release-request-8a6a1d17-d673-453b-8612-ea961499cd38-for-aosp-oreo-cts-release-4341710 snap-temp-L24800000103383547
Change-Id: I544f264b42348f4795d4b8b1f70f47ed81b6be43
diff --git a/public/netd.te b/public/netd.te
index 691887f..85a4f7d 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -104,7 +104,9 @@
# Write to files in /data/data or system files on /data
neverallow netd { app_data_file system_data_file }:dir_file_class_set write;
-# only system_server, dumpstate and netd may interact with netd over binder
+# only system_server and dumpstate may find netd service
neverallow { domain -system_server -dumpstate -netd } netd_service:service_manager find;
-neverallow { domain -system_server -dumpstate } netd:binder call;
-neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;
+
+neverallow appdomain netd:binder call;
+neverallow netd { appdomain userdebug_or_eng(`-su') }:binder call;
+
