Move creation of /data/misc/wifi and /data/misc/dhcp to main init.rc file.

mkdir /data/misc/wifi subdirectories and /data/misc/dhcp is performed
in the various device-specific init*.rc files but seems generic.
Move it to the main init.rc file.

Change-Id: I51b09c5e40946673a38732ea9f601b2d047d3b62
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
DO NOT MERGE: Disable GPU RS driver due to AOSP incompatibility.

This change will necessitate a rebuilt GPU driver:
https://android-review.googlesource.com/80951

Change-Id: I70a0b43165b1166538facf15576d3df7185fda0a
Merge "Move creation of /data/misc/wifi and /data/misc/dhcp to main init.rc file."
Add file_contexts entries for socket files.

So that we do not relabel them on a restorecon -R /data.

Change-Id: I6306a1e77922731a8f8d380345cefe6851bbc91c
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Add file_contexts entries for socket files."
SELinux policy for rmt_storage process.

Initial policy helps address some of the following denials:

Wake lock access:
    avc:  denied  { append } for  pid=171 comm="rmt_storage" name="wake_lock" dev="sysfs" ino=57 scontext=u:r:rmt:s0 tcontext=u:object_r:sysfs_wake_lock:s0 tclass=file
    avc:  denied  { open } for  pid=171 comm="rmt_storage" name="wake_lock" dev="sysfs" ino=57 scontext=u:r:rmt:s0 tcontext=u:object_r:sysfs_wake_lock:s0 tclass=file

Capabilities (dropping uid and gid):
    avc:  denied  { setgid } for  pid=171 comm="rmt_storage" capability=6  scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=capability
    avc:  denied  { setuid } for  pid=171 comm="rmt_storage" capability=7  scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=capability

Cgroup controls:
    avc:  denied  { add_name } for  pid=171 comm="rmt_storage" name="9999" scontext=u:r:rmt:s0 tcontext=u:object_r:cgroup:s0 tclass=dir
    avc:  denied  { create } for  pid=171 comm="rmt_storage" name="9999" scontext=u:r:rmt:s0 tcontext=u:object_r:cgroup:s0 tclass=dir

Socket creation:
    avc:  denied  { read } for  pid=209 comm="rmt_storage" scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=socket
    avc:  denied  { create } for  pid=169 comm="rmt_storage" scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=socket
    avc:  denied  { ioctl } for  pid=169 comm="rmt_storage" path="socket:[7463]" dev="sockfs" ino=7463 scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=socket
    avc:  denied  { setopt } for  pid=169 comm="rmt_storage" scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=socket
    avc:  denied  { bind } for  pid=169 comm="rmt_storage" scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=socket
    avc:  denied  { read } for  pid=210 comm="rmt_storage" scontext=u:r:rmt:s0 tcontext=u:r:rmt:s0 tclass=socket

Access root block device to read MBR:
    avc:  denied  { read } for  pid=171 comm="rmt_storage" name="mmcblk0" dev="tmpfs" ino=6554 scontext=u:r:rmt:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file
    avc:  denied  { open } for  pid=171 comm="rmt_storage" name="mmcblk0" dev="tmpfs" ino=6554 scontext=u:r:rmt:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file

Also added the system group to the rmt_storage service to avoid
a dac_override denial when trying to access wake locks.

Change-Id: Ic4ea3500a1f1c3c4aff0da3fcb6dff984f74e8fe
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "DO NOT MERGE: Disable GPU RS driver due to AOSP incompatibility."
Merge "SELinux policy for rmt_storage process."
Move SELinux diag_device policy to userdebug/eng.

Also just remove all specific domain access and instead
allow diag_device access for all domains on the
userdebug/user builds.

Change-Id: If41fc97e10243fd53f5fcd9183a3ff3f5142b1c2
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Move SELinux diag_device policy to userdebug/eng."
Merge remote-tracking branch 'origin/master'