Augment SELinuxMMAC functionality.

* No longer support a package name stanza outside of
  a signature tag. Package names, by themselves, have
  no security associated with them in Android and thus we
  should not be allowing or encouraging this
  type of policy.

* Allow for nested package name stanzas inside
  signature stanzas. There are cases where a finer
  distinction needs to be made among apps signed with
  the same cert. New code allows a different seinfo
  tag to be assigned to the listed package names
  signed by the parent cert. When a determination needs
  to be made concerning seinfo assignments, the inner
  seinfo tag takes precedence over the outer seinfo
  labels which are assigned to just the signature.

* Temp structures are now used to parse new policy files
  until the entire xml file is parsed and deemed correct,
  at which time the temp structures are copied over to the
  permanent class structures. This ensures that any structural
  errors with the policy will not result in partial loads.

* Valid stanzas look like the following with the inner
  package piece being optional.

   <signer signature="">
     <seinfo value=""/>
     <package name="">
       <seinfo value=""/>
     </package>
   <signer>

   <default>
     <seinfo value=""/>
   </default>

Change-Id: Ia204d71211776dcf9b2dcc86ad6d77c4ad39dc25
Allow PMS to restorecon directories under /data.

This change applies a relabel to both /data/data and
/data/user directories on boot. Not every boot will
apply this relabeling however. The appropriate
seapp_contexts is hashed and compared to
/data/system/seapp_hash to decide if the relabel
should occur.

Change-Id: I05e8b438950ddb908e46c9168ea6ee601e6d674f
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Convert all selinux_android_restorecon and _setfilecon calls to new API.

libselinux selinux_android_restorecon API is changing to the more
general interface with flags and dropping the older variants.

Also get rid of the old, no longer used selinux_android_setfilecon API
and rename selinux_android_setfilecon2 to it as it is the only API in use.

Change-Id: I1e71ec398ccdc24cac4ec76f1b858d0f680f4925
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge remote-tracking branch 'aokp/kitkat' into kitkat