commit f3722d5a715992c74b567efd71179955b41c9157
author Steven Moreland <smoreland@google.com> Mon May 22 23:45:40 2023 +0000
committer Steven Moreland <smoreland@google.com> Tue May 23 00:01:27 2023 +0000
tree a0df365a9592651fcbfbc557ff4bc175aa9f1c6d
parent b56bf68763bcb2a47fae192b57c8b67d9fcd25c3

strengthen app_data_file neverallows

There are more types of apps now.

Bug: 281877578
Test: boot
Change-Id: I1918de8610070f6fac0e933d75c656e4ee0cfbdd

private/traced_perf.te

diff --git a/private/traced_perf.te b/private/traced_perf.te
index 640b054..c7e81cd 100644
--- a/private/traced_perf.te
+++ b/private/traced_perf.te
@@ -58,7 +58,7 @@
 dontaudit traced_perf domain:process signal;
 
 # Never allow access to app data files
-neverallow traced_perf { app_data_file privapp_data_file system_app_data_file }:file *;
+neverallow traced_perf app_data_file_type:file *;
 
 # Never allow profiling privileged or otherwise incompatible domains.
 # Corresponding allow-rule is in private/domain.te.