd netmgr_data_file:dir rw_dir_perms;
allow netmgrd netmgr_data_file:file create_file_perms;
')
-r_dir_file(netmgrd, zoneinfo_data_file)
# execute shell, ip, and toolbox
allow netmgrd shell_exec:file rx_file_perms;
diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index ce0c1fd..a3fe7df 100644
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -29,8 +29,3 @@
# TODO(b/36613472): Remove this once system_server, mediaserver, bluetooth, and radio no longer
# communicate with rild over sockets.
typeattribute rild socket_between_core_and_vendor_violators;
-
-# TODO(b/36730929): Remove this once time daemon no longer access data outside
-# /data/vendor
-typeattribute rild coredata_in_vendor_violators;
-r_dir_file(rild, zoneinfo_data_file)
diff --git a/sepolicy/time.te b/sepolicy/time.te
index 4fef476..e8c596b 100644
--- a/sepolicy/time.te
+++ b/sepolicy/time.te
@@ -16,10 +16,6 @@
allow time sysfs_soc:dir search;
allow time sysfs_soc:file r_file_perms;
-# TODO(b/36730929): Remove this once time daemon no longer access data outside
-# /data/vendor
-typeattribute time coredata_in_vendor_violators;
-r_dir_file(time, zoneinfo_data_file)
allow time time_data_file:file create_file_perms;
allow time time_data_file:dir rw_dir_perms;
