Start enforcing SELinux rules for install_recovery. Change-Id: I052c7d2203babf3e146cf32794283e80ca21dd9a
Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8