Merge "Enforce assumptions around metadata_block_device" am: 62f0b8ea am:...

Merge "Enforce assumptions around metadata_block_device" am: 62f0b8ea am: 320e821e am: c6bcdbdf
am: fb4f3617

Change-Id: I357f9d599e48bc9822b38fe092b7c3df20de279f

public/domain.te

@@ -383,6 +383,12 @@ neverallow {
   -ueventd # Further restricted in ueventd.te
 } frp_block_device:blk_file rw_file_perms;
 
+# The metadata block device is set aside for device encryption and
+# verified boot metadata. It may be reset at will and should not
+# be used by other domains.
+neverallow { domain -init -recovery -vold } metadata_block_device:blk_file
+  { append link rename write open read ioctl lock };
+
 # No domain other than recovery and update_engine can write to system partition(s).
 neverallow { domain -recovery -update_engine } system_block_device:blk_file write;