Move folio_daemon to system in sepolicy

Remove Treble violations.

Bug: 36867326
Bug: 62387246
Test: loaded on taimen, checked dmesg, and tested daemon with magnet
Change-Id: I4662b41206b94cae6ac9843b5dc7e1452003c63c

folio_daemon/Android.mk

@@ -17,6 +17,5 @@ LOCAL_CLANG := true
 LOCAL_MODULE := folio_daemon
 LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_OWNER := google
-LOCAL_PROPRIETARY_MODULE := true
 
 include $(BUILD_EXECUTABLE)

init.hardware.rc

@@ -415,7 +415,7 @@ service init-radio-sh /vendor/bin/init.radio.sh
     group root radio
     oneshot
 
-service folio_daemon /vendor/bin/folio_daemon
+service folio_daemon /system/bin/folio_daemon
     class late_start
     user system
     group system

sepolicy/private/file_contexts

@@ -0,0 +1 @@
+/system/bin/folio_daemon        u:object_r:folio_daemon_exec:s0

sepolicy/private/folio_daemon.te

@@ -1,16 +1,11 @@
-type folio_daemon, domain;
-type folio_daemon_exec, exec_type, vendor_file_type, file_type;
+type folio_daemon, domain, coredomain;
+type folio_daemon_exec, exec_type, file_type;
 
 init_daemon_domain(folio_daemon)
 
 allow folio_daemon binder_device:chr_file rw_file_perms;
 allow folio_daemon uhid_device:chr_file rw_file_perms;
 
-# TODO(b/35870313): Remove this attribute when the corresponding bug is fixed and the treble
-# violations are handled
-typeattribute folio_daemon binder_in_vendor_violators;
-typeattribute folio_daemon socket_between_core_and_vendor_violators;
-
 allow folio_daemon system_server:unix_stream_socket rw_socket_perms_no_ioctl;
 
 binder_use(folio_daemon)

sepolicy/private/system_server.te

@@ -0,0 +1 @@
+binder_call(system_server, folio_daemon)

sepolicy/vendor/file_contexts

@@ -168,7 +168,6 @@
 /vendor/bin/hw/android\.hardware\.usb@1\.1-service.wahoo             u:object_r:hal_usb_default_exec:s0
 /vendor/bin/hw/android\.hardware\.power@1\.1-service.wahoo           u:object_r:hal_power_default_exec:s0
 /vendor/bin/chre                u:object_r:chre_exec:s0
-/vendor/bin/folio_daemon        u:object_r:folio_daemon_exec:s0
 /vendor/bin/time_daemon         u:object_r:time_daemon_exec:s0
 /vendor/bin/imsrcsd             u:object_r:hal_rcsservice_exec:s0
 /vendor/bin/init\.qcom\.devstart\.sh                                 u:object_r:init-qcom-devstart-sh_exec:s0

sepolicy/vendor/system_server.te

@@ -3,8 +3,6 @@ allowxperm system_server self:socket ioctl msm_sock_ipc_ioctls;
 
 # TODO(b/36867326): Remove this once system_server no longer communicates over binder
 binder_call(system_server, per_mgr)
-binder_call(system_server, folio_daemon)
-
 binder_call(system_server, hal_camera_default)
 
 allow system_server persist_file:dir search;