Switch app_* and isolated to _app and _isolated in seapp_contexts.

The app_* syntax was a legacy of the original approach of looking up
the username returned by getpwuid() and the original username encoding
scheme by bionic.  With the recent changes to move away from this approach,
there is no reason to retain that syntax.  Instead, just use _app to match
app UIDs and _isolated to match isolated service UIDs.  The underscore
prefix is to signify that these are not real usernames and to avoid
conflicts with any system usernames.

Requires a corresponding change to libselinux.

Change-Id: Ic388a12c1c9d3e47386c8849db607140ef8a3d75
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
am 3ac1d26a: Switch app_* and isolated to _app and _isolated in seapp_contexts.

* commit '3ac1d26a585b0cef73b626656e90005617725662':
  Switch app_* and isolated to _app and _isolated in seapp_contexts.
file class macro cleanup

Change-Id: I328bc882b3d6e200742e017aa23154fb01e638a5
Remove HAVE_SELINUX guard

Change-Id: I45b4a749bf4fb085d96d912871bae33aa5288119
allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access

- allow all apps to connect to the keystore over unix socket
- dhcp runs scripts in /system/etc/dhcpcd/dhcpcd-hooks and creates/removes lease files
- mtp connects to dnsproxyd when a pptp vpn connection is established
- allow appdomain to also open qtaguid_proc and release_app to read qtaguid_device
- WifiWatchDog uses packet_socket when wifi comes up
- apps interact with isolated_apps when an app uses an isolated service and uses sockets for that interaction
- for apps with levelFromUid=true to interact with isolated_app, isolated_app must be an mlstrustedsubject

Change-Id: I09ff676267ab588ad4c73f04d8f23dba863c5949
Signed-off-by: Joshua Brindle <jbrindle@tresys.com>
am 659aaced: Remove HAVE_SELINUX guard

* commit '659aaced054c21048c712fe1f5831a86c99213d8':
  Remove HAVE_SELINUX guard
Revert "ISSUE 6849488 Bluedroid stack, remove system/bluetooth."

This reverts commit b620dc60b17a5abaf88e05c1872367bf5e9c416f.

(cherry picked from commit 128db96282d907ea2b81e7598d45bba68c33d472)

Change-Id: I21227e6232c925a42597e5c8fc0fcc0585d7a876
Add a checkfc utility to check file_contexts validity and invoke it.

Change-Id: I4b12dc3dcb432edbdf95dd3bc97f809912ce86d1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
am 01a58af1: Add a checkfc utility to check file_contexts validity and invoke it.

* commit '01a58af19494420bb259505bc5404790a21fdd64':
  Add a checkfc utility to check file_contexts validity and invoke it.
Merge "file class macro cleanup"
Merge "allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access"
am 91c12e3c: Merge "file class macro cleanup"

* commit '91c12e3c0c7639cae727e8dec2d390474de546f9':
  file class macro cleanup
am 6766cc9e: Merge "allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access"

* commit '6766cc9e3c1d5dcec5db445a8d06bb6d4f301562':
  allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access
Add SELinux policy for asec containers.

Creates 2 new types:
- asec_apk_file : files found under /mnt/asec
                  when the asec images are mounted
- asec_image_file : the actual encrypted apks under
                    /data/app-asec

Change-Id: I963472add1980ac068d3a6d36a24f27233022832
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Add double free protection to checkseapp.

A double free error occurs when building with non glibc
devices. The hdestroy() function frees all comparison
keys internally in these cases. So avoid an explicit
call to free().

Change-Id: If9c5dc1a969605cd1eeb9218de02a9f8dbbd3ae1
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
am 5dbfdc0b: Add double free protection to checkseapp.

* commit '5dbfdc0b0fec04d670912c4eed179983f98abe8a':
  Add double free protection to checkseapp.
Use file target as dependency.

"sepolicy" is a phony target defined by the build system.
If you use it as dependency of a file target, you'll get unnecessary
rebuild.

Change-Id: I3a948ebbaff6a146050eb86a3d04cdc050f7c001
am d8b122c7: Use file target as dependency.

* commit 'd8b122c7bbe3a57620bee0a5c6bfcb8f7c574081':
  Use file target as dependency.
Add better per-device sepolicy support.

This is a rewrite of the existing implementation.
Three new variables are now needed to add/modify
the exisitng base policy. They are, BOARD_SEPOLICY_REPLACE
and BOARD_SEPOLICY_UNION which govern what files
are replaced and concatenated, and BOARD_SEPOLICY_DIRS
which lists the various directories that will contain
the BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_UNION
policy files.

Change-Id: Id33381268cef03245c56bc5242fec7da9b6c6493
Signed-off-by: rpcraig <robertpcraig@gmail.com>
resolved conflicts for merge of 47cd396b to jb-mr1-dev-plus-aosp

Change-Id: I3112f4cf0fafb6e7e3c9c60084a097f5e6190c22