Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9

* commit '71139516':
  Make ppp domain enforcing.

* commit '623b6361':
  Label /data/.layout_version with its own type.

* commit '2680a8c4':
  Make ppp domain enforcing.

* commit '132e56b9':
  Label /data/.layout_version with its own type.

* commit 'f78fb4e0':
  Make ppp domain enforcing.

* commit 'e3519d6c':
  Label /data/.layout_version with its own type.

The automerger is introducing duplicate rules. Clean them
up and make sure internal master is the same as AOSP master.

Change-Id: If6183947688b2adefbc54f048958221598d8d975

am a914acb1: am 6d439213: am bc36ce13: Merge "Restrict system_server to only the data file types needed."

* commit 'a914acb1':
  Restrict system_server to only the data file types needed.

* commit 'b372f246':
  DO NOT MERGE: remove duplicate rules.

* commit '6d439213':
  Restrict system_server to only the data file types needed.

* commit 'bc36ce13':
  Restrict system_server to only the data file types needed.

* commit 'd733117a':
  DO NOT MERGE: remove system_server sdcard_type

Another removal of duplicate rules, which don't occur in AOSP nor
internal master.

Change-Id: I363b6e8f5b87741ca5d837ab1858603d1bd8fb5b

* commit '8393d4b8':
  DO NOT MERGE: remove duplicate rules.

klp-modular-dev-plus-aosp has a rule allowing system_server
access to sdcard file descriptors, but this change isn't
in AOSP nor internal master.

This line was removed in https://android-review.googlesource.com/84081 .
Pull the line out from the -plus-aosp tree. DO NOT MERGE because
this change is already in internal master.

Change-Id: I0a1b08f75d309a5a1acb5dc1a44212f9d35eaf3e

klp-modular-dev-plus-aosp has duplicate SELinux rules in
system_server, which don't appear in AOSP or master. Delete
those duplicate rules, as they just make resolving merge
conflicts more difficult.

Change-Id: I0eaae453b887d08bddf16f963cef4c099fe2e9a6

* commit '5892d336':
  DO NOT MERGE: Fix broken halt while in healthd charger mode

* commit 'aeb3eb7c':
  DO NOT MERGE: Address system_server denials.

* commit '3ff8b536':
  DO NOT MERGE: Fix broken halt while in healthd charger mode

Change-Id: I20dc8bf1c8861c2152d5aa41f50cd4d44730056b

Reboots/halts aren't working in healthd charger mode. This is
causing high power draw in an unplugged, powered off state.

Steps to reproduce (on Nexus 5):
  Unplug device from USB charger/computer
  Turn device off
  Wait for device to turn off
  Plug in USB cable/charger
  Wait for charge animation (wait for animation, not just lightning bolt, may have to press power button briefly to get animation going)
  Wait for panel to turn off
  Unplug USB cable/charger
  Press power button again, notice screen turns on at some frame in the animation.
  (not important) Each press of the power button advances the animation
  Power on.
  Examine denials from /proc/last_kmsg

Addresses the following denials:

[   24.934809] type=1400 audit(12534308.640:8): avc:  denied  { write } for  pid=130 comm="healthd" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:healthd:s0 tcontext=u:object_r:proc_sysrq:s0 tclass=file
[   24.935395] type=1400 audit(12534308.640:9): avc:  denied  { sys_boot } for  pid=130 comm="healthd" capability=22  scontext=u:r:healthd:s0 tcontext=u:r:healthd:s0 tclass=capability

Bug: 13229119
Bug: 14833575

(cherry picked from commit 9ada894a)

Change-Id: I6175ad9225e847a0a40d558ac65c3544b22803d5

Label /proc/sysrq-trigger and allow access.
Label /dev/socket/mtpd and allow access.

Resolves denials such as:
avc:  denied  { getattr } for  pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { call } for  pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder

avc:  denied  { write } for  pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file

avc:  denied  { write } for  pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file

avc:  denied  { ptrace } for  pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process

avc:  denied  { sigkill } for  pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process

avc:  denied  { write } for  pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket

avc:  denied  { getattr } for  pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket

avc:  denied  { getattr } for  pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv
er:s0 tclass=udp_socket

avc:  denied  { getopt } for  pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket

avc:  denied  { getopt } for  pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket

avc:  denied  { read write } for  pid=21384 comm="rtsp" path="socket:[443742]"
dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s
0 tclass=tcp_socket

avc:  denied  { read write } for  pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket

avc:  denied  { setopt } for  pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket

avc:  denied  { setopt } for  pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket

avc:  denied  { getattr } for  pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file

avc:  denied  { read } for  pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file

avc:  denied  { unlink } for  pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file

avc:  denied  { getattr } for  pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { getopt } for  pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { read write } for  pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { write } for  pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file

Bug: 14833575

Change-Id: I23425b4ef1552ff31486d0a52ee2c69d6236691d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

* commit '24f18d69':
  Revisit kernel setenforce

* commit 'd0313c12':
  Allow ppp to inherit/use mtp unix datagram socket.

* commit '1a1abe51':
  Revisit kernel setenforce

* commit '24247d18':
  Allow ppp to inherit/use mtp unix datagram socket.

* commit 'f67e0ef3':
  Revisit kernel setenforce

* commit '4fc25052':
  Allow ppp to inherit/use mtp unix datagram socket.

* commit 'e83bbd7a':
  Allow mediaserver to use app-created pipes.

* commit '87bf6de9':
  Allow mediaserver to use app-created pipes.

* commit 'efc72991':
  Allow mediaserver to use app-created pipes.

Change-Id: If6b85fbb2332f7a03b603f2d46bd2f73c778ecf9
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Resolves denials such as:
avc:  denied  { read write } for  path="socket:[33571]" dev="sockfs" ino=33571 scontext=u:r:ppp:s0 tcontext=u:r:mtp:s0 tclass=unix_dgram_socket

Change-Id: Icb1ee00d8513179039bfb738647f49480e836f25
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Resolves denials such as:
 avc:  denied  { getattr } for  path="pipe:[167684]" dev="pipefs" ino=167684 scontext=u:r:mediaserver:s0 tcontext=u:r:untrusted_app:s0 tclass=fifo_file

Change-Id: I1120c8b130a592e40992c5233650345640a23a87
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>