Make font_fallback.xml unreadable
Bug: 281769620
Test: atest CtsGraphicsTestCases
Test: atest CtsTextTestCases
Change-Id: I05011c9313fa3818ec50d9884227512ef1b0fda9
diff --git a/private/app.te b/private/app.te
index 3f8560a..594ae63 100644
--- a/private/app.te
+++ b/private/app.te
@@ -102,6 +102,10 @@
# Don't allow regular apps access to storage configuration properties.
neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
+# Don't allow apps reading /system/etc/font_fallback.xml
+dontaudit appdomain system_font_fallback_file:file no_rw_file_perms;
+neverallow appdomain system_font_fallback_file:file no_rw_file_perms;
+
# Allow to read sendbug.preferred.domain
get_prop(appdomain, sendbug_config_prop)