incident_service: only disallow untrusted access
Allow device-specific domains to access the incident_service.
Test: build
Bug: 156479626
Change-Id: I3b368c09087e2d3542b70be5aa22f8ef47392221
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 66e9f69..1157187 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -257,3 +257,6 @@
-untrusted_app_25
-untrusted_app_27
} mnt_sdcard_file:lnk_file *;
+
+# Only privileged apps may find the incident service
+neverallow all_untrusted_apps incident_service:service_manager find;
diff --git a/private/incidentd.te b/private/incidentd.te
index 405684a..656f69f 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -179,21 +179,6 @@
###
### neverallow rules
###
-
-# only specific domains can find the incident service
-neverallow {
- domain
- -dumpstate
- -incident
- -incidentd
- -perfetto
- -permissioncontroller_app
- -priv_app
- -statsd
- -system_app
- -system_server
-} incident_service:service_manager find;
-
# only incidentd and the other root services in limited circumstances
# can get to the files in /data/misc/incidents
#