Merge "Restrict ability to set checkreqprot."

domain.te

@@ -148,7 +148,7 @@ neverallow { domain -init } kernel:security load_policy;
 # init starts in kernel domain and switches to init domain via setcon in
 # the init.rc, so the setenforce occurs while still in kernel. After
 # switching domains, there is never any need to setenforce again by init.
-neverallow { domain -kernel } kernel:security setenforce;
+neverallow { domain -kernel } kernel:security { setenforce setcheckreqprot };
 
 # Only init, ueventd and system_server should be able to access HW RNG
 neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *;

kernel.te

@@ -9,3 +9,6 @@ allow kernel unlabeled:filesystem mount;
 
 # Initial setenforce by init prior to switching to init domain.
 allow kernel self:security setenforce;
+
+# Set checkreqprot by init.rc prior to switching to init domain.
+allow kernel self:security setcheckreqprot;

unconfined.te

@@ -17,7 +17,7 @@
 ######################################################
 
 allow unconfineddomain self:capability_class_set *;
-allow unconfineddomain kernel:security ~{ load_policy setenforce };
+allow unconfineddomain kernel:security ~{ load_policy setenforce setcheckreqprot };
 allow unconfineddomain kernel:system *;
 allow unconfineddomain domain:process ~ptrace;
 allow unconfineddomain domain:fd *;