Make bluetooth_loader enforcing.

Change-Id: Ic58eb73e8bb3bcfb625c7c0b7597d08058b8cae0
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Allow the radio to access qmux

Addresses the following denial:

<5>[  508.313455] type=1400 audit(1389033492.145:78): avc:  denied  { search } for  pid=3932 comm="QcRilReceiver" name="qmux_radio" dev="tmpfs" ino=6056 scontext=u:r:radio:s0 tcontext=u:object_r:qmuxd_socket:s0 tclass=dir

And the following logcat error messages:

E/QcrilMsgTunnelSocket( 3916): IOExceptionjava.io.IOException: Permission deniedReason: Permission denied
E/QcrilMsgTunnelSocket( 3916): Couldn't find 'qmux_radio/rild_oem0' socket after 8 times, continuing to retry silently

Change-Id: I7894aea69a7b5c956948527e55fc1a7b73f5e165
allow sensors dac_override

sensors needs dac_override, otherwise the folllowing logcat messages occur:

E/Sensors (  192): sns_debug_main.c(438):Debug Config File missing in EFS!
E/Sensors (  192): sns_smr_util.c(104):Unable to initialize service 259 with QCCI, timed out (2000 ms)
E/Sensors (  192): sns_acm_mr.c(388):Error getting info for service 3
E/Sensors (  192): sns_main.c(819):bind error 98
E/Sensors (  192): sns_main.c(819):bind error 98
D/SensorService(  752): nuSensorService starting...
I/qcom_sensors_hal(  752): hal_init: Setting log level to 4
E/qcom_sensors_hal(  752): hal_init: Error in sensor_reg_write(): -4
E/qcom_sensors_hal(  752): hal_check_ltcy_ssi_reg_flag: Error in sensor_reg_read() for reg flag: -4
E/qcom_sensors_hal(  752): hal_check_ltcy_ssi_reg_flag: Error in sensor_reg_read() for reg flag: -4
E/qcom_sensors_hal(  752): hal_check_ltcy_ssi_reg_flag: Error in sensor_reg_read() for reg flag: -4
E/qcom_sensors_hal(  752): hal_check_ltcy_ssi_reg_flag: Error in sensor_reg_read() for reg flag: -4
E/qcom_sensors_hal(  752): hal_check_ltcy_ssi_reg_flag: Error in sensor_reg_read() for reg flag: -4
E/qcom_sensors_hal(  752): _hal_sensors_get_sensors_list: sensor1 init failed
E/qcom_sensors_hal(  752): _hal_sensors_get_sensors_list: sensor1 init failed

One way this bug manifests itself is by breaking screen autorotation.

  PRE-CONDITION:
  - Auto-rotate screen should be enabled (Settings > Accessibility > Auto-rotate screen)

  STEPS TO REPRODUCE:
  1. Launch any of the apps(Chrome,Gmail, Keep..) > change the orientation to landscape mode

  OBSERVED RESULTS:
  - Auto rotate screen not functioning for landscape mode

  EXPECTED RESULTS:
  - Device should display landscape/portrait mode as per user selection when auto-rotate screen option is enabled

Change-Id: I85cabeb28ab9e28a729d3930bfc454522f2a42cf
Merge "Allow the radio to access qmux"
Merge "allow sensors dac_override"
Mark /dev/jpeg* as camera_device

Fixes the following denial:

<5>[  169.494636] type=1400 audit(1389041883.193:26): avc:  denied  { read write } for  pid=3061 comm="cam_data_proc" name="jpeg0" dev="tmpfs" ino=7185 scontext=u:r:mediaserver:s0 tcontext=u:object_r:device:s0 tclass=chr_file

Bug: 12416198
Change-Id: I2671c835c9b7385e77a674843b990ec8e974d444
Merge "Mark /dev/jpeg* as camera_device"
fixup sensors files.

The sensors data files are improperly labeled on old
devices. Fix them up.

Bug: 12416169
Change-Id: I3377c0993cec21535f07233ff9b7d72334b0cf08
Merge "fixup sensors files."
Address /proc/sys/net access by netmgrd.

