Add CM SELinux policies

All credit goes to CM and those who contributed!

Add SELinux filesystem relabeling to init

Since not all recoveries out there will support the OTA packages'
own labeling, check at boot if the system needs labels (and
apply them)

Change-Id: I58767977b90a78a12efe7bd9d713654eadf47e7a

Conflicts:

	config/common.mk

selinux: Use a more reliable sentinel to flag /data labelling

/data/anr isn't present on all devices, /data/system is

Change-Id: Ifba71d073dc7b577911386cff316e8a19662cd0d

selinux: When adding userdata labels, do cache too

Change-Id: I0c1ff737629474135767be7cfe2bfbea0513fa9e

Enable the SELinux dialog in Settings

Change-Id: Icc708416d062bc811c83bce0841331c84afcb3f6

Conflicts:

	config/common.mk

sepolicy: Start CM Common sepolicy

Rather than having to maintain out of tree changes, it is often
easier to maintain a hiearchy of changes, starting with the vendors
common config file. From there, inheriting products can pick up a base
and start to add or remove certain bits from it, making use of the
BOARD_SEPOLICY_* functions documented in external/sepolicy/README.

Change-Id: I28a4aaf6c126535f0a88001582641b234a750015

Conflicts:

	config/common.mk

selinux: CM policies are now inserted last

Inclusion of the makefile is done by the build system to enforce
the wanted order

Change-Id: I86d7c6fb08b6bb1f6e0385e951a54827345aaf84

Conflicts:

	config/common.mk
	sepolicy/sepolicy.mk

selinux: Add CM-specific file_contexts

Change-Id: Ie70c59acedbb7be2f5b34a83c1d3d011f440ba05

selinux: Add missing seapp_contexts file

Change-Id: I6bda9e4876b9053ea16fe3c11c21b9c1e7acb17a

sepolicy: f2fs: Allow fs_use_xattr

Change-Id: I458d464598777fa06751dad0aa9cfd4d903a4de1

selinux: Fix asec mounting

Change-Id: I92392f3d810dfaf8dfc35f5c9170178a651d28dc

sepolicy: treat fuseblk as sdcard_external

Allow fuse-mounted NTFS/exFAT file systems to be written to

Change-Id: I1492914dd269a305e27aba58e61064d853adf2bc

sepolicy: allow installd to query ASEC size

installd need to query ASEC size on sdcard_external
to show on the Settings -> Apps page correctly.

Change-Id: I2d9a49b8f0652f05d73d0ff464a3835595e2cc3c

sepolicy: allow vold to create files on external sdcard

This is required for ASEC support. Vold can already create and
access directories, but do not yet have the permission for files.

Change-Id: I5082bbff692e5dc53c7000e4b3a293e42d33f901

sepolicy: allow vold to mount ext4 sdcard

When vold mounts an ext4 sdcard, it needs to force the context to
sdcard_external.

avc:  denied  { relabelfrom } for  pid=190 comm=vold scontext=u:r:vold:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem
avc:  denied  { relabelto } for  pid=190 comm=vold scontext=u:r:vold:s0 tcontext=u:object_r:sdcard_external:s0 tclass=filesystem
avc:  denied  { relabelfrom } for  pid=190 comm=vold scontext=u:r:vold:s0 tcontext=u:object_r:sdcard_external:s0 tclass=filesystem

Change-Id: I80f42fbdf738dee10958ce1bdc1893a41234f0d9

selinuxrelabel: Need to check in priv-app now

Change-Id: I67529c3b0f8baaac15fd475305eafd085feac112