Vendor domains must not use Binder

On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor
apps) are not permitted to use Binder. This commit thus:
* groups non-vendor domains using the new "coredomain" attribute,
* adds neverallow rules restricting Binder use to coredomain and
  appdomain only, and
* temporarily exempts the domains which are currently violating this
  rule from this restriction. These domains are grouped using the new
  "binder_in_vendor_violators" attribute. The attribute is needed
  because the types corresponding to violators are not exposed to the
  public policy where the neverallow rules are.

Test: mmm system/sepolicy
Test: Device boots, no new denials
Test: In Chrome, navigate to ip6.me, play a YouTube video
Test: YouTube: play a video
Test: Netflix: play a movie
Test: Google Camera: take a photo, take an HDR+ photo, record video with
      sound, record slow motion video with sound. Confirm videos play
      back fine and with sound.
Bug: 35870313
Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95

private/drmserver.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute drmserver coredomain;
+
 init_daemon_domain(drmserver)
 
 type_transition drmserver apk_data_file:sock_file drmserver_socket;

private/dumpstate.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute dumpstate coredomain;
+
 init_daemon_domain(dumpstate)
 
 # Execute and transition to the vdc domain

private/ephemeral_app.te

@@ -11,6 +11,8 @@
 ###
 ### PackageManager flags an app as ephemeral at install time.
 
+typeattribute ephemeral_app coredomain;
+
 net_domain(ephemeral_app)
 app_domain(ephemeral_app)
 

private/fingerprintd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute fingerprintd coredomain;
+
 init_daemon_domain(fingerprintd)

private/fsck.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute fsck coredomain;
+
 init_daemon_domain(fsck)

private/fsck_untrusted.te

+typeattribute fsck_untrusted coredomain;

private/gatekeeperd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute gatekeeperd coredomain;
+
 init_daemon_domain(gatekeeperd)

private/hal_allocator_default.te

-type hal_allocator_default, domain;
+type hal_allocator_default, domain, coredomain;
 hal_server_domain(hal_allocator_default, hal_allocator)
 
 type hal_allocator_default_exec, exec_type, file_type;

private/healthd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute healthd coredomain;
+
 init_daemon_domain(healthd)
 
 # Allow callback to storaged batteryproperties listener

private/hwservicemanager.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute hwservicemanager coredomain;
+
 init_daemon_domain(hwservicemanager)

private/idmap.te

+typeattribute idmap coredomain;

private/incident.te

+typeattribute incident coredomain;
+
 type incident_exec, exec_type, file_type;
 
 # switch to incident domain for incident command

private/incidentd.te

+typeattribute incidentd coredomain;
+
 init_daemon_domain(incidentd)
 type incidentd_exec, exec_type, file_type;
 binder_use(incidentd)

private/init.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute init coredomain;
+
 tmpfs_domain(init)
 
 # Transitions to seclabel processes in init.rc

private/inputflinger.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute inputflinger coredomain;
+
 init_daemon_domain(inputflinger)

private/install_recovery.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute install_recovery coredomain;
+
 init_daemon_domain(install_recovery)

private/installd.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute installd coredomain;
+
 init_daemon_domain(installd)
 
 # Run dex2oat in its own sandbox.

private/isolated_app.te

@@ -6,6 +6,8 @@
 ### and AID_ISOLATED_END (99999).
 ###
 
+typeattribute isolated_app coredomain;
+
 app_domain(isolated_app)
 
 # Access already open app data files received over Binder or local socket IPC.

private/kernel.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute kernel coredomain;
+
 domain_auto_trans(kernel, init_exec, init)

private/keystore.te

-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
+typeattribute keystore coredomain;
+
 init_daemon_domain(keystore)