domain: keep most domains out of app sandboxes
Change-Id: Idc9552d2130750d82318d57e7c55fd280d687063
Signed-off-by: William Roberts <william.c.roberts@intel.com>
diff --git a/domain.te b/domain.te
index 0af215d..de00ac1 100644
--- a/domain.te
+++ b/domain.te
@@ -427,6 +427,13 @@
-installd # creation of app sandbox
} system_app_data_file:dir_file_class_set { create unlink open };
+# Services should respect app sandboxes
+neverallow {
+ domain
+ -appdomain
+ -installd # creation of sandbox
+} app_data_file:dir_file_class_set { create unlink };
+
#
# Only these domains should transition to shell domain. This domain is
# permissible for the "shell user". If you need a process to exec a shell