am df80ebd9: am d0919ec2: assert: do not allow raw access to generic block_device

* commit 'df80ebd9':
  assert: do not allow raw access to generic block_device

domain.te

@@ -183,3 +183,7 @@ neverallow domain init:process ptrace;
 # Init can't receive binder calls. If this neverallow rule is being
 # triggered, it's probably due to a service with no SELinux domain.
 neverallow domain init:binder call;
+
+# Don't allow raw read/write/open access to block_device
+# Rather force a relabel to a more specific type
+neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };