Merge "DO NOT MERGE. Remove isolated_app\'s ability to read sysfs." into nyc-dev

am: 1a5fcecc

* commit '1a5fcecc':
  DO NOT MERGE. Remove isolated_app's ability to read sysfs.

Change-Id: I145b5ecc3ea1ce1c1515842b689e5129d4cc7fe2

domain_deprecated.te

@@ -53,7 +53,7 @@ allow domain_deprecated ion_device:chr_file rw_file_perms;
 
 # Read access to pseudo filesystems.
 r_dir_file(domain_deprecated, proc)
-r_dir_file(domain_deprecated, sysfs)
+r_dir_file({ domain_deprecated -isolated_app }, sysfs)
 r_dir_file(domain_deprecated, inotify)
 r_dir_file(domain_deprecated, cgroup)
 allow domain_deprecated proc_meminfo:file r_file_perms;