p50x: Enable selinux support

Change-Id: I5dafd00adcb077066c0287df0d745842a420c420
Add permission checking for binder IPC.

Do not apply permission checks to private files.

Fix security_binder_transfer_binder hook.

Drop the owning task argument to security_binder_transfer_binder
since ref->node->proc can be NULL (dead owner?).
Revise the SELinux checking to apply a single transfer check between
the source and destination tasks.  Owning task is no longer relevant.
Drop the receive permission definition as it is no longer used.

This makes the transfer permission similar to the call permission; it is only
useful if you want to allow a binder IPC between two tasks (call permission)
but deny passing of binder references between them (transfer permission).

Change-Id: I51e7a9a6662e826073b35e4f70a57f9ec73e472e
Signed-off-by: William Roberts <w.roberts@sta.samsung.com>

Conflicts:

	drivers/staging/android/binder.c
Add permission checking for binder IPC.

Do not apply permission checks to private files.

Fix security_binder_transfer_binder hook.

Drop the owning task argument to security_binder_transfer_binder
since ref->node->proc can be NULL (dead owner?).
Revise the SELinux checking to apply a single transfer check between
the source and destination tasks.  Owning task is no longer relevant.
Drop the receive permission definition as it is no longer used.

This makes the transfer permission similar to the call permission; it is only
useful if you want to allow a binder IPC between two tasks (call permission)
but deny passing of binder references between them (transfer permission).

Change-Id: I51e7a9a6662e826073b35e4f70a57f9ec73e472e
Signed-off-by: William Roberts <w.roberts@sta.samsung.com>

Conflicts:

	drivers/staging/android/binder.c
Do not ratelimit audit messages. We want to see them all.

Change-Id: I19c29788cc33b0f59e0bdfe04fe67c247239c559
Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
yaffs: fix getxattr support

When passed a buffer size of 0, getxattr(2) is documented to return the
size of the attribute value.  However, yaffs returns -ERANGE instead.
This breaks SELinux usage of getxattr.  Fix yaffs to return the
attribute size in this case.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
yaffs: set security attribute at file creation

Add support to yaffs to set the security attribute of new inodes when
they are created.  This parallels similar support in other filesystems,
and is a requirement for SELinux and other MAC systems.

Change-Id: I4038621dc92af43573ec022a7cf09a0ec1bd5870
Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
usb:gadget:android: avoid sending extra uevents

Don't schedule a uevet from android_disconnect
if there is no change in the connection state
and if the DISCONNECT event was already sent.
This patch will avoid these unecessary messages:

android_work: did not send uevent (0 0   (null))

Change-Id: I54d66ef84fc19791da94d32f82bf6e5dcef3786d