Merge "Enable per-user isolation for normal apps."
diff --git a/app.te b/app.te
index 1fb53e6..2a6b270 100644
--- a/app.te
+++ b/app.te
@@ -316,8 +316,8 @@
{ create write setattr relabelfrom relabelto append unlink link rename };
# Access to factory files.
-neverallow appdomain
- efs_file:dir_file_class_set { read write };
+neverallow appdomain efs_file:dir_file_class_set write;
+neverallow { appdomain -shell } efs_file:dir_file_class_set read;
# Write to various pseudo file systems.
neverallow { appdomain -bluetooth -nfc }
diff --git a/su.te b/su.te
index 73ca514..6870684 100644
--- a/su.te
+++ b/su.te
@@ -5,7 +5,7 @@
# Domain used for su processes, as well as for adbd and adb shell
# after performing an adb root command. The domain definition is
# wrapped to ensure that it does not exist at all on -user builds.
- type su, domain;
+ type su, domain, mlstrustedsubject;
domain_auto_trans(shell, su_exec, su)
# Allow dumpstate to call su on userdebug / eng builds to collect