Vendor domains must not use Binder am: f5446eb1

am: 2fe065d7

Change-Id: Ieefcec5619fc2b941a675b473661dc561864ffc9

private/lmkd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute lmkd coredomain;
+
 init_daemon_domain(lmkd)

private/logd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute logd coredomain;
+
 init_daemon_domain(logd)
 
 # logd is not allowed to write anywhere other than /data/misc/logd, and then

private/logpersist.te

+typeattribute logpersist coredomain;
+
 # android debug log storage in logpersist domains (eng and userdebug only)
 userdebug_or_eng(`
 

private/mdnsd.te

 # mdns daemon
 
+typeattribute mdnsd coredomain;
 typeattribute mdnsd mlstrustedsubject;
 
 type mdnsd_exec, exec_type, file_type;

private/mediacodec.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute mediacodec coredomain;
+
 init_daemon_domain(mediacodec)

private/mediadrmserver.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute mediadrmserver coredomain;
+
 init_daemon_domain(mediadrmserver)

private/mediaextractor.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute mediaextractor coredomain;
+
 init_daemon_domain(mediaextractor)

private/mediametrics.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute mediametrics coredomain;
+
 init_daemon_domain(mediametrics)

private/mediaserver.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute mediaserver coredomain;
+
 init_daemon_domain(mediaserver)

private/modprobe.te

+typeattribute modprobe coredomain;

private/mtp.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute mtp coredomain;
+
 init_daemon_domain(mtp)

private/netd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute netd coredomain;
+
 init_daemon_domain(netd)
 
 # Allow netd to spawn dnsmasq in it's own domain

private/nfc.te

 # nfc subsystem
+typeattribute nfc coredomain;
 app_domain(nfc)
 net_domain(nfc)
 

private/otapreopt_chroot.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute otapreopt_chroot coredomain;
+
 # Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
 domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)

private/otapreopt_slot.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute otapreopt_slot coredomain;
+
 # Technically not a daemon but we do want the transition from init domain to
 # cppreopts to occur.
 init_daemon_domain(otapreopt_slot)

private/performanced.te

+typeattribute performanced coredomain;
+
 init_daemon_domain(performanced)

private/platform_app.te

@@ -2,6 +2,7 @@
 ### Apps signed with the platform key.
 ###
 
+typeattribute platform_app coredomain;
 typeattribute platform_app domain_deprecated;
 
 app_domain(platform_app)

private/postinstall.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute postinstall coredomain;
+
 domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)

private/postinstall_dexopt.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute postinstall_dexopt coredomain;
+
 # Run dex2oat/patchoat in its own sandbox.
 # We have to manually transition, as we don't have an entrypoint.
 domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)

private/ppp.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute ppp coredomain;
+
 domain_auto_trans(mtp, ppp_exec, ppp)