1022142223 - Mergebot : Merge manual pull request from upstream source for external_sepolicy with the following commits:

commit cbc36489a60bddbee9857aaddb027290e4b22ef8
Author:     Steve Kondik <shade@chemlab.org>
AuthorDate: Thu Jun 12 02:22:11 2014 -0700
Commit:     Steve Kondik <shade@chemlab.org>
CommitDate: Thu Jun 12 02:22:11 2014 -0700

    sepolicy: Fix a few denials when using backup service

    Change-Id: Ia5c307a126d42f1dd5952f809f8b4ca1c686a33c

commit c22b6c9f022c0f64c7e48067dd5c7fa6ff67d7dd
Merge: 4e7819d 9702e49
Author:     Ricardo Cerqueira <cyanogenmod@cerqueira.org>
AuthorDate: Tue Jun 3 03:05:16 2014 +0100
Commit:     Ricardo Cerqueira <cyanogenmod@cerqueira.org>
CommitDate: Tue Jun 3 03:05:16 2014 +0100

    Merge tag 'android-4.4.3_r1' into HEAD

    Android 4.4.3 release 1

    Change-Id: Ia2768fd8748d3fef11e2e0692e881b4bdb585ee1

commit 9702e49307aa738508bb0949bac3000fe9ec5a0d
Author:     jaejyn.shin <jaejyn.shin@lge.com>
AuthorDate: Tue Dec 24 08:59:53 2013 +0900
Commit:     Nick Kralevich <nnk@google.com>
CommitDate: Thu Mar 13 16:21:46 2014 -0700

    DO NOT MERGE: Adding permissions needed to remove cache

    During removing cache data using Zipper application, I found violation logs.

    avc:  denied  { write } for  pid=198 comm="installd" name="cache" dev="mmcblk0p29" ino=81680 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
    avc:  denied  { remove_name } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
    avc:  denied  { unlink } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=file

    Reproduction path is like below
    1. Downloading Zipper application from Google Play (I used Zipper 1.9.9.2)
    2. Clicking option and clicking "removing cache" button
    3. Select "yes"
    4. Violation show up

    (cherry picked from commit 9cc6d8d581b6094b36c59a0e95d674cb193916e8)

    Bug: 13450421
    Change-Id: I487ccd1d8d58bf2c590af39a7b1eb448c113670e

commit 2a2a4936c2223e9b3a70b177a97c270aa1aa2740
Author:     Takeshi Aimi <takeshi.aimi@sonymobile.com>
AuthorDate: Tue Nov 26 20:19:08 2013 +0900
Commit:     Nick Kralevich <nnk@google.com>
CommitDate: Thu Mar 13 16:21:38 2014 -0700

    DO NOT MERGE: Make bluetooth, nfc, radio and shell adb-installable

    bluetooth, nfc, radio and shell are not explicitly declared
    in installd.te. This prevents applications in those group
    from upgrading by "adb install -r".

    You can reproduce the issue by following step:
     1. adb pull /system/priv-app/Shell.apk
     2. adb install -r Shell.apk
     3. install failed with the error log blow

    [Error in logcat]
    E/installd(  338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/com.android.shell-1': Permission denied
    E/installd(  338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/Shell': Permission denied

    [Error in dmesg]
    <5>[  112.053301] type=1400 audit(1387412796.071:10): avc:  denied  { create } for  pid=337 comm="installd" name="lib" scontext=u:r:installd:s0 tcontext=u:object_r:shell_data_file:s0 tclass=lnk_file

    This operation fails only if the app belongs to any of the
    groups specified in the commit title.

    (cherry picked from commit f5e90004a30a2cb5c1a1d70134a32d68994e2568)

    Bug: 13450421
    Change-Id: Ie38d05c1306bebd90b0f15c1d4e1a55f6798d497