Add a domain for the recovery console.

Define a domain for use by the recovery init.rc file for
/sbin/recovery.  Start with a copy of the kernel domain
rules since that is what /sbin/recovery was previously running in,
and then add rules as appropriate.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Allow recovery to execute ashmem_device and tmpfs.

Requires execmem and ashmem_device:chr_file execute similar to bootanim
presumably for the display.

Did not see any cache_file execute denials and do not see any
exec of /cache files in the code, only reading/interpreting scripts,
so I removed cache_file rx_file_perms.

Did not see any tmpfs execute denials in /proc/last_kmsg but the
source code appears to extract the update-binary to a tmpfs mount
in /tmp and then exec it.  So I retained that rule.

Tested with adb sideload.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

ashmem_device is a character device, not a regular file.

Change-Id: I9b9ac1a383ac2ffdaf2fc62cb11ed026505ed924
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
sepolicy: Allow vold to use rootfs entrypoint

 * For recovery

Change-Id: I57dbe3b0a504b63551a69046d36472bb20af3963