Merge "Abolish calls to shell in vold"

private/vold.te

@@ -8,8 +8,8 @@ domain_auto_trans(vold, sdcardd_exec, sdcardd);
 
 # For a handful of probing tools, we choose an even more restrictive
 # domain when working with untrusted block devices
-domain_trans(vold, shell_exec, blkid);
-domain_trans(vold, shell_exec, blkid_untrusted);
+domain_trans(vold, blkid_exec, blkid);
+domain_trans(vold, blkid_exec, blkid_untrusted);
 domain_trans(vold, fsck_exec, fsck);
 domain_trans(vold, fsck_exec, fsck_untrusted);
 

public/vold.te

@@ -31,9 +31,6 @@ allow vold file_contexts_file:file r_file_perms;
 # Allow us to jump into execution domains of above tools
 allow vold self:process setexec;
 
-# For sgdisk launched through popen()
-allow vold shell_exec:file rx_file_perms;
-
 # For formatting adoptable storage devices
 allow vold e2fs_exec:file rx_file_perms;