Merge "Revert "Ensure /sys restrictions for isolated_apps""

am: 3e60e38a

Change-Id: I08ed6727590cac42f6440f2462041368fc4544e2

private/isolated_app.te

@@ -103,11 +103,3 @@ neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;
 
 # Restrict the webview_zygote control socket.
 neverallow isolated_app webview_zygote_socket:sock_file write;
-
-# Limit the /sys files which isolated_app can access. This is important
-# for controlling isolated_app attack surface.
-neverallow isolated_app {
-  sysfs_type
-  -sysfs_devices_system_cpu
-  -sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
-}:file no_rw_file_perms;