Make bluetooth_loader enforcing.

Change-Id: Ic58eb73e8bb3bcfb625c7c0b7597d08058b8cae0
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
fixup sensors files.

The sensors data files are improperly labeled on old
devices. Fix them up.

Bug: 12416169
Change-Id: I3377c0993cec21535f07233ff9b7d72334b0cf08
Merge "fixup sensors files."
Address /proc/sys/net access by netmgrd.

Patch solves the following denial.

type=1400 msg=audit(3021494.429:151): avc:  denied  { write } for  pid=757 comm="sh" name="accept_ra" dev="proc" ino=6088 scontext=u:r:netmgrd:s0 tcontext=u:object_r:proc_net:s0 tclass=file

Change-Id: If8b2643e7bc6cfd699bb435ca2ad40284e70e08d
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Address /proc/sys/net access by netmgrd."
Address new thermald and mpdecision SELinux denials.

* The thermal service needs rw access to
  /sys/module/msm_thermal/pmic_sw_mode/vdd_dig/mode and
  /sys/module/msm_thermal/vdd_restriction/enabled. Allow
  dac_override for now til the perms can be properly
  fixed in the kernel. The perms are:
    --w----r-T root     root              u:object_r:sysfs:s0 mode
    --w----r-T root     root              u:object_r:sysfs:s0 enabled

* In order to avoid a dac_override with access to
  /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
  the perms were changed to 664 from 644. This allows
  both mpdecision and thermal services to access it.
  This addressed the following denials:
type=1400 msg=audit(2996841.439:197): avc:  denied  { dac_override } for  pid=1944 comm="mpdecision" capability=1  scontext=u:r:mpdecision:s0 tcontext=u:r:mpdecision:s0 tclass=capability

* In order to avoid another dac_override with access to
  /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  thermal service nows runs with the system group id.
  This addressed the following denial.
type=1400 msg=audit(3008460.600:19): avc:  denied  { dac_override } for  pid=195 comm="thermal-engine-" capability=1  scontext=u:r:thermald:s0 tcontext=u:r:thermald:s0 tclass=capability

* Give the thermal service read access to the /dev/socket/mpdecision
  directory. This address the following denial.
type=1400 msg=audit(3007815.520:23): avc:  denied  { search } for  pid=262 comm="thermal-engine-" name="mpdecision" dev="tmpfs" ino=6071 scontext=u:r:thermald:s0 tcontext=u:object_r:mpdecision_socket:s0 tclass=dir

* Add new wpa rule to allow access to persist partition files.
type=1400 msg=audit(3090909.619:194): avc:  denied  { search } for  pid=851 comm="wpa_supplicant" name="/" dev="mmcblk0p16" ino=2 scon
text=u:r:wpa:s0 tcontext=u:object_r:persist_file:s0 tclass=dir
type=1400 msg=audit(3093618.959:200): avc:  denied  { search } for  pid=3062 comm="wpa_supplicant" name="wifi" dev="mmcblk0p16" ino=12 scontext=u:r:wpa:s0 tcontext=u:object_r:persist_wifi_file:s0 tclass=dir

Change-Id: Ied2293d9effb1b2d9e043e01c08b5e7be407c868
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Address new thermald and mpdecision SELinux denials."
Make thermald enforcing.

Change-Id: I546d7bf03aed80b15e69c5b9596ea2298a378634
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Make thermald enforcing."
Make mpdecision enforcing.

Change-Id: I1955ec610c0e5a9fffc2bc488b57ed99d18a58c5
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Make mpdecision enforcing."
add bug to thermald dac_override message

Change-Id: Ia75713b418396145e18c5acacb7a662f7b1ae524
Merge "add bug to thermald dac_override message"
allow system_server to access /dev/rtc0

Addresses the following denials:

<5>[  121.559060] type=1400 audit(1389412679.098:15): avc:  denied  { read write } for  pid=837 comm="Binder_2" name="rtc0" dev="tmpfs" ino=6532 scontext=u:r:system_server:s0 tcontext=u:object_r:rtc:s0 tclass=chr_file
<5>[  121.559301] type=1400 audit(1389412679.098:16): avc:  denied  { open } for  pid=837 comm="Binder_2" name="rtc0" dev="tmpfs" ino=6532 scontext=u:r:system_server:s0 tcontext=u:object_r:rtc:s0 tclass=chr_file
<5>[  121.568976] type=1400 audit(1389412679.098:17): avc:  denied  { ioctl } for  pid=837 comm="Binder_2" path="/dev/rtc0" dev="tmpfs" ino=6532 scontext=u:r:system_server:s0 tcontext=u:object_r:rtc:s0 tclass=chr_file

Change-Id: I57bbb6a26439ae26a40bedc31d7eae1167c0cc50
Allow platform_app to connect to time daemon

Addresses the following denial:

<5>[  122.065279] type=1400 audit(1389412679.598:18): avc:  denied  { connectto } for  pid=3248 comm="omm.timeservice" path=0074696D655F67656E6F6666 scontext=u:r:platform_app:s0 tcontext=u:r:time:s0 tclass=unix_stream_socket

Change-Id: I55ec57700bc8dd4205adb39c981794de93c187c3
Merge "Make bluetooth_loader enforcing."
Use userdebug_or_eng in domain.te

For /dev/diag

Change-Id: I9692a0bb55cdf1d8bf4786f178be42dca44fea5f
Merge "allow system_server to access /dev/rtc0"
Move camera back into permissive_or_unconfined

Seeing the following denial. Rollback to allow us to investigate.

<5>[  188.554821] type=1400 audit(1389638517.272:1337): avc:  denied  { write } for  pid=201 comm="mm-qcamera-daem" name="sensor_ctl_socket" dev="mmcblk0p28" ino=162882 scontext=u:r:camera:s0 tcontext=u:object_r:apk_data_file:s0 tclass=sock_file

This conceptually reverts commit 4d22124901c4c2e8134645ca944658a38be73f97.

Bug: 12529574
Change-Id: I2c21e313580659e611f886eb2eae0fe3429f5f4c
Merge "Move camera back into permissive_or_unconfined"