more ephemeral_app cleanup

As of https://android-review.googlesource.com/324092, ephemeral_app is
now an appdomain, so places where both appdomain and ephemeral_app are
granted the same set of rules can be deleted.

Test: policy compiles.
Change-Id: Ideee710ea47af7303e5eb3af1331653afa698415

public/adbd.te

@@ -84,7 +84,7 @@ userdebug_or_eng(`
 # ndk-gdb invokes adb forward to forward the gdbserver socket.
 allow adbd { app_data_file ephemeral_data_file }:dir search;
 allow adbd { app_data_file ephemeral_data_file }:sock_file write;
-allow adbd { appdomain ephemeral_app }:unix_stream_socket connectto;
+allow adbd appdomain:unix_stream_socket connectto;
 
 # ndk-gdb invokes adb pull of app_process, linker, and libc.so.
 allow adbd zygote_exec:file r_file_perms;

public/audioserver.te

@@ -6,7 +6,7 @@ r_dir_file(audioserver, sdcard_type)
 
 binder_use(audioserver)
 binder_call(audioserver, binderservicedomain)
-binder_call(audioserver, { appdomain ephemeral_app })
+binder_call(audioserver, appdomain)
 binder_service(audioserver)
 
 hwbinder_use(audioserver)

public/domain.te

@@ -297,7 +297,6 @@ neverallow { domain -kernel -init -recovery -vold -zygote -update_engine -otapre
 neverallow {
     domain
     -appdomain
-    -ephemeral_app
     -dumpstate
     -shell
     userdebug_or_eng(`-su')

public/drmserver.te

@@ -9,7 +9,7 @@ net_domain(drmserver)
 # Perform Binder IPC to system server.
 binder_use(drmserver)
 binder_call(drmserver, system_server)
-binder_call(drmserver, { appdomain ephemeral_app })
+binder_call(drmserver, appdomain)
 binder_service(drmserver)
 # Inherit or receive open files from system_server.
 allow drmserver system_server:fd use;

public/dumpstate.te

@@ -49,7 +49,7 @@ allow dumpstate pstorefs:file r_file_perms;
 allow dumpstate domain:process getattr;
 
 # Signal java processes to dump their stack
-allow dumpstate { appdomain ephemeral_app system_server }:process signal;
+allow dumpstate { appdomain system_server }:process signal;
 
 # Signal native processes to dump their stack.
 # This list comes from native_processes_to_dump in dumpstate/utils.c
@@ -85,7 +85,7 @@ r_dir_file(dumpstate, cgroup)
 
 # Allow dumpstate to make binder calls to any binder service
 binder_call(dumpstate, binderservicedomain)
-binder_call(dumpstate, { appdomain ephemeral_app netd wificond })
+binder_call(dumpstate, { appdomain netd wificond })
 
 # Vibrate the device after we are done collecting the bugreport
 # For binderized mode:

public/hal_graphics_composer.te

@@ -13,4 +13,4 @@ allow hal_graphics_composer graphics_device:chr_file rw_file_perms;
 # Fences
 allow hal_graphics_composer system_server:fd use;
 allow hal_graphics_composer bootanim:fd use;
-allow hal_graphics_composer {appdomain ephemeral_app}:fd use;
+allow hal_graphics_composer appdomain:fd use;

public/lmkd.te

@@ -14,8 +14,6 @@ allow lmkd self:capability ipc_lock;
 ## TODO: maybe scope this down?
 r_dir_file(lmkd, appdomain)
 allow lmkd appdomain:file write;
-r_dir_file(lmkd, ephemeral_app)
-allow lmkd ephemeral_app:file write;
 r_dir_file(lmkd, system_server)
 allow lmkd system_server:file write;
 

public/mediaserver.te

@@ -22,7 +22,7 @@ userdebug_or_eng(`
 
 binder_use(mediaserver)
 binder_call(mediaserver, binderservicedomain)
-binder_call(mediaserver, { appdomain ephemeral_app })
+binder_call(mediaserver, appdomain)
 binder_service(mediaserver)
 
 allow mediaserver media_data_file:dir create_dir_perms;
@@ -48,7 +48,7 @@ allow mediaserver ringtone_file:file { read getattr };
 allow mediaserver radio_data_file:file { read getattr };
 
