neverallow /data/anr access for isolated/untrusted apps

Add a neverallow rule (compile time assertion + CTS test) that
isolated_apps and untrusted_apps can't do anything else but append
to /data/anr/traces.txt. In particular, assert that they can't
read from the file, or overwrite other data which may already be
in the file.

Bug: 18340553
Bug: 27853304
Change-Id: I249fe2a46401b660efaa3f1102924a448ed750d5

isolated_app.te

@@ -39,6 +39,12 @@ neverallow isolated_app property_type:property_service set;
 # Isolated apps should not directly open app data files themselves.
 neverallow isolated_app app_data_file:file open;
 
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+# TODO: are there situations where isolated_apps write to this file?
+# TODO: should we tighten these restrictions further?
+neverallow isolated_app anr_data_file:file ~{ open append };
+neverallow isolated_app anr_data_file:dir ~search;
+
 # b/17487348
 # Isolated apps can only access two services,
 # activity_service and display_service

untrusted_app.te

@@ -172,3 +172,7 @@ neverallow untrusted_app {
 
 # Do not allow untrusted_app to directly open tun_device
 neverallow untrusted_app tun_device:chr_file open;
+
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+neverallow untrusted_app anr_data_file:file ~{ open append };
+neverallow untrusted_app anr_data_file:dir ~search;