Move watchdogd out of init and into its own domain

am: d840374e

Change-Id: I93264ded0479ab0e101d0449c2ff52b9a92e3d6e

private/compat/26.0/26.0.cil

@@ -280,7 +280,7 @@
 (typeattributeset incident_data_file_26_0 (incident_data_file))
 (typeattributeset incident_service_26_0 (incident_service))
 (typeattributeset init_26_0 (init))
-(typeattributeset init_exec_26_0 (init_exec))
+(typeattributeset init_exec_26_0 (init_exec watchdogd_exec))
 (typeattributeset inotify_26_0 (inotify))
 (typeattributeset input_device_26_0 (input_device))
 (typeattributeset inputflinger_26_0 (inputflinger))

private/compat/26.0/26.0.ignore.cil

@@ -153,6 +153,7 @@
     wait_for_keymaster
     wait_for_keymaster_exec
     wait_for_keymaster_tmpfs
+    watchdogd_tmpfs
     wpantund
     wpantund_exec
     wpantund_service

private/compat/27.0/27.0.cil

@@ -993,7 +993,7 @@
 (typeattributeset incident_data_file_27_0 (incident_data_file))
 (typeattributeset incident_service_27_0 (incident_service))
 (typeattributeset init_27_0 (init))
-(typeattributeset init_exec_27_0 (init_exec))
+(typeattributeset init_exec_27_0 (init_exec watchdogd_exec))
 (typeattributeset inotify_27_0 (inotify))
 (typeattributeset input_device_27_0 (input_device))
 (typeattributeset inputflinger_27_0 (inputflinger))

private/compat/27.0/27.0.ignore.cil

@@ -131,6 +131,7 @@
     wait_for_keymaster
     wait_for_keymaster_exec
     wait_for_keymaster_tmpfs
+    watchdogd_tmpfs
     wm_trace_data_file
     wpantund
     wpantund_exec

private/compat/28.0/28.0.cil

@@ -1177,7 +1177,7 @@
 (typeattributeset incident_helper_28_0 (incident_helper))
 (typeattributeset incident_service_28_0 (incident_service))
 (typeattributeset init_28_0 (init))
-(typeattributeset init_exec_28_0 (init_exec))
+(typeattributeset init_exec_28_0 (init_exec watchdogd_exec))
 (typeattributeset inotify_28_0 (inotify))
 (typeattributeset input_device_28_0 (input_device))
 (typeattributeset inputflinger_28_0 (inputflinger))

private/compat/28.0/28.0.ignore.cil

@@ -13,4 +13,5 @@
     timedetector_service
     timezonedetector_service
     uri_grants_service
-    vrflinger_vsync_service))
+    vrflinger_vsync_service
+    watchdogd_tmpfs))

private/file_contexts

@@ -294,6 +294,7 @@
 /system/bin/statsd               u:object_r:statsd_exec:s0
 /system/bin/bpfloader            u:object_r:bpfloader_exec:s0
 /system/bin/wait_for_keymaster   u:object_r:wait_for_keymaster_exec:s0
+/system/bin/watchdogd            u:object_r:watchdogd_exec:s0
 
 #############################
 # Vendor files

private/init.te

@@ -13,7 +13,6 @@ recovery_only(`
 ')
 domain_trans(init, shell_exec, shell)
 domain_trans(init, init_exec, ueventd)
-domain_trans(init, init_exec, watchdogd)
 domain_trans(init, init_exec, vendor_init)
 domain_trans(init, { rootfs toolbox_exec }, modprobe)
 # case where logpersistd is actually logcat -f in logd context (nee: logcatd)

private/watchdogd.te

 typeattribute watchdogd coredomain;
+
+init_daemon_domain(watchdogd)

public/watchdogd.te

 # watchdogd seclabel is specified in init.<board>.rc
 type watchdogd, domain;
+type watchdogd_exec, exec_type, file_type;
+
 allow watchdogd watchdog_device:chr_file rw_file_perms;
 allow watchdogd kmsg_device:chr_file rw_file_perms;