Split preloads into media_file and data_file
Untrusted apps should only access /data/preloads/media and demo directory.
Bug: 36197686
Test: Verified retail mode.
Checked non-privileged APK cannot access /data/preloads
Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 2f8066a..15ab764 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -97,3 +97,6 @@
# Avoid reads from generically labeled /proc files
# Create a more specific label if needed
neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms };
+
+# Do not allow untrusted apps access to preloads data files
+neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;