Vendor domains must not use Binder am: f5446eb1

am: 2fe065d7

Change-Id: Ieefcec5619fc2b941a675b473661dc561864ffc9

private/drmserver.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute drmserver coredomain;
+
 init_daemon_domain(drmserver)
 
 type_transition drmserver apk_data_file:sock_file drmserver_socket;

private/dumpstate.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute dumpstate coredomain;
+
 init_daemon_domain(dumpstate)
 
 # Execute and transition to the vdc domain

private/ephemeral_app.te

@@ -11,6 +11,8 @@
 ###
 ### PackageManager flags an app as ephemeral at install time.
 
+typeattribute ephemeral_app coredomain;
+
 net_domain(ephemeral_app)
 app_domain(ephemeral_app)
 

private/fingerprintd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute fingerprintd coredomain;
+
 init_daemon_domain(fingerprintd)

private/fsck.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute fsck coredomain;
+
 init_daemon_domain(fsck)

private/fsck_untrusted.te

+typeattribute fsck_untrusted coredomain;

private/gatekeeperd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute gatekeeperd coredomain;
+
 init_daemon_domain(gatekeeperd)

private/hal_allocator_default.te

-type hal_allocator_default, domain;
+type hal_allocator_default, domain, coredomain;
 hal_server_domain(hal_allocator_default, hal_allocator)
 
 type hal_allocator_default_exec, exec_type, file_type;

private/healthd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute healthd coredomain;
+
 init_daemon_domain(healthd)
 
 # Allow callback to storaged batteryproperties listener

private/hwservicemanager.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute hwservicemanager coredomain;
+
 init_daemon_domain(hwservicemanager)

private/idmap.te

+typeattribute idmap coredomain;

private/incident.te

+typeattribute incident coredomain;
+
 type incident_exec, exec_type, file_type;
 
 # switch to incident domain for incident command

private/incidentd.te

+typeattribute incidentd coredomain;
+
 init_daemon_domain(incidentd)
 type incidentd_exec, exec_type, file_type;
 binder_use(incidentd)

private/init.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute init coredomain;
+
 tmpfs_domain(init)
 
 # Transitions to seclabel processes in init.rc

private/inputflinger.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute inputflinger coredomain;
+
 init_daemon_domain(inputflinger)

private/install_recovery.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute install_recovery coredomain;
+
 init_daemon_domain(install_recovery)

private/installd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute installd coredomain;
+
 init_daemon_domain(installd)
 
 # Run dex2oat in its own sandbox.

private/isolated_app.te

@@ -6,6 +6,8 @@
 ### and AID_ISOLATED_END (99999).
 ###
 
+typeattribute isolated_app coredomain;
+
 app_domain(isolated_app)
 
 # Access already open app data files received over Binder or local socket IPC.

private/kernel.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute kernel coredomain;
+
 domain_auto_trans(kernel, init_exec, init)

private/keystore.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute keystore coredomain;
+
 init_daemon_domain(keystore)