audioserver has the same rules as mediaserver so there is
no loss of rights or permissions.

media.log moves to audioserver.

TBD: Pare down permissions.

Bug: 24511453
Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d

am: 67100b5f

* commit '67100b5f':
  Support fine grain read access control for properties

am: 42aaf56f

* commit '42aaf56f':
  shell.te: allow pulling the currently running SELinux policy

am: c28d9091

* commit 'c28d9091':
  Support fine grain read access control for properties

am: 6fa6bdb6

* commit '6fa6bdb6':
  Support fine grain read access control for properties

Properties are now broken up from a single /dev/__properties__ file into
multiple files, one per property label.  This commit provides the
mechanism to control read access to each of these files and therefore
sets of properties.

This allows full access for all domains to each of these new property
files to match the current permissions of /dev/__properties__.  Future
commits will restrict the access.

Bug: 21852512

Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094

am: d483d2f3

* commit 'd483d2f3':
  shell.te: allow pulling the currently running SELinux policy

am: ad22e867

* commit 'ad22e867':
  shell.te: allow pulling the currently running SELinux policy

am: 06366398

* commit '06366398':
  Allow priv_apps to stat files on the system partition

am: d95780ac

* commit 'd95780ac':
  Allow priv_apps to stat files on the system partition

Allow pulling the currently running SELinux policy for CTS.

Change-Id: I82ec03724a8e5773b3b693c4f39cc7b5c3ae4516

am: 1d58b2fd

* commit '1d58b2fd':
  Allow priv_apps to stat files on the system partition

Allows safetynet to scan the system partition which is made up of
files labeled system_file (already allowed) and/or files with the
exec_type attribute.

Bug: 25821333
Change-Id: I9c1c9c11bc568138aa115ba83238ce7475fbc5e4

am: d7ce3c6b

* commit 'd7ce3c6b':
  bootanim: Remove domain_deprecated

Explicitly added permissions that were previously granted through domain_deprecated. am: 15a1e0d4 am: 1bee3fd2
am: b969955d

* commit 'b969955d':
  Explicitly added permissions that were previously granted through domain_deprecated.

am: d9c22bc4

* commit 'd9c22bc4':
  bootanim: Remove domain_deprecated

am: a0757c4d

* commit 'a0757c4d':
  bootanim: Remove domain_deprecated

Remove domain_deprecated from bootanim. This removes some unnecessarily
permissive rules.

As part of this, re-allow access to cgroups, proc and sysfs, removed as
a result of removing domain_deprecated.

Bug: 25433265
Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c

am: 1bee3fd2

* commit '1bee3fd2':
  Explicitly added permissions that were previously granted through domain_deprecated.

am: 15a1e0d4

* commit '15a1e0d4':
  Explicitly added permissions that were previously granted through domain_deprecated.

domain_deprecated.

BUG: 25965160
Change-Id: I586d082ef5fe49079cb0c4056f8e7b34fae48c03

am: e6a97e97

* commit 'e6a97e97':
  mdnsd: Remove domain_deprecated

am: 8dc92446

* commit '8dc92446':
  mdnsd: Remove domain_deprecated

am: 4367cf2d

* commit '4367cf2d':
  mdnsd: Remove domain_deprecated

Remove domain_deprecated from mdnsd. This removes some unnecessarily
permissive rules from mdnsd.

As part of this, re-allow /proc/net access, which is removed as
a result of removing domain_deprecated.

Bug: 25433265
Change-Id: Ie1cf27179ac2e9170cf4cd418aea3256b9534603

am: d0f197d4

* commit 'd0f197d4':
  Add permissions back to app / shell domains

am: f7a0cc51

* commit 'f7a0cc51':
  Add permissions back to app / shell domains

am: 8ff6a86d

* commit '8ff6a86d':
  Add permissions back to app / shell domains

Allow directory reads to allow tab completion in rootfs to work.

"pm" is crashing due to failure to access /data/dalvik-cache. Add
back in the permissions from domain_deprecated.

Allow /sdcard to work again.

Bug: 25954400
Change-Id: I48cfa92fabfa47ed3007a63b85284659ba94ea73

am: 07d06266

* commit '07d06266':
  Allow appdomains to write on cgroup so it can start threads.

am: 781a4bed

* commit '781a4bed':
  Allow appdomains to write on cgroup so it can start threads.

am: d618eb6f

* commit 'd618eb6f':
  Allow appdomains to write on cgroup so it can start threads.

Addresses the following denial:

  avc: denied { write } for path="/dev/cpuctl/bg_non_interactive/tasks" dev="cgroup" ino=716 scontext=u:r:shell:s0 tcontext=u:object_r:cgroup:s0 tclass=file permissive=0

which started occurring because of https://android-review.googlesource.com/184260

Bug: 25945485
Change-Id: I6dcfb4bcfc473478e01e0e4690abf84c24128045

am: 06f94977

* commit '06f94977':
  Remove domain_deprecated from adbd and shell

am: 78d03007

* commit '78d03007':
  Remove domain_deprecated from adbd and shell

am: 8ca19368

* commit '8ca19368':
  Remove domain_deprecated from adbd and shell