Make sure exec_type is assigned to all entrypoint types.

Some file types used as domain entrypoints were missing the
exec_type attribute.  Add it and add a neverallow rule to
keep it that way.

Change-Id: I7563f3e03940a27ae40ed4d6bb74181c26148849
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

domain.te

@@ -138,3 +138,6 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto;
 
 # Only init should be able to load SELinux policies
 neverallow { domain -init } kernel:security load_policy;
+
+# Ensure that all entrypoint executables are in exec_type.
+neverallow domain { file_type -exec_type }:file entrypoint;

ping.te

 type ping, domain;
 permissive ping;
-type ping_exec, file_type;
+type ping_exec, exec_type, file_type;
 domain_auto_trans(shell, ping_exec, ping)
 unconfined_domain(ping)

runas.te

 type runas, domain;
-type runas_exec, file_type;
+type runas_exec, exec_type, file_type;
 permissive runas;
 unconfined_domain(runas)
 

shell.te

 # Domain for shell processes spawned by ADB
 type shell, domain;
-type shell_exec, file_type;
+type shell_exec, exec_type, file_type;
 unconfined_domain(shell)
 
 # Run app_process.

su.te

 type su, domain;
 permissive su;
-type su_exec, file_type;
+type su_exec, exec_type, file_type;
 domain_auto_trans(shell, su_exec, su)
 
 # su is unconfined.

su_user.te

 # File types must be defined for file_contexts.
-type su_exec, file_type;
+type su_exec, exec_type, file_type;
 
 # No allow rules