Merge "Revert "Ensure /sys restrictions for isolated_apps"" am: 3e60e38a40 am: 89185f5aa8
am: 3f5bc5022b
Change-Id: I0c442961eab964595ad072ec1a4308a4cc2c6888
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 30253af..951a0df 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -103,11 +103,3 @@
# Restrict the webview_zygote control socket.
neverallow isolated_app webview_zygote_socket:sock_file write;
-
-# Limit the /sys files which isolated_app can access. This is important
-# for controlling isolated_app attack surface.
-neverallow isolated_app {
- sysfs_type
- -sysfs_devices_system_cpu
- -sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
-}:file no_rw_file_perms;