DO NOT MERGE: Make bluetooth, nfc, radio and shell adb-installable

bluetooth, nfc, radio and shell are not explicitly declared
in installd.te. This prevents applications in those group
from upgrading by "adb install -r".

You can reproduce the issue by following step:
 1. adb pull /system/priv-app/Shell.apk
 2. adb install -r Shell.apk
 3. install failed with the error log blow

[Error in logcat]
E/installd(  338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/com.android.shell-1': Permission denied
E/installd(  338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/Shell': Permission denied

[Error in dmesg]
<5>[  112.053301] type=1400 audit(1387412796.071:10): avc:  denied  { create } for  pid=337 comm="installd" name="lib" scontext=u:r:installd:s0 tcontext=u:object_r:shell_data_file:s0 tclass=lnk_file

This operation fails only if the app belongs to any of the
groups specified in the commit title.

(cherry picked from commit f5e90004a30a2cb5c1a1d70134a32d68994e2568)

Bug: 13450421
Change-Id: Ie38d05c1306bebd90b0f15c1d4e1a55f6798d497
DO NOT MERGE: Adding permissions needed to remove cache

During removing cache data using Zipper application, I found violation logs.

avc:  denied  { write } for  pid=198 comm="installd" name="cache" dev="mmcblk0p29" ino=81680 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
avc:  denied  { remove_name } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir
avc:  denied  { unlink } for  pid=198 comm="installd" name="downloadfile.apk" dev="mmcblk0p29" ino=82247 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=file

Reproduction path is like below
1. Downloading Zipper application from Google Play (I used Zipper 1.9.9.2)
2. Clicking option and clicking "removing cache" button
3. Select "yes"
4. Violation show up

(cherry picked from commit 9cc6d8d581b6094b36c59a0e95d674cb193916e8)

Bug: 13450421
Change-Id: I487ccd1d8d58bf2c590af39a7b1eb448c113670e
Add rules to permit CTS security-related tests to run.

Change-Id: I184458af1f40de6f1ab99452e76ba586dad1319e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge tag 'android-4.4.3_r1' into HEAD

Android 4.4.3 release 1

Change-Id: Ia2768fd8748d3fef11e2e0692e881b4bdb585ee1
sepolicy: Fix a few denials when using backup service

Change-Id: Ia5c307a126d42f1dd5952f809f8b4ca1c686a33c
Merge branch 'cm-11.0' of https://github.com/CyanogenMod/android_external_sepolicy into philz