sepolicy/isolated_app.te

allow isolated_app app_data_file:dir { search getattr };
allow isolated_app shell_data_file:dir search;