Append to sepolicy variables

Change-Id: I0cf2a72b1219d9f7331323d97ab2bd017a076691
Correct executable bit for source files

Change-Id: Ic37634d5e53376b59d4df80caae2681f960fceee
Seandroid: Adding policy for QTI.

Adding policy for QTI.

Change-Id: Iea59e6add0540600effdbc117ef6dc7c88055218
Seandroid: Moving adbd to enforcing mode

Moving seandroid to enforcing mode

Change-Id: I2425464992e0ea8cc44f9680781e011340b48513
Seandroid: Adding policy for system_app

Adding policy for system_app to give access to debugfs

Change-Id: I98e5fff67d56840eb8b025223d94e28315e22765
EAndroid:add policy for init_shell

Adding policy for ini_shell for test scripts

Change-Id: Ic5c876b75612c6b8f06ee566ff144c6d50243c8a
sepolicy : Define policy for wcnss service domain

Adding wcnss domain and secontext needed for this domain.

Change-Id: I905a0e7b3e1672ead5980b81134c4d1a9b5164e5
Seandroid: Add policy for wbc services

Add policy for wbc services

Change-Id: I1ca863faeaac84382cc6e208fa4c869978d9b80a
sepolicy: add rule for CNE.

add rule for CNE data file for db file

Change-Id: I1dbc81f7be2bb4b4344336546622d351f5fa3e23
Seandroid: Adding dun service context.

Adding context for dun service

Change-Id: Ie20962700335058800ed0d42ed01c2f27e4f96de
Seandroid: Removing unused file

Removing unused file gloabal_macro.te

Change-Id: If5bd3813b0918ca08bbcebc4339d873f4abb95a9
Seandroid: Moving wpa related policies to wpa.te

Moving all wpa related issues to wpa.te and removing unnecessary
files

Change-Id: I610dbb0041ad89489fad2235f3d7cbb0c49edfb8
Seandroid: replacing policies with macro

Using macro for location services

Change-Id: Ic70498c3463803a36718091d43837c2f93e6d34b
SEAndroid: Add new location policy

Added policy for lowi-server to access
netlink sockets

Change-Id: I8fd6687d2b2e7c4dcb5e05b6f0541b3a24807b23
CRs-fixed: 747721
sepolicy: allow untrusted_app access to perflock

Add allow policy for untrusted app to write into
PerfLock socket

Change-Id: Ib494148895b38e352635511643fa90266c8d2ae9
netmgrd: allow communication with connectivity framework

Fix the following denials

Allow communication with cnd sockets
[   22.806091] type=1400 audit(1415054892.584:18): avc: denied { write }
for pid=1317 comm="netmgrd" name="cnd" dev="tmpfs" ino=8381
scontext=u:r:netmgrd:s0 tcontext=u:object_r:cnd_socket:s0 tclass=sock_file
[ 22.316132] type=1400 audit(1415053588.674:56): avc: denied
{ connectto } for pid=1321 comm="netmgrd" path="/dev/socket/cnd"
scontext=u:r:netmgrd:s0 tcontext=u:r:cnd:s0 tclass=unix_stream_socket

Allow operations on netlink xfrm sockets
[   20.794160] type=1400 audit(1415053541.505:16): avc: denied
{ setopt } for pid=1162 comm="ip" scontext=u:r:netmgrd:s0
tcontext=u:r:netmgrd:s0 tclass=netlink_xfrm_socket
[   20.794450] type=1400 audit(1415053541.505:17): avc: denied
{ getattr } for pid=1162 comm="ip" scontext=u:r:netmgrd:s0
tcontext=u:r:netmgrd:s0 tclass=netlink_xfrm_socket
[   20.794528] type=1400 audit(1415053541.505:18): avc: denied
{ write } for pid=1162 comm="ip" scontext=u:r:netmgrd:s0
tcontext=u:r:netmgrd:s0 tclass=netlink_xfrm_socket
[   20.794602] type=1400 audit(1415053541.505:19): avc: denied
{ nlmsg_write } for pid=1162 comm="ip" scontext=u:r:netmgrd:s0
tcontext=u:r:netmgrd:s0 tclass=netlink_xfrm_socket
[   20.794688] type=1400 audit(1415053541.505:20): avc: denied
{ read } for pid=1162 comm="ip" scontext=u:r:netmgrd:s0
tcontext=u:r:netmgrd:s0 tclass=netlink_xfrm_socket

Allow operations on netd and its resources
[   20.827567] type=1400 audit(1415053541.545:21): avc: denied { read }
for pid=1166 comm="ip" name="rt_tables" dev="mmcblk0p13" ino=268
scontext=u:r:netmgrd:s0 tcontext=u:object_r:net_data_file:s0 tclass=file
[   20.827802] type=1400 audit(1415053541.545:22): avc: denied { open }
for pid=1166 comm="ip" name="rt_tables" dev="mmcblk0p13" ino=268
scontext=u:r:netmgrd:s0 tcontext=u:object_r:net_data_file:s0 tclass=file
[   20.827915] type=1400 audit(1415053541.545:23): avc: denied { getattr
}for pid=1166 comm="ip" path="/data/misc/net/rt_tables" dev="mmcblk0p13"
ino=268 scontext=u:r:netmgrd:s0 tcontext=u:object_r:net_data_file:s0
tclass=file
[   21.480717] type=1400 audit(1415053542.195:24): avc: denied { getattr
} for pid=1259 comm="sh" path="/system/bin/ndc" dev="mmcblk0p12" ino=444
 scontext=u:r:netmgrd:s0 tcontext=u:object_r:wpa_exec:s0 tclass=file
[   21.481188] type=1400 audit(1415053542.195:25): avc: denied { execute
} for pid=1259 comm="sh" name="ndc" dev="mmcblk0p12" ino=444
scontext=u:r:netmgrd:s0 tcontext=u:object_r:wpa_exec:s0 tclass=file
[   21.482377] type=1400 audit(1415053542.195:26): avc: denied { read
open } for pid=1260 comm="sh" name="ndc" dev="mmcblk0p12" ino=444
scontext=u:r:netmgrd:s0 tcontext=u:object_r:wpa_exec:s0 tclass=file
[   21.482614] type=1400 audit(1415053542.195:27): avc: denied
{ execute_no_trans } for pid=1260 comm="sh" path="/system/bin/ndc"
dev="mmcblk0p12" ino=444 scontext=u:r:netmgrd:s0
tcontext=u:object_r:wpa_exec:s0 tclass=file
avc: denied { search } for pid=1168 comm="ip" name="net" dev="mmcblk0p34"
ino=210 scontext=u:r:netmgrd:s0 tcontext=u:object_r:net_data_file:s0
tclass=dir permissive=0

CRs-Fixed: 748457
Change-Id: Ie1044b498002602354b28f3c2e36bf1c9ee64e15
Do not include common SE policies automatically

Automatic additions to BOARD_SEPOLICY_UNION from Android.mk do not
guarantee order or precedence of rules. More often than not, these
rules get included _after_ the device's own, which makes
it impossible for the device to extend them, or even to use types
defined here.

Manually include these in the device's BoardConfig with
"include device/qcom/sepolicy/sepolicy.mk" before
its own specific BOARD_SEPOLICY_DIRS (if any) instead. Or just
include files piecemeal.

Change-Id: I2ce0c3ec325906a46570b26c5f0c2018390d2ec9