Split preloads into media_file and data_file
Untrusted apps should only access /data/preloads/media and demo directory.
Bug: 36197686
Test: Verified retail mode.
Checked non-privileged APK cannot access /data/preloads
Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446
diff --git a/private/system_server.te b/private/system_server.te
index d78c576..f25e8ce 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -599,6 +599,8 @@
# Access to /data/preloads
allow system_server preloads_data_file:file { r_file_perms unlink };
allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
+allow system_server preloads_media_file:file { r_file_perms unlink };
+allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
r_dir_file(system_server, cgroup)
allow system_server ion_device:chr_file r_file_perms;