Constrain getattr for app data directories.
This seems to have been omitted inadvertently.
Bug: 161356067
Test: Verified test app can no longer call stat()
Change-Id: I6bffa9d2932a221823648ab01b58437d5bf6e194
diff --git a/private/mls b/private/mls
index 9690440..08d4e1f 100644
--- a/private/mls
+++ b/private/mls
@@ -54,7 +54,7 @@
# Only constrain open, not read/write.
# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc.
# Subject must dominate object unless the subject is trusted.
-mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir }
+mlsconstrain dir { open search getattr setattr rename add_name remove_name reparent rmdir }
( (t2 != app_data_file and t2 != privapp_data_file ) or l1 dom l2 or t1 == mlstrustedsubject);
mlsconstrain { file sock_file } { open setattr unlink link rename }
( (t2 != app_data_file and t2 != privapp_data_file and t2 != appdomain_tmpfs) or l1 dom l2 or t1 == mlstrustedsubject);