Neverallow app open access to /dev/ashmem

Apps are no longer allowed open access to /dev/ashmem, unless they
target API level < Q.

Bug: 113362644
Test: device boots, Chrome, instant apps work
Change-Id: I1cff08f26159fbf48a42afa7cfa08eafa1936f42
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 38a5651..17f4111 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -335,15 +335,10 @@
 # Untrusted apps are not allowed to use cgroups.
 neverallow all_untrusted_apps cgroup:file *;
 
-# TODO(b/113362644): remove open permission from these domains.
 # Untrusted apps targetting >= Q are not allowed to open /dev/ashmem directly.
-#neverallow {
-#  all_untrusted_apps
-# TODO(b/113362644): route mediaprovider to ashmemd
-#  -mediaprovider
-#  -untrusted_app_25
-#  -untrusted_app_27
-#} ashmem_device:chr_file open;
-# In preparation to remove open permission, we audit open operations on
-# /dev/ashmem.
-auditallow all_untrusted_apps ashmem_device:chr_file open;
+# They must use ASharedMemory NDK API instead.
+neverallow {
+  all_untrusted_apps
+  -untrusted_app_25
+  -untrusted_app_27
+} ashmem_device:chr_file open;