Restrict access to suspend control
Test: m selinux_policy
Change-Id: Ieccfd2aa059da065ace4f2db1b9634c52dd2cb24
diff --git a/private/system_suspend.te b/private/system_suspend.te
index 1ed24bb..e93a73d 100644
--- a/private/system_suspend.te
+++ b/private/system_suspend.te
@@ -9,3 +9,12 @@
# Access to /sys/power/{ wakeup_count, state } suspend interface.
allow system_suspend sysfs_power:file rw_file_perms;
+
+neverallow {
+ domain
+ -atrace # tracing
+ -dumpstate # bug reports
+ -system_suspend # implements system_suspend_control_service
+ -system_server # configures system_suspend via ISuspendControlService
+ -traceur_app # tracing
+} system_suspend_control_service:service_manager find;