Fix coredomain violation for modprobe

am: e41af203

Change-Id: I586cf07d87339f83d66919871d1531e9b8d79c4e

private/init.te

@@ -13,7 +13,7 @@ recovery_only(`
 domain_trans(init, shell_exec, shell)
 domain_trans(init, init_exec, ueventd)
 domain_trans(init, init_exec, watchdogd)
-domain_trans(init, { rootfs toolbox_exec vendor_toolbox_exec }, modprobe)
+domain_trans(init, { rootfs toolbox_exec }, modprobe)
 # case where logpersistd is actually logcat -f in logd context (nee: logcatd)
 userdebug_or_eng(`
   domain_auto_trans(init, logcat_exec, logpersist)

public/modprobe.te

@@ -7,5 +7,5 @@ recovery_only(`
   allow modprobe rootfs:system module_load;
   allow modprobe rootfs:file r_file_perms;
 ')
-allow modprobe { system_file vendor_file }:system module_load;
-r_dir_file(modprobe, { system_file vendor_file })
+allow modprobe { system_file }:system module_load;
+r_dir_file(modprobe, { system_file })

vendor/vendor_modprobe.te

+type vendor_modprobe, domain;
+
+# For the use of /vendor/bin/modprobe from vendor init.rc fragments
+domain_trans(init, vendor_toolbox_exec, vendor_modprobe)
+
+allow vendor_modprobe proc_modules:file r_file_perms;
+allow vendor_modprobe self:capability sys_module;
+allow vendor_modprobe kernel:key search;
+
+allow vendor_modprobe { vendor_file }:system module_load;
+r_dir_file(vendor_modprobe, { vendor_file })