Due to the work done for b/156305599 ("Ensure no process except vold can
create directories like /data/system_ce/0"), the SELinux policy now
enforces that vold is the only process that can write to directories
that contain per-user encrypted subdirectories. This is essential to
prevent bugs where directories that are supposed to be encrypted get
created too early so are not actually encrypted as intended.
However, this only works when SELinux is in enforcing mode. When
SELinux is in permissive mode, only DAC is enforced, and the file modes
allow other processes to write to many of these directories. That
allows system_server to break things once again.
Therefore, remove the write bit from the file modes so that write access
is always denied to processes that don't have CAP_DAC_OVERRIDE. This is
not as strong a restriction as the SELinux policy, which still applies
independently, but it does keep out system_server by itself.
Also remove the sticky bit from /data/misc_ce and /data/misc_de, since
there is no reason for it. (It probably was originally copied from
/data/misc, which might need it. But misc_{ce,de} don't need it.)
Bug: 285239971
Test: Booted Cuttlefish
Change-Id: I1213a4d18c5f851acf213d786400d79d73777ed0
7a0611b006