yaffs: fix getxattr support

When passed a buffer size of 0, getxattr(2) is documented to return the
size of the attribute value.  However, yaffs returns -ERANGE instead.
This breaks SELinux usage of getxattr.  Fix yaffs to return the
attribute size in this case.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
yaffs: set security attribute at file creation

Add support to yaffs to set the security attribute of new inodes when
they are created.  This parallels similar support in other filesystems,
and is a requirement for SELinux and other MAC systems.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
Enable SELinux and its dependencies in herring_defconfig.
Do not ratelimit audit messages. We want to see them all.

Change-Id: I19c29788cc33b0f59e0bdfe04fe67c247239c559
Add permission checking for binder IPC.
enable secmark labeling and netfilter security table for SE Android network access controls

Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
Do not apply permission checks to private files.
Fix security_binder_transfer_binder hook.

Drop the owning task argument to security_binder_transfer_binder
since ref->node->proc can be NULL (dead owner?).
Revise the SELinux checking to apply a single transfer check between
the source and destination tasks.  Owning task is no longer relevant.
Drop the receive permission definition as it is no longer used.

This makes the transfer permission similar to the call permission; it is only
useful if you want to allow a binder IPC between two tasks (call permission)
but deny passing of binder references between them (transfer permission).
Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge remote-tracking branch 'samsung/seandroid-samsung-3.0-jb-mr0' into linux
crespo: enable selinux

Change-Id: I15e6973db15ef9a26ecd94c7c640785d30015a5d
Merge remote-tracking branch 'cm/cm-10.2' into cm-10.2-samsung-3.0