Patch solves the following denial.

type=1400 msg=audit(3021494.429:151): avc:  denied  { write } for  pid=757 comm="sh" name="accept_ra" dev="proc" ino=6088 scontext=u:r:netmgrd:s0 tcontext=u:object_r:proc_net:s0 tclass=file

Change-Id: If8b2643e7bc6cfd699bb435ca2ad40284e70e08d
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Address /proc/sys/net access by netmgrd."
Address new thermald and mpdecision SELinux denials.

* The thermal service needs rw access to
  /sys/module/msm_thermal/pmic_sw_mode/vdd_dig/mode and
  /sys/module/msm_thermal/vdd_restriction/enabled. Allow
  dac_override for now til the perms can be properly
  fixed in the kernel. The perms are:
    --w----r-T root     root              u:object_r:sysfs:s0 mode
    --w----r-T root     root              u:object_r:sysfs:s0 enabled

* In order to avoid a dac_override with access to
  /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
  the perms were changed to 664 from 644. This allows
  both mpdecision and thermal services to access it.
  This addressed the following denials:
type=1400 msg=audit(2996841.439:197): avc:  denied  { dac_override } for  pid=1944 comm="mpdecision" capability=1  scontext=u:r:mpdecision:s0 tcontext=u:r:mpdecision:s0 tclass=capability

* In order to avoid another dac_override with access to
  /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
  thermal service nows runs with the system group id.
  This addressed the following denial.
type=1400 msg=audit(3008460.600:19): avc:  denied  { dac_override } for  pid=195 comm="thermal-engine-" capability=1  scontext=u:r:thermald:s0 tcontext=u:r:thermald:s0 tclass=capability

* Give the thermal service read access to the /dev/socket/mpdecision
  directory. This address the following denial.
type=1400 msg=audit(3007815.520:23): avc:  denied  { search } for  pid=262 comm="thermal-engine-" name="mpdecision" dev="tmpfs" ino=6071 scontext=u:r:thermald:s0 tcontext=u:object_r:mpdecision_socket:s0 tclass=dir

* Add new wpa rule to allow access to persist partition files.
type=1400 msg=audit(3090909.619:194): avc:  denied  { search } for  pid=851 comm="wpa_supplicant" name="/" dev="mmcblk0p16" ino=2 scon
text=u:r:wpa:s0 tcontext=u:object_r:persist_file:s0 tclass=dir
type=1400 msg=audit(3093618.959:200): avc:  denied  { search } for  pid=3062 comm="wpa_supplicant" name="wifi" dev="mmcblk0p16" ino=12 scontext=u:r:wpa:s0 tcontext=u:object_r:persist_wifi_file:s0 tclass=dir

Change-Id: Ied2293d9effb1b2d9e043e01c08b5e7be407c868
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Address new thermald and mpdecision SELinux denials."
Make thermald enforcing.

Change-Id: I546d7bf03aed80b15e69c5b9596ea2298a378634
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Make thermald enforcing."
Make mpdecision enforcing.

Change-Id: I1955ec610c0e5a9fffc2bc488b57ed99d18a58c5
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Merge "Make mpdecision enforcing."
add bug to thermald dac_override message

Change-Id: Ia75713b418396145e18c5acacb7a662f7b1ae524
Merge "add bug to thermald dac_override message"
allow system_server to access /dev/rtc0

Addresses the following denials:

<5>[  121.559060] type=1400 audit(1389412679.098:15): avc:  denied  { read write } for  pid=837 comm="Binder_2" name="rtc0" dev="tmpfs" ino=6532 scontext=u:r:system_server:s0 tcontext=u:object_r:rtc:s0 tclass=chr_file
<5>[  121.559301] type=1400 audit(1389412679.098:16): avc:  denied  { open } for  pid=837 comm="Binder_2" name="rtc0" dev="tmpfs" ino=6532 scontext=u:r:system_server:s0 tcontext=u:object_r:rtc:s0 tclass=chr_file
<5>[  121.568976] type=1400 audit(1389412679.098:17): avc:  denied  { ioctl } for  pid=837 comm="Binder_2" path="/dev/rtc0" dev="tmpfs" ino=6532 scontext=u:r:system_server:s0 tcontext=u:object_r:rtc:s0 tclass=chr_file

Change-Id: I57bbb6a26439ae26a40bedc31d7eae1167c0cc50