Merge "update isolated_app service_manager rules"
diff --git a/recovery.te b/recovery.te
index 61c42b1..b0616ae 100644
--- a/recovery.te
+++ b/recovery.te
@@ -36,11 +36,9 @@
# support to OTAs. However, that code has a bug. When an update occurs,
# some directories are inappropriately labeled as exec_type. This is
# only transient, and subsequent steps in the OTA script correct this
- # mistake.
- # Allow this behavior for now until we can fix the underlying bug.
- # b/15575013
+ # mistake. New devices are moving to block based OTAs, so this is not
+ # worth fixing. b/15575013
allow recovery exec_type:dir { create_dir_perms relabelfrom relabelto };
- auditallow recovery exec_type:dir { create_dir_perms relabelfrom relabelto };
# Write to /proc/sys/vm/drop_caches
# TODO: create more specific label?
diff --git a/system_server.te b/system_server.te
index 191c446..41036b6 100644
--- a/system_server.te
+++ b/system_server.te
@@ -49,7 +49,6 @@
net_broadcast
net_raw
sys_boot
- sys_module
sys_nice
sys_resource
sys_time