Add nnp_nosuid_transition policycap and related class/perm definitions.

am: 1b1d133be5

Change-Id: I3fa539a472a0ac382205ad206fe56a36949d222c

private/access_vectors

@@ -330,6 +330,11 @@ class process
 	getrlimit
 }
 
+class process2
+{
+	nnp_transition
+	nosuid_transition
+}
 
 #
 # Define the access vector interpretation for ipc-related objects

private/policy_capabilities

@@ -11,3 +11,10 @@ policycap open_perms;
 # to the rawip_socket class.
 policycap extended_socket_class;
 
+# Enable NoNewPrivileges support.  Requires libsepol 2.7+
+# and kernel 4.14 (estimated).
+#
+# Checks enabled;
+# process2: nnp_transition, nosuid_transition
+#
+policycap nnp_nosuid_transition;

private/security_classes

@@ -130,6 +130,8 @@ class kcm_socket
 class qipcrtr_socket
 class smc_socket
 
+class process2
+
 # Property service
 class property_service          # userspace