[cleanup] Remove permissions about servicemanager inside microdroid

Bug: 222479468
Test: atest MicrodroidTests MicrodroidHostTests
Change-Id: I562d0d018f0dbd7d4b93c39b2bde4d2a8b50de13

microdroid/system/private/domain.te

@@ -58,7 +58,6 @@ allowxperm domain binder_device:chr_file ioctl { unpriv_binder_ioctls };
 allow domain binderfs:dir { getattr search };
 allow domain binderfs_logs_proc:dir search;
 
-allow { domain -servicemanager } hwbinder_device:chr_file rw_file_perms;
 allow domain ptmx_device:chr_file rw_file_perms;
 allow domain random_device:chr_file rw_file_perms;
 allow domain proc_random:dir r_dir_perms;
@@ -411,11 +410,6 @@ neverallow { domain -init -vendor_init } vendor_default_prop:property_service se
 
 neverallow { domain -init } build_prop:property_service set;
 
-# Only (hw|vnd|)servicemanager should be able to register with binder as the context manager
-# The service managers are only allowed to access their own device node
-neverallow servicemanager hwbinder_device:chr_file no_rw_file_perms;
-neverallow servicemanager vndbinder_device:chr_file no_rw_file_perms;
-
 # Never allow anyone to connect or write to
 # the tombstoned intercept socket.
 neverallow { domain } tombstoned_intercept_socket:sock_file write;
@@ -512,15 +506,6 @@ neverallow {
   -shell
 } shell_data_file:dir { open search };
 
-# servicemanager is the only process which handles the
-# service_manager list request
-neverallow * ~{
-    servicemanager
-    }:service_manager list;
-
-# only service_manager_types can be added to service_manager
-# TODO - rework this: neverallow * ~service_manager_type:service_manager { add find };
-
 # Prevent assigning non property types to properties
 # TODO - rework this: neverallow * ~property_type:property_service set;
 

microdroid/system/public/apexd.te

@@ -1,5 +1,2 @@
 type apexd, domain, coredomain;
 type apexd_exec, file_type, exec_type, system_file_type;
-
-binder_use(apexd)
-add_service(apexd, apex_service)

microdroid/system/public/servicemanager.te

@@ -1 +0,0 @@
-type servicemanager, domain;

microdroid/system/public/statsd.te

@@ -1,7 +1,6 @@
 type statsd, domain;
 
 type statsd_exec, system_file_type, exec_type, file_type;
-binder_use(statsd)
 
 # Allow statsd to scan through /proc/pid for all processes.
 r_dir_file(statsd, domain)

microdroid/system/public/su.te

@@ -36,8 +36,6 @@ userdebug_or_eng(`
   dontaudit su domain:binder *;
   dontaudit su property_type:property_service *;
   dontaudit su property_type:file *;
-  dontaudit su service_manager_type:service_manager *;
-  dontaudit su servicemanager:service_manager list;
   dontaudit su domain:drmservice *;
   dontaudit su unlabeled:filesystem *;
   dontaudit su domain:bpf *;