Merge "Remove sys/class/leds permissions from dumpstate."
diff --git a/private/system_server.te b/private/system_server.te
index 7d7a1a6..46becd0 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -706,13 +706,6 @@
r_dir_file(system_server, rootfs)
-### Rules needed when Light HAL runs inside system_server process.
-### These rules should eventually be granted only when needed.
-allow system_server sysfs_leds:lnk_file read;
-allow system_server sysfs_leds:file rw_file_perms;
-allow system_server sysfs_leds:dir r_dir_perms;
-###
-
# Allow WifiService to start, stop, and read wifi-specific trace events.
allow system_server debugfs_tracing_instances:dir search;
allow system_server debugfs_wifi_tracing:dir search;
diff --git a/public/domain.te b/public/domain.te
index ec0532d..f9b6688 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1114,3 +1114,16 @@
# be passthrough only (i.e., run in the process of their clients instead of a
# separate server process).
neverallow * same_process_hwservice:hwservice_manager add;
+
+# On TREBLE devices, most coredomains should not access vendor_files.
+full_treble_only(`
+ neverallow {
+ coredomain
+ -halclientdomain
+ -init
+ -ueventd
+ -crash_dump
+ -perfprofd
+ -vendor_init
+ } vendor_file:file { create_file_perms x_file_perms };
+')