Do not change ownership on /sys/fs/selinux/enforce.

There is no longer any reason to permit system UID to set enforcing mode.

Change-Id: Ie28beed1ca2b215c71f2847e2390cee1af1713c3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Log a warning on services that lack SELinux domains.

Sample output on flo:
<3>[    7.270568] init: Warning!  Service irsc_util needs a SELinux domain defined; please fix!
<3>[    8.290832] init: Warning!  Service bootanim needs a SELinux domain defined; please fix!

Change-Id: If5514b188517917d58ee81c446af563b0443be45
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Run the console service shell in the shell domain.

This allows it to be permissive in userdebug/eng builds
but confined/enforcing in user builds.

Change-Id: Ie322eaa0acdbefea2de4e71ae386778c929d042b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls.

If checkreqprot == 1, SELinux only checks the protection flags passed
by the application, even if the kernel internally adds PROT_EXEC for
READ_IMPLIES_EXEC personality flags.  Switch to checkreqprot == 0
to check the final protection flags applied by the kernel.

Change-Id: Ic39242bbbd104fc9a1bcf2cd2ded7ce1aeadfac4
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Set security context of /adb_keys and /data/misc/adb/adb_keys.

I97b3d86a69681330bba549491a2fb39df6cf20ef introduced a separate type
for the adb_keys file.  Set the security context of the adb_keys file
accordingly by adding restorecon commands to init.rc.

Change-Id: I30e4d2a1ae223a03eadee58a883c79932fff59fe
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Move restorecon and restorecon_recursive code to libselinux.

This requires telling libselinux to use the sehandle already
obtained by init rather than re-acquiring it internally.  init
retains ownership of the sehandle because it performs the
initial load, uses the sehandle for other purposes (e.g. labeling
of directories created via mkdir and labeling of socket files),
and handles the policy reload property trigger.

Change-Id: I4a380caab7f8481c33eb64fcdb16b6cabe918ebd
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Move creation of /data/misc/wifi and /data/misc/dhcp to main init.rc file.

mkdir /data/misc/wifi subdirectories and /data/misc/dhcp is performed
in the various device-specific init*.rc files but seems generic.
Move it to the main init.rc file.

Drop the separate chown for /data/misc/dhcp as this is handled by mkdir
built-in if the directory already exists.

Add a restorecon_recursive /data/misc/wifi/sockets.

Change-Id: I51b09c5e40946673a38732ea9f601b2d047d3b62
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Trigger a policy reload from post-fs-data.

Once userdata is available and decrypted, trigger a policy reload to pick
up any policy update files stored under /data/security.

Change-Id: Ic2b3121c3395429b108c40d1d7f5a3124a5896c5
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Apply restorecon_recursive to all of /data.

With the following prior changes:
I77bf2a0c4c34b1feef6fdf4d6c3bd92dbf32f4a1
I698b1b2c3f00f31fbb2015edf23d33b51aa5bba1
I8dd915d9bb80067339621b905ea2b4ea0fa8d71e
it should now be safe (will correctly label all files)
and reasonably performant (will skip processing unless
file_contexts has changed since the last call) to call
restorecon_recursive /data from init.rc.

The call is placed after the setprop selinux.policy_reload 1 so that
we use any policy update under /data/security if present.

Change-Id: Ib8d9751a47c8e0238cf499fcec61898937945d9d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Revert "toolbox: Add levelFromUid categorization support to restorecon"

This reverts commit 679e2100087be07878a506ff0f7748a32811a40d.

Change-Id: Ifaa97a7e2552667d7f8dcef75bb877d1692f5c88
Unify toolbox restorecon and libselinux restorecon implementations.

Extend the libselinux restorecon implementation to allow reuse
by the toolbox restorecon command.  This simply requires adding
support for the nochange (-n) and verbose (-v) options to the
libselinux functions and rewriting the toolbox restorecon command
to use the libselinux functions.   Also add a force (-F) option to
support forcing a restorecon_recursive even if the restorecon_last
attribute matches the current file_contexts hash so that we can
continue to force a restorecon via the toolbox command for testing
or when we know something else has changed (e.g. for when we support
relabeling /data/data and package information has changed).

Change-Id: I92bb3259790a7195ba56a5e9555c3b6c76ceb862
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Convert all selinux_android_restorecon and _setfilecon calls to new API.

libselinux selinux_android_restorecon API is changing to the more
general interface with flags and dropping the older variants.

Also get rid of the old, no longer used selinux_android_setfilecon API
and rename selinux_android_setfilecon2 to it as it is the only API in use.

Change-Id: I1e71ec398ccdc24cac4ec76f1b858d0f680f4925
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Add -D option to restorecon for relabeling /data/data.

This depends on change I137588013ed1750315702c0dbe088ce3e4a29e83.

Change-Id: I690982f6612ef3744c73a1f20220f28c326cfd5f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Expose /dev/hw_random to group "system".

This is needed to let EntropyMixer (runs inside system_server) read
from /dev/hw_random.

Change-Id: Ica698afece9d7fd23adbdd68878e0ad052be78a7
Merge "Expose /dev/hw_random to group "system"." into pac-4.4
Handle policy reloads within ueventd rather than restarting it.

Restarting ueventd upon policy reloads has reportedly created
stability problems for some users and could cause events to be lost.
Stop restarting ueventd and instead handle policy reloads within ueventd.

Also stops restarting installd upon policy reloads.

Change-Id: Ic7f310d69a7c420e48fbc974000cf4a5b9ab4a3b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge remote-tracking branch 'pac/pac-4.4' into pac-4.4