move sensors to enforcing.

The sensors SELinux domain is already in enforcing on
mako / flo / deb. Make the same change for hammerhead.

This change will start enforcing SELinux rules. SELinux policy
violations will return EPERM.

Change-Id: I9016ca9d5a8a326b603faaf996d28291e6e4a6ca
SELinux: Allow hostapd to read wifi data files under /persist.

Addresses the following denials:
  avc:  denied  { search } for  pid=9143 comm="hostapd" name="wifi" dev="mmcblk0p16" ino=12 scontext=u:r:hostapd:s0 tcontext=u:object_r:persist_wifi_file:s0 tclass=dir
  avc:  denied  { getattr } for  pid=9143 comm="hostapd" path="/persist/wifi/.macaddr" dev="mmcblk0p16" ino=19 scontext=u:r:hostapd:s0 tcontext=u:object_r:persist_wifi_file:s0 tclass=file
  avc:  denied  { read } for  pid=9143 comm="hostapd" name=".macaddr" dev="mmcblk0p16" ino=19 scontext=u:r:hostapd:s0 tcontext=u:object_r:persist_wifi_file:s0 tclass=file
  avc:  denied  { open } for  pid=9143 comm="hostapd" name=".macaddr" dev="mmcblk0p16" ino=19 scontext=u:r:hostapd:s0 tcontext=u:object_r:persist_wifi_file:s0 tclass=file

Change-Id: I090446b7b330fbeccf828a01bc539d10d51d51ca
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "SELinux: Allow hostapd to read wifi data files under /persist."
remove custom recovery animation

This installation animation is now the platform default.

Change-Id: Id0a4907a11925589f623c6749b5e69fdcf5203d3

Conflicts:
	recovery/recovery_ui.cpp
Merge "remove custom recovery animation"
Merge "move sensors to enforcing."
Make netmgrd domain enforcing.

Change-Id: Ie1bd4b5a362c4053dd37db8b0b9af519eaac6f5c
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Move camera domain into enforcing.

Change-Id: I0441dadd8dd75d3e5a75f75ac33ef3e4bb3342cf
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Move camera domain into enforcing."
Merge "Make netmgrd domain enforcing."
Rewrite mediaserver socket rule using macro.

Addresses denials such as:
 avc:  denied  { ioctl } for  pid=31771 comm="mediaserver" path="socket:[217520]" dev="sockfs" ino=217520 scontext=u:r:mediaserver:s0 tcontext=u:r:mediaserver:s0 tclass=socket

Change-Id: I2b4939a40a67bdde0bed9ea3b5da56f93f943f44
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Rewrite mediaserver socket rule using macro."
Fix mode on sysfs file to avoid need for thermald dac_override.

/sys/class/leds/lcd-backlight/brightness has system owner/group
and is only owner-writable which triggers CAP_DAC_OVERRIDE check
when thermald tries to write to it.  Fix by chmod 664 to make
it writable by group system, which thermald already has in its
group set.

Before the change:
-rw-r--r-- system   system            u:object_r:sysfs:s0 brightness

After the change:
-rw-rw-r-- system   system            u:object_r:sysfs:s0 brightness

The policy for thermald is left unchanged by this change; we can
continue to watch for further dac_override granted messages until
we are sure there are no further cases.

Change-Id: Ic9372d9c5cefeefbf3d2369e95b65f265df85a02
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Fix mode on sysfs file to avoid need for thermald dac_override."
Allow thermald to connect to mpdecision.

Addresses denials such as:
 avc:  denied  { write } for  pid=1519 comm="thermal-engine-" name="mpdecision" dev="tmpfs" ino=8778 scontext=u:r:thermald:s0 tcontext=u:object_r:mpdecision_socket:s0 tclass=sock_file

Change-Id: Ib8d420fe04bb2e0bca3ad4d3849ec59e9de54a91
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow mpdecision to read mediaserver /proc/pid files.

Addresses denials such as:
avc:  denied  { search } for  pid=2341 comm="mpdecision" name="189" dev="proc" ino=9688 scontext=u:r:mpdecision:s0 tcontext=u:r:mediaserver:s0 tclass=dir

Change-Id: Ie32ea31d2d77929d0f7d4480208b50c099f71c7e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Allow thermald to connect to mpdecision."
Merge "Allow mpdecision to read mediaserver /proc/pid files."