Merge "DO NOT MERGE. Remove isolated_app's ability to read sysfs." into nyc-dev
diff --git a/domain_deprecated.te b/domain_deprecated.te
index e5bfb1c..00fb516 100644
--- a/domain_deprecated.te
+++ b/domain_deprecated.te
@@ -54,7 +54,7 @@
# Read access to pseudo filesystems.
r_dir_file(domain_deprecated, proc)
-r_dir_file(domain_deprecated, sysfs)
+r_dir_file({ domain_deprecated -isolated_app }, sysfs)
r_dir_file(domain_deprecated, inotify)
r_dir_file(domain_deprecated, cgroup)
allow domain_deprecated proc_meminfo:file r_file_perms;