make init_gsi its own domain

..so that we are no longer violating Treble SELinux checks

BoardConfigCommon.mk

@@ -8,4 +8,3 @@ TARGET_SYSTEM_PROP := $(DEVICE_PATH)/system.prop
 
 # Sepolicy
 SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += $(DEVICE_PATH)/sepolicy/private
-SELINUX_IGNORE_NEVERALLOWS := true

init/init_gsi.rc

@@ -1,2 +1,2 @@
 on post-fs
-    exec u:r:init:s0 -- /system_ext/bin/init_gsi
+    exec -- /system_ext/bin/init_gsi

sepolicy/private/file_contexts

@@ -0,0 +1 @@
+/system/system_ext/bin/init_gsi        u:object_r:init_gsi_exec:s0

sepolicy/private/init.te

@@ -1 +0,0 @@
-allow init system_file:file execute_no_trans;

sepolicy/private/init_gsi.te

@@ -0,0 +1,7 @@
+type init_gsi, domain, coredomain;
+type init_gsi_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(init_gsi);
+
+# TODO: Address denials and remove this
+permissive init_gsi;