assert: Do not allow access to generic device:chr_file

Rather, enforce that a relabel should be done. This
tightens an existing assertion.

Change-Id: I0500e3dc483e6bf97e5b017043e358bcbdc69904

app.te

@@ -201,9 +201,6 @@ neverallow { appdomain -unconfineddomain } self:capability2 *;
 # Block device access.
 neverallow { appdomain -unconfineddomain } dev_type:blk_file { read write };
 
-# Access to any character device that is not specifically typed.
-neverallow { appdomain -unconfineddomain } device:chr_file { read write };
-
 # Access to any of the following character devices.
 neverallow { appdomain -unconfineddomain } {
     audio_device

domain.te

@@ -187,3 +187,8 @@ neverallow domain init:binder call;
 # Don't allow raw read/write/open access to block_device
 # Rather force a relabel to a more specific type
 neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };
+
+# Don't allow raw read/write/open access to generic devices.
+# Rather force a relabel to a more specific type.
+# ueventd is exempt from this, as its managing these devices.
+neverallow { domain -unconfineddomain -ueventd } device:chr_file { open read write };