Allow system to getenforce, setenforce, setbool

Adding to the Device Admin API to allow Device Admin apps to change
SELinux and MMAC settings requires allowing the system_server (running
under system context) to change those settings.
Add seinfo tag to inner browser package stanza.

Per recent changes to SELinuxMMAC, we need to now
explicitly label inner package stanzas with their
seinfo tags. Prior to this, the inner package
stanza would just use the outer containers seinfo
tag.
Some edits to comments concerning mac_permissions.xml.

These mainly reflect recent changes to SELinuxMMAC which
allows inner package stanzas to hold an seinfo value.
Add SELinux policy for asec containers.

Creates 2 new types:
- asec_apk_file : files found under /mnt/asec
                  when the asec images are mounted
- asec_image_file : the actual encrypted apks under
                    /data/app-asec

Change-Id: I963472add1980ac068d3a6d36a24f27233022832
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Relocate setool program.

Moved from external/mac-policy/tools to
external/sepolicy/tools
Add AOSP Copyright header to select files.
Add description to setool usage statement.
Moved Android policy tools to tools directory

Change-Id: I9f82ce9b1f734d19328c61bd44c3eb9b3483e0a0

Conflicts:
	tools/Android.mk
Revert "Moved Android policy tools to tools directory"

This reverts commit e8ac72be35384f5930af1851e33b4ee9d2114a70.
Moved Android policy tools to tools directory

Change-Id: I57b0dd9f8071eae492020f410c87f465ba820711

Conflicts:
	tools/Android.mk
Merge branch 'master' into seandroid

Conflicts:
	tools/Android.mk
Add policy for run-as program.

Add policy for run-as program and label it in file_contexts.
Drop MLS constraints on local socket checks other than create/relabel
as this interferes with connections with services, in particular for
adb forward.

Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge branch 'master' into seandroid
Define a bluetooth domain for apps running in the bluetooth UID.
Policy changes for 4.2.
Further fixes for 4.2.
Update for changes to binder security checking.
Allow transferring refs to servicemanager.
Kill extra whitespace.
Allow binder reference transfer on server reply.