Merge "Move domain_deprecated into private policy" into oc-dev

am: 02a101a6

Change-Id: I0140009cfbf316489db4994b414ac079776ead21

private/attributes

+# Temporary attribute used for migrating permissions out of domain.
+# Motivation: Domain is overly permissive. Start removing permissions
+# from domain and assign them to the domain_deprecated attribute.
+# Domain_deprecated and domain can initially be assigned to all
+# domains. The goal is to not assign domain_deprecated to new domains
+# and to start removing domain_deprecated where it's not required or
+# reassigning the appropriate permissions to the inheriting domain
+# when necessary.
+attribute domain_deprecated;

private/clatd.te

 typeattribute clatd coredomain;
+typeattribute clatd domain_deprecated;

private/dex2oat.te

 typeattribute dex2oat coredomain;
+typeattribute dex2oat domain_deprecated;

private/dhcp.te

 typeattribute dhcp coredomain;
+typeattribute dhcp domain_deprecated;
 
 init_daemon_domain(dhcp)
 type_transition dhcp system_data_file:{ dir file } dhcp_data_file;

public/domain_deprecated.te → private/domain_deprecated.te

@@ -79,7 +79,6 @@ auditallow {
   -fingerprintd
   -installd
   -keystore
-  -rild
   -surfaceflinger
   -system_server
   -update_engine
@@ -193,7 +192,6 @@ auditallow {
   domain_deprecated
   -fsck
   -fsck_untrusted
-  -rild
   -sdcardd
   -system_server
   -update_engine
@@ -203,7 +201,6 @@ auditallow {
   domain_deprecated
   -fsck
   -fsck_untrusted
-  -rild
   -system_server
   -vold
 } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
@@ -212,7 +209,6 @@ auditallow {
   -fingerprintd
   -healthd
   -netd
-  -rild
   -system_app
   -surfaceflinger
   -system_server
@@ -225,7 +221,6 @@ auditallow {
   -fingerprintd
   -healthd
   -netd
-  -rild
   -system_app
   -surfaceflinger
   -system_server
@@ -238,7 +233,6 @@ auditallow {
   -fingerprintd
   -healthd
   -netd
-  -rild
   -system_app
   -surfaceflinger
   -system_server
@@ -256,7 +250,6 @@ auditallow {
   -installd
   -keystore
   -netd
-  -rild
   -surfaceflinger
   -system_server
   -zygote
@@ -271,7 +264,6 @@ auditallow {
   -installd
   -keystore
   -netd
-  -rild
   -surfaceflinger
   -system_server
   -zygote

private/dumpstate.te

 typeattribute dumpstate coredomain;
+typeattribute dumpstate domain_deprecated;
 
 init_daemon_domain(dumpstate)
 

private/fingerprintd.te

 typeattribute fingerprintd coredomain;
+typeattribute fingerprintd domain_deprecated;
 
 init_daemon_domain(fingerprintd)

private/fsck.te

 typeattribute fsck coredomain;
+typeattribute fsck domain_deprecated;
 
 init_daemon_domain(fsck)

private/fsck_untrusted.te

 typeattribute fsck_untrusted coredomain;
+typeattribute fsck_untrusted domain_deprecated;

private/installd.te

 typeattribute installd coredomain;
+typeattribute installd domain_deprecated;
 
 init_daemon_domain(installd)
 

private/keystore.te

 typeattribute keystore coredomain;
+typeattribute keystore domain_deprecated;
 
 init_daemon_domain(keystore)
 

private/mtp.te

 typeattribute mtp coredomain;
+typeattribute mtp domain_deprecated;
 
 init_daemon_domain(mtp)

private/netd.te

 typeattribute netd coredomain;
+typeattribute netd domain_deprecated;
 
 init_daemon_domain(netd)
 

private/perfprofd.te

 userdebug_or_eng(`
   typeattribute perfprofd coredomain;
+  typeattribute perfprofd domain_deprecated;
   init_daemon_domain(perfprofd)
 ')

private/ppp.te

 typeattribute ppp coredomain;
+typeattribute ppp domain_deprecated;
 
 domain_auto_trans(mtp, ppp_exec, ppp)

private/radio.te

 typeattribute radio coredomain;
+typeattribute radio domain_deprecated;
 
 app_domain(radio)
 

private/recovery.te

 typeattribute recovery coredomain;
+typeattribute recovery domain_deprecated;

private/runas.te

 typeattribute runas coredomain;
+typeattribute runas domain_deprecated;
 
 # ndk-gdb invokes adb shell run-as.
 domain_auto_trans(shell, runas_exec, runas)

private/sdcardd.te

 typeattribute sdcardd coredomain;
+typeattribute sdcardd domain_deprecated;
 
 type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;

private/shared_relro.te

 typeattribute shared_relro coredomain;
+typeattribute shared_relro domain_deprecated;
 
 # The shared relro process is a Java program forked from the zygote, so it
 # inherits from app to get basic permissions it needs to run.