selinux: Workaround for devices with PR_SET_NO_NEW_PRIVS enforcement

PR_SET_NO_NEW_PRIVS blocks domain transitions from within app_process,
unless the new domain is bounded by the app's context. So we can't
switch to a domain that has perms not available to untrusted_app :(

This means any app can talk to the daemon, bypassing the su executable
client. That's not a good thing, and needs to be resolved.

Change-Id: I85b74f90b8737caaa193a0555b5262e7392519b2
sepolicy: More rules for recovery

Change-Id: Ie50c04eb83cb9c62f679a1c1aa2ac482af159f7e

Conflicts:
	sepolicy/property_contexts
Revert "Fix superuser binary premissions on boot"

This reverts commit 983d31e91285654c71c02e640b521b2ad56a2c32.
vendor: Update SELinux policy for sysinit

Fix denial of

adb shell su -c dmesg | grep 'avc: '
<4>[4.595855] C1 [init] avc:  denied  { set } for property=supolicy.loaded scontext=u:r:sysinit:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service

Thanks @freshgiammi

Change-Id: I95b490133bc59337fbf2bc12cc47aaad9bd0c30e
cm: sepolicy: Remove vold external sdcard rules, moved to main sepolicy

Change-Id: I67756bad2c6e1361ecc0052003f2b4e5e4dbb007