gsid: Remove redundant neverallow rules
These neverallow rules have grown over the years, and there are now some
duplicated rules. For example,
neverallow scon tcon:tcls ~{ read };
really isn't doing anything due to the
neverallow scon tcon:tcls *;
banning every actions already.
Remove these rules to make them more manageable, and make the follow-up
changes simpler to review.
Bug: 181110285
Test: Build pass
Change-Id: I82f2bbb54436153507b451a61b3075f223522028
diff --git a/private/gsid.te b/private/gsid.te
index 56def1d..c523731 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -168,7 +168,13 @@
-gsid
-fastbootd
-vold
-} gsi_metadata_file:file_class_set ~{ relabelto getattr };
+} gsi_metadata_file:file_class_set *;
+
+neverallow {
+ domain
+ -init
+ -gsid
+} gsi_data_file:dir *;
neverallow {
domain
@@ -176,19 +182,7 @@
-gsid
-fastbootd
-vold
-} { gsi_data_file gsi_metadata_file }:file_class_set *;
-
-neverallow {
- domain
- -gsid
- -init
-} gsi_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
-
-neverallow {
- domain
- -init
- -gsid
-} gsi_data_file:dir *;
+} gsi_data_file:file_class_set *;
neverallow {
domain