Strengthen ptrace neverallow rules
Add additional compile time constraints on the ability to ptrace various
sensitive domains.
llkd: remove some domains which llkd should never ptrace, even on
debuggable builds, such as kernel threads and init.
crash_dump neverallows: Remove the ptrace neverallow checks because
it duplicates other neverallow assertions spread throughout the policy.
Test: policy compiles and device boots
Change-Id: Ia4240d1ce7143b983bb048e046bb4729d0af5a6e
diff --git a/private/llkd.te b/private/llkd.te
index 73e3f58..900d403 100644
--- a/private/llkd.te
+++ b/private/llkd.te
@@ -22,9 +22,12 @@
userdebug_or_eng(`
allow llkd {
domain
+ -kernel
-keystore
-init
-llkd
+ -ueventd
+ -vendor_init
}:process ptrace;
')