domain: strengthen system_app sandbox neverallow

am: 1cf262da

* commit '1cf262da':
  domain: strengthen system_app sandbox neverallow

Change-Id: I498d85343ccc49407edefc520fa5e78566ac597a

domain.te

@@ -425,7 +425,7 @@ neverallow {
   -system_app # its own sandbox
   -system_server #populate com.android.providers.settings/databases/settings.db.
   -installd # creation of app sandbox
-} system_app_data_file:dir_file_class_set { create unlink };
+} system_app_data_file:dir_file_class_set { create unlink open };
 
 #
 # Only these domains should transition to shell domain. This domain is