Skip to content
Snippets Groups Projects
Commit 1d1d78cc authored by Nick Kralevich's avatar Nick Kralevich Committed by android-build-merger
Browse files

Merge "Revert "Ensure /sys restrictions for isolated_apps"" am: 3e60e38a am:...

Merge "Revert "Ensure /sys restrictions for isolated_apps"" am: 3e60e38a am: 89185f5a am: 3f5bc502
am: 0011fd40

Change-Id: I24fcec7bb6943864173194a64ef7027cd52533a6
parents bf8ab686 0011fd40
No related branches found
No related tags found
No related merge requests found
...@@ -103,11 +103,3 @@ neverallow isolated_app { usb_device usbaccessory_device }:chr_file *; ...@@ -103,11 +103,3 @@ neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;
# Restrict the webview_zygote control socket. # Restrict the webview_zygote control socket.
neverallow isolated_app webview_zygote_socket:sock_file write; neverallow isolated_app webview_zygote_socket:sock_file write;
# Limit the /sys files which isolated_app can access. This is important
# for controlling isolated_app attack surface.
neverallow isolated_app {
sysfs_type
-sysfs_devices_system_cpu
-sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
}:file no_rw_file_perms;
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment