Merge "Let vold_prepare_subdirs completely clean deleted user data." into pi-dev
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 93d6c11..ab18258 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -12,8 +12,8 @@
allow vold_prepare_subdirs {
system_data_file
vendor_data_file
-}:dir { open read write add_name remove_name relabelfrom };
-allow vold_prepare_subdirs system_data_file:file getattr;
+}:dir { open read write add_name remove_name rmdir relabelfrom };
+allow vold_prepare_subdirs system_data_file:file { getattr unlink };
allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto };
allow vold_prepare_subdirs vold_data_file:file { getattr unlink };
allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto };
diff --git a/public/domain.te b/public/domain.te
index 7c772b4..598991b 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1122,6 +1122,7 @@
-system_app
-init
-installd # for relabelfrom and unlink, check for this in explicit neverallow
+ -vold_prepare_subdirs # For unlink
with_asan(`-asan_extract')
} system_data_file:file no_w_file_perms;
# do not grant anything greater than r_file_perms and relabelfrom unlink