Merge "appdomain: neverallow direct input_device access"

9cc3a580 · Treehugger Robot · Gerrit Code Review · 5423db6e · e83b9f03 · 9cc3a580
Commit 9cc3a580 authored 8 years ago by Treehugger Robot Committed by Gerrit Code Review 8 years ago
--- a/app.te
+++ b/app.te
@@ -405,3 +405,9 @@ neverallow appdomain {
  system_file
  tmpfs
 }:lnk_file no_w_file_perms;
+
+# Applications should use the activity model for receiving events
+neverallow {
+  appdomain
+  -shell # bugreport
+} input_device:chr_file ~getattr;