yaffs: fix getxattr support

When passed a buffer size of 0, getxattr(2) is documented to return the
size of the attribute value.  However, yaffs returns -ERANGE instead.
This breaks SELinux usage of getxattr.  Fix yaffs to return the
attribute size in this case.

Change-Id: I0b18a7d551cf5f3e7d8b99e1397cd4828c69878c
Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
yaffs: set security attribute at file creation

Add support to yaffs to set the security attribute of new inodes when
they are created.  This parallels similar support in other filesystems,
and is a requirement for SELinux and other MAC systems.

Change-Id: I4038621dc92af43573ec022a7cf09a0ec1bd5870
Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
Do not ratelimit audit messages. We want to see them all.

Change-Id: I19c29788cc33b0f59e0bdfe04fe67c247239c559
Add permission checking for binder IPC.

Change-Id: If59988c217023a778b22a9ffb38d388d58462230
Do not apply permission checks to private files.

Change-Id: Ica8cb8ff1b9d51adb731abff871a8776d94a3dc6
Fix security_binder_transfer_binder hook.

Drop the owning task argument to security_binder_transfer_binder
since ref->node->proc can be NULL (dead owner?).
Revise the SELinux checking to apply a single transfer check between
the source and destination tasks.  Owning task is no longer relevant.
Drop the receive permission definition as it is no longer used.

This makes the transfer permission similar to the call permission; it is only
useful if you want to allow a binder IPC between two tasks (call permission)
but deny passing of binder references between them (transfer permission).

Change-Id: Ia102ff75b57c33f86bb79afd78c4188c1c71a705
Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Change-Id: I2cb5d34bf5a5a51aad8c21e86cf635349c843f45
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>