appdomain: neverallow direct input_device access
Applications should not access /dev/input/* for events, but
rather use events handled via the activity mechanism.
Change-Id: I0182b6be1b7c69d96e4366ba59f14cee67be4beb
Signed-off-by: William Roberts <william.c.roberts@intel.com>
diff --git a/app.te b/app.te
index 70b1c94..f166caa 100644
--- a/app.te
+++ b/app.te
@@ -405,3 +405,9 @@
system_file
tmpfs
}:lnk_file no_w_file_perms;
+
+# Applications should use the activity model for receiving events
+neverallow {
+ appdomain
+ -shell # bugreport
+} input_device:chr_file ~getattr;