Prevent sandbox executing from sdk_sandbox_data_file
Bug: 215105355
Test: make
Change-Id: I73c6a0d5034f194bf7149336fdac1db51a2b151d
diff --git a/private/sdk_sandbox.te b/private/sdk_sandbox.te
index b18b7dd..029be53 100644
--- a/private/sdk_sandbox.te
+++ b/private/sdk_sandbox.te
@@ -47,7 +47,7 @@
### neverallow rules
###
-neverallow sdk_sandbox { app_data_file privapp_data_file }:file { execute execute_no_trans };
+neverallow sdk_sandbox { app_data_file privapp_data_file sdk_sandbox_data_file }:file { execute execute_no_trans };
# Receive or send uevent messages.
neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *;