Merge changes Icd71c967,I3fd90ad9
* changes:
Do not permit appdomain to create/write to download_file.
Remove duplicated rules between appdomain and isolated_app.
diff --git a/domain.te b/domain.te
index 7c9e7a6..3db35d7 100644
--- a/domain.te
+++ b/domain.te
@@ -103,9 +103,8 @@
# For /sys/qemu_trace files in the emulator.
bool in_qemu false;
if (in_qemu) {
-allow domain sysfs:file rw_file_perms;
-}
allow domain sysfs_writable:file rw_file_perms;
+}
# Read access to pseudo filesystems.
r_dir_file(domain, proc)
diff --git a/file_contexts b/file_contexts
index 81b9da9..a70ab83 100644
--- a/file_contexts
+++ b/file_contexts
@@ -208,7 +208,7 @@
#############################
# sysfs files
#
-/sys/qemu_trace/process_name -- u:object_r:sysfs_writable:s0
+/sys/qemu_trace(/.*)? -- u:object_r:sysfs_writable:s0
/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
/sys/class/rfkill/rfkill[0-9]*/state -- u:object_r:sysfs_bluetooth_writable:s0
/sys/class/rfkill/rfkill[0-9]*/type -- u:object_r:sysfs_bluetooth_writable:s0