Files in /proc/net leak information. This change is the first step in
determining which files apps may use, whitelisting benign access, and
otherwise removing access while providing safe alternative APIs.

To that end, this change:
* Introduces the proc_net_type attribute which will assigned to any
new SELinux types in /proc/net to avoid removing access to privileged
processes. These processes may be evaluated later, but are lower
priority than apps.
* Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing
use by VPN apps. This may be replaced by an alternative API.
* Audits all other proc/net access for apps.
* Audits proc/net access for other processes which are currently
granted broad read access to /proc/net but should not be including
storaged, zygote, clatd, logd, preopt2cachename and vold.

Bug: 9496886
Bug: 68016944
Test: Boot Taimen-userdebug. On both wifi and cellular: stream youtube
    navigate maps, send text message, make voice call, make video call.
    Verify no avc "granted" messages in the logs.
Test: A few VPN apps including "VPN Monster", "Turbo VPN", and
"Freighter". Verify no logspam with the current setup.
Test: atest CtsNativeNetTestCases
Test: atest netd_integration_test
Test: atest QtaguidPermissionTest
Test: atest FileSystemPermissionTest

Change-Id: I7e49f796a25cf68bc698c6c9206e24af3ae11457

am: 97b66cb5

Change-Id: Ifcb2f1b137943c4f481e6ef8c19ac211e1b15ece

am: 558cdf1e

Change-Id: I998cb4d7b507c39ddd027a9e24646303c4765512

am: f08328b0

Change-Id: Ia7d4f56cb596cc6aa5d8517d38ba5437ab678f35

am: 62861f86

Change-Id: Ia6eefc0d79c77ba363faccb42fb3e8d9e7f9ce24

am: c9dd7149

Change-Id: Ideee1c776e572f0e8d90eb340f1d2e58b1182a4c

am: e53b335d

Change-Id: I02bd67f5aca4a24f5759eda5728b9ed55b0d8454

am: 0f59d0b1

Change-Id: I0cd1ab02d104e051000673b12e155feb36fafb69

am: e505a35d

Change-Id: I7183822e3930dc6ef1b995027d784831b74aaf9f

am: 7a99df89

Change-Id: I577f211e913fd5ad2150a54d6931a810ec58cb43

am: f3220aa6

Change-Id: Ibf50ab24fa12e07fc44e89420bba99d5665156d9

am: 9d28625f

Change-Id: Iadb2f23c577f3641ed9785891c97a000d757957a

avc: denied { read } for name="ext4" dev="sysfs" ino=32709
scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0
tclass=dir permissive=0 b/72749888
avc: denied { read } for name="state" dev="sysfs" ino=51318
scontext=u:r:priv_app:s0:c512,c768
tcontext=u:object_r:sysfs_android_usb:s0 tclass=file permissive=0
b/72749888

Bug: 72749888
Test: build/boot taimen-userdebug. No more logspam
Change-Id: Ic43d1c8b71e1e5e0e6f9af1e03816c4084120e7e

System components should use the public tagSocket() API, not direct
file access to /proc/net/xt_qtaguid/* and /dev/xt_qtaguid.

Test: build/boot taimen-userdebug. Use youtube, browse chrome,
    navigate maps on both cellular and wifi.
Bug: 68774956

Change-Id: Id895395de100d8f9a09886aceb0d6061fef832ef

Remove unecessary access to /proc/net/xt_qtaguid/ctrl and
/dev/xt_qtaguid.

Bug: 68774956
Test: atest CtsNativeNetTestCases
Test: adb root; atest tagSocket
Change-Id: If3a1e823be0e342faefff28ecd878189c68a8e92

am: 49733255

Change-Id: I412a4ffeba18478ec634344d8ebf29b5ac992d31

am: 5f98693a

Change-Id: Iaeaaeb8195e2ffcbf148b1764d57d4e1c7da6f4f

am: 985db6d8

Change-Id: I1c05fb2469df71f5572aaf8ed88333dc3c92d3c5

Bug: 72177715
Test: flash device and check incident output
Change-Id: I16c172caec235d985a6767642134fbd5e5c23912

[automerger skipped] Merge "Reland "Allow dexopt to follow /odm/lib(64) symlinks.""" into pi-dev am: 3c0b8c01  -s ours
am: 7b0e2f1b  -s ours

Change-Id: Id186b40893925459baf924427a7447fb94b6b565

am: 41cc2b05

Change-Id: I14036bfad3b59bf2add0de1f3001b23f0d908980

am: 3c0b8c01  -s ours

Change-Id: I1a3b2f22453bf846f0d68d13aa72c57822c336a8

am: f7d49787

Change-Id: Ia141cdcd71b7f76a566ce2f9d0cf720d90693af2

am: e8db0b37

Change-Id: I1a100b79b00618af667c31bb7651762ce6dd822d

am: d093691c

Change-Id: Ie6ffba47ea2164260d60115a738c57f0e47f04be

am: 38a84cf8

Change-Id: I76cbd596ac70b065c288b30855db956fd456b5f6

am: a7fea58d  -s ours

Change-Id: Id99363967c8837494a320cbbde800869de97ef55

am: fcbc3fcf  -s ours

Change-Id: I7e0cbf7981125ab29c7dbc3942e2c8db635d5379

am: 40e6b795  -s ours

Change-Id: I08541ef49695b32c24cdfcff9c112cb9cf7c9ccb

am: 7698c72f  -s ours

Change-Id: I8e68dd92f2513906a0fcceaffaeb464b7ff66237

am: 6fd5da1c

Change-Id: If73b6334e0a1b2fdf4912f90578f2e0099bf0e49

* changes:
  Test that /proc files have proc_type attribute.
  Assert types labeled in genfs_contexts have correct attributes

am: c9f91a8c

Change-Id: I19acbd57012782c82995dacd3165a6ae8605c00a

am: c69cbe55

Change-Id: I741c90bf96d43b6ab5227696ac24d8891cf5dc97