app_data_file is the only app_data_file_type that is allowed for crosvm

Bug: 204852957
Test: monitor TH
Change-Id: Ie92aa25336087519661002624b486cb35740cda6

private/crosvm.te

@@ -70,3 +70,14 @@ full_treble_only(`
     -vendor_task_profiles_file
   }:file *;
 ')
+
+# app_data_file (and shell_data_file for debuggable builds) is the only
+# app_data_file_type that is allowed for crosvm to read.  Note that the use of
+# app_data_file is allowed only for the intance disk image.  This is enforced
+# inside the virtualizationservice by checking the file context of all disk
+# image files.
+neverallow crosvm {
+  app_data_file_type
+  -app_data_file
+  userdebug_or_eng(`-shell_data_file')
+}:file read;