Allow vold to invoke blkid, use external ASECs.

Bug: 11175082
Change-Id: Ic1bd15e8729583be199551ec6baeb4acaf46c210
netd: allow tcp connections.

DNS can use TCP connections, in addition to UDP connections.
Allow TCP connections.

Addresses the following denial:

[ 1831.586826] type=1400 audit(1384129166.563:173): avc:  denied  { create } for  pid=11406 comm="netd" scontext=u:r:netd:s0 tcontext=u:r:netd:s0 tclass=tcp_socket

Public Bug: https://code.google.com/p/android/issues/detail?id=62196
Bug: 11097631

(cherry picked from commit 36a5d109e6953c63d2a865eab4c4d021aa52250b)

Change-Id: Id2e383e1c74a26ef7e56499a33bf2b06b869c12b
netd: allow tcp_socket name_connect

The patch in 36a5d109e6953c63d2a865eab4c4d021aa52250b wasn't
sufficient to address DNS over TCP. We also need to allow
name_connect.

Fixes the following denial:

<5>[   82.120746] type=1400 audit(1830030.349:5): avc:  denied  { name_connect } for  pid=1457 comm="netd" dest=53 scontext=u:r:netd:s0 tcontext=u:object_r:port:s0 tclass=tcp_socket

Public Bug: https://code.google.com/p/android/issues/detail?id=62196
Bug: 11097631

(cherry picked from commit 91ebcf33326418ed9603e618ad193550646c3b04)

Change-Id: I62bba8777a5c8af1c0143e7ca2d915129ef38798
Let vold mount OBB files on external storage.

Fixes this specific violation:

type=1400 audit(1384468728.202:16): avc:  denied { read write } for
pid=271 comm="vold" name="test1.obb" dev="fuse" ino=3100664872
scontext=u:r:vold:s0 tcontext=u:object_r:sdcard_internal:s0
tclass=file

Bug: 11693888
Change-Id: I45d30ecabdf0bc8871f3dd67b5695ac909109d9a
Merge "Let vold mount OBB files on external storage." into klp-dev
DO NOT MERGE: Make bluetooth, nfc, radio and shell adb-installable

bluetooth, nfc, radio and shell are not explicitly declared
in installd.te. This prevents applications in those group
from upgrading by "adb install -r".

You can reproduce the issue by following step:
 1. adb pull /system/priv-app/Shell.apk
 2. adb install -r Shell.apk
 3. install failed with the error log blow

[Error in logcat]
E/installd(  338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/com.android.shell-1': Permission denied
E/installd(  338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/Shell': Permission denied

[Error in dmesg]
<5>[  112.053301] type=1400 audit(1387412796.071:10): avc:  denied  { create } for  pid=337 comm="installd" name="lib" scontext=u:r:installd:s0 tcontext=u:object_r:shell_data_file:s0 tclass=lnk_file

This operation fails only if the app belongs to any of the
groups specified in the commit title.

(cherry picked from commit f5e90004a30a2cb5c1a1d70134a32d68994e2568)

Bug: 13450421
Change-Id: Ie38d05c1306bebd90b0f15c1d4e1a55f6798d497
DO NOT MERGE: Adding permissions needed to remove cache

During removing cache data using Zipper application, I found violation logs.

avc:  denied  { write } for  pid=198 comm="installd" name="cache" dev="mmcblk0p29" ino=81680 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
avc:  denied  { remove_name } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
avc:  denied  { unlink } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=file

Reproduction path is like below
1. Downloading Zipper application from Google Play (I used Zipper 1.9.9.2)
2. Clicking option and clicking "removing cache" button
3. Select "yes"
4. Violation show up

(cherry picked from commit 9cc6d8d581b6094b36c59a0e95d674cb193916e8)

Bug: 13450421
Change-Id: I487ccd1d8d58bf2c590af39a7b1eb448c113670e
Merge tag 'android-4.4.3_r1.1' into v4.4plus

Android 4.4.3 release 1.1