Don't allow zygote init:binder call

init can't handle binder calls. It's always incorrect
to allow init:binder call, and represents a binder call
to a service without an SELinux domain. Adding this
allow rule was a mistake; the dumpstate SELinux domain didn't
exist at the time this rule was written, and dumpstate was
running under init's domain.

Add a neverallow rule to prevent the reintroduction of
this bug.

Change-Id: I78d35e675fd142d880f15329471778c18972bf50

domain.te

@@ -166,3 +166,7 @@ neverallow { domain -init } proc_security:file { append write };
 
 # No domain should be allowed to ptrace init.
 neverallow domain init:process ptrace;
+
+# Init can't receive binder calls. If this neverallow rule is being
+# triggered, it's probably due to a service with no SELinux domain.
+neverallow domain init:binder call;

unconfined.te

@@ -38,5 +38,5 @@ allow unconfineddomain netif_type:netif *;
 allow unconfineddomain port_type:socket_class_set name_bind;
 allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
 allow unconfineddomain domain:peer recv;
-allow unconfineddomain domain:binder { call transfer set_context_mgr };
+allow unconfineddomain { domain -init }:binder { call transfer set_context_mgr };
 allow unconfineddomain property_type:property_service set;

zygote.te

@@ -47,7 +47,6 @@ allow zygote zygote_exec:file { execute_no_trans open };
 
 # handle bugreports b/10498304
 allow zygote ashmem_device:chr_file execute;
-allow zygote init:binder call;
 allow zygote shell_data_file:file { write getattr };
 allow zygote system_server:binder { transfer call };
 allow zygote servicemanager:binder { call };