 # Use pipes passed over Binder from app domains.
-allow mediaserver { appdomain ephemeral_app }:fifo_file { getattr read write };
+allow mediaserver appdomain:fifo_file { getattr read write };
 
 allow mediaserver rpmsg_device:chr_file rw_file_perms;
 

public/surfaceflinger.te

@@ -12,7 +12,7 @@ binder_call(surfaceflinger, hal_graphics_composer)
 # Perform Binder IPC.
 binder_use(surfaceflinger)
 binder_call(surfaceflinger, binderservicedomain)
-binder_call(surfaceflinger, { appdomain ephemeral_app })
+binder_call(surfaceflinger, appdomain)
 binder_call(surfaceflinger, bootanim)
 binder_service(surfaceflinger)
 
@@ -21,7 +21,7 @@ binder_call(surfaceflinger, adbd)
 
 # Read /proc/pid files for Binder clients.
 r_dir_file(surfaceflinger, binderservicedomain)
-r_dir_file(surfaceflinger, { appdomain ephemeral_app })
+r_dir_file(surfaceflinger, appdomain)
 
 # Access the GPU.
 allow surfaceflinger gpu_device:chr_file rw_file_perms;
@@ -42,7 +42,7 @@ set_prop(surfaceflinger, system_prop)
 set_prop(surfaceflinger, ctl_bootanim_prop)
 
 # Use open files supplied by an app.
-allow surfaceflinger { appdomain ephemeral_app }:fd use;
+allow surfaceflinger appdomain:fd use;
 allow surfaceflinger app_data_file:file { read write };
 
 # Allow a dumpstate triggered screenshot

public/system_server.te

@@ -87,10 +87,10 @@ allow system_server self:socket create_socket_perms_no_ioctl;
 allow system_server self:netlink_route_socket nlmsg_write;
 
 # Kill apps.
-allow system_server { appdomain ephemeral_app }:process { sigkill signal };
+allow system_server appdomain:process { sigkill signal };
 
 # Set scheduling info for apps.
-allow system_server { appdomain ephemeral_app }:process { getsched setsched };
+allow system_server appdomain:process { getsched setsched };
 allow system_server audioserver:process { getsched setsched };
 allow system_server hal_audio:process { getsched setsched };
 allow system_server cameraserver:process { getsched setsched };
@@ -151,7 +151,7 @@ allow system_server surfaceflinger:unix_stream_socket { read write setopt };
 
 # Perform Binder IPC.
 binder_use(system_server)
-binder_call(system_server, { appdomain ephemeral_app })
+binder_call(system_server, appdomain)
 binder_call(system_server, binderservicedomain)
 binder_call(system_server, dumpstate)
 binder_call(system_server, fingerprintd)
@@ -428,8 +428,8 @@ allow system_server system_file:lnk_file r_file_perms;
 allow system_server gps_control:file rw_file_perms;
 
 # Allow system_server to use app-created sockets and pipes.
-allow system_server { appdomain ephemeral_app }:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
-allow system_server { appdomain ephemeral_app }:{ fifo_file unix_stream_socket } { getattr read write };
+allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
+allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
 
 # Allow abstract socket connection
 allow system_server rild:unix_stream_socket connectto;

public/zygote.te

@@ -13,15 +13,15 @@ allow zygote self:capability setpcap;
 # Switch SELinux context to app domains.
 allow zygote self:process setcurrent;
 allow zygote system_server:process dyntransition;
-allow zygote { appdomain ephemeral_app }:process dyntransition;
+allow zygote appdomain:process dyntransition;
 
 # Allow zygote to read app /proc/pid dirs (b/10455872).
-allow zygote { appdomain ephemeral_app }:dir { getattr search };
-allow zygote { appdomain ephemeral_app }:file { r_file_perms };
+allow zygote appdomain:dir { getattr search };
+allow zygote appdomain:file { r_file_perms };
 
 # Move children into the peer process group.
 allow zygote system_server:process { getpgid setpgid };
-allow zygote { appdomain ephemeral_app }:process { getpgid setpgid };
+allow zygote appdomain:process { getpgid setpgid };
 
 # Read system data.
 allow zygote system_data_file:dir r_dir_perms;
@@ -116,7 +116,7 @@ get_prop(zygote, overlay_prop)
 # This is achieved by ensuring that it is impossible for zygote to
 # setcon (dyntransition) to any types other than those associated
 # with appdomain plus system_server.
-neverallow zygote ~{ appdomain ephemeral_app system_server }:process dyntransition;
+neverallow zygote ~{ appdomain system_server }:process dyntransition;
 
 # Zygote should never execute anything from /data except for /data/dalvik-cache files.
 neverallow zygote {