Merge "RESTRICT AUTOMERGE: lowpan: Add neverallow rule for lowpan_device" into oc-mr1-iot-dev

public/hal_lowpan.te

@@ -12,3 +12,10 @@ set_prop(hal_lowpan_server, lowpan_prop)
 
 # Allow hal_lowpan_server to open lowpan_devices
 allow hal_lowpan_server lowpan_device:chr_file rw_file_perms;
+
+###
+### neverallow rules
+###
+
+# Only LoWPAN HAL may directly access LoWPAN hardware
+neverallow { domain -hal_lowpan_server -init -ueventd } lowpan_device:chr_file ~getattr;