Merge "zygote.te: clean up and tighten app data isolation rules"
diff --git a/private/apexd.te b/private/apexd.te
index 040651d..0cafd3c 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -86,7 +86,6 @@
allow apexd apex_info_file:file relabelto;
# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update.
allow apexd apex_info_file:file rw_file_perms;
-allow apexd apex_info_file:file mounton;
# allow apexd to unlink apex files in /data/apex/active
# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX,
diff --git a/private/sdk_sandbox.te b/private/sdk_sandbox.te
index 74ede2a..46e7be8 100644
--- a/private/sdk_sandbox.te
+++ b/private/sdk_sandbox.te
@@ -110,7 +110,7 @@
### neverallow rules
###
-neverallow sdk_sandbox { app_data_file privapp_data_file }:file { execute execute_no_trans };
+neverallow sdk_sandbox { app_data_file privapp_data_file sdk_sandbox_data_file }:file { execute execute_no_trans };
# Receive or send uevent messages.
neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *;