Use concatenation versus assignment when making policy declarations

* Use concatenation versus assignment when making
  policy declarations inside BoardConfig.mk. This
  will allow sepolicy to exist in the vendor
  directory.

Change-Id: I0709fa4b8d6eaeac2fa11cd1b7106f459e443dc4
Merge "Use concatenation versus assignment when making policy declarations" into klp-dev-plus-aosp
am d09b2915: Revert "Revert "hammerhead: Add support for modem logging""

* commit 'd09b29155c8c640f17dab0484db5beab0e2ebd10':
  Revert "Revert "hammerhead: Add support for modem logging""
am f09d974e: hammerhead: update releasetools.py for different bootloader layout

* commit 'f09d974e9d8da5f6581ec6a7960dc52b545efa7e':
  hammerhead: update releasetools.py for different bootloader layout
am 95e090f2: Merge "hammerhead: Remove Manage Mobile Plan" into klp-dev

* commit '95e090f27f835032ddc8944b06772898de562fb9':
  hammerhead: Remove Manage Mobile Plan
am d9f4bb0d: Merge "Remove several proprietary blobs" into klp-dev

* commit 'd9f4bb0dfa055afa3d50bf63c47c25268d0b49b4':
  Remove several proprietary blobs
am 382b4a25: Merge "Update propietary blobs for hammerhead" into klp-dev

* commit '382b4a25379e8c5d6ba762b25aeeeb065c352ddb':
  Update propietary blobs for hammerhead
am b5dfeed4: Merge "Hammerhead: NFC: Fix PREINIT_DSP config." into klp-dev

* commit 'b5dfeed46d5941a4347ea840bd7902bccf78e6f1':
  Hammerhead: NFC: Fix PREINIT_DSP config.
am f02334e1: Merge "hammerhead: Add mms overlay for lliad and Bouygues Telecom" into klp-dev

* commit 'f02334e1f5b41f7896348814ee5e541dd9653063':
  hammerhead: Add mms overlay for lliad and Bouygues Telecom
am 1d0123cf: hammerhead: Force full GLES virtual layers to go via HWC

* commit '1d0123cf17e692b726f4df6c632f00e68a572e53':
  hammerhead: Force full GLES virtual layers to go via HWC
Label more files in /dev

Addresses the following denials:

Bluetooth denials:

<5>[   90.748659] type=1400 audit(1383147543.197:30): avc:  denied  { read write } for  pid=2024 comm="bt_hc_worker" name="ttyHS99" dev="tmpfs" ino=6169 scontext=u:r:bluetooth:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[   90.748835] type=1400 audit(1383147543.197:31): avc:  denied  { open } for  pid=2024 comm="bt_hc_worker" name="ttyHS99" dev="tmpfs" ino=6169 scontext=u:r:bluetooth:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[   90.751471] type=1400 audit(1383147543.197:32): avc:  denied  { ioctl } for  pid=2024 comm="bt_hc_worker" path="/dev/ttyHS99" dev="tmpfs" ino=6169 scontext=u:r:bluetooth:s0 tcontext=u:object_r:device:s0 tclass=chr_file

NFC denials:

<5>[   78.948661] type=1400 audit(544163.129:22): avc:  denied  { read write } for  pid=1369 comm=4173796E635461736B202331 name="bcm2079x" dev="tmpfs" ino=6097 scontext=u:r:nfc:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[   78.948859] type=1400 audit(544163.129:23): avc:  denied  { open } for  pid=1369 comm=4173796E635461736B202331 name="bcm2079x" dev="tmpfs" ino=6097 scontext=u:r:nfc:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[   78.949091] type=1400 audit(544163.129:24): avc:  denied  { ioctl } for  pid=1369 comm=4173796E635461736B202331 path="/dev/bcm2079x" dev="tmpfs" ino=6097 scontext=u:r:nfc:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[   80.463356] type=1400 audit(544164.639:25): avc:  denied  { ioctl } for  pid=1369 comm=4173796E635461736B202331 path="/dev/bcm2079x" dev="tmpfs" ino=6097 scontext=u:r:nfc:s0 tcontext=u:object_r:device:s0 tclass=chr_file

Change-Id: I367edcfd5d6b40f082fee263291457cd56b65996
Initial empty repository
keystore: label /dev/qseecom

This is needed to allow keystore to communicate with
/dev/qseecom.

Addresses the following SELinux denials on HH:

<5>[    4.793579] type=1400 audit(714558.370:5): avc:  denied  { read write } for  pid=191 comm="keystore" name="qseecom" dev="tmpfs" ino=6707 scontext=u:r:keystore:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[    4.793705] type=1400 audit(714558.370:6): avc:  denied  { open } for  pid=191 comm="keystore" name="qseecom" dev="tmpfs" ino=6707 scontext=u:r:keystore:s0 tcontext=u:object_r:device:s0 tclass=chr_file
<5>[    4.793739] type=1400 audit(714558.370:7): avc:  denied  { ioctl } for  pid=191 comm="keystore" path="/dev/qseecom" dev="tmpfs" ino=6707 scontext=u:r:keystore:s0 tcontext=u:object_r:device:s0 tclass=chr_file

Change-Id: I6de80dfc9f7331526e636707e4679e8680920372
Merge remote-tracking branch 'origin/kitkat-dev'
Label /firmware as firmware_file.

This corrects an incorrect labeling of this filesystem (was
previously sdcard_external) and fixes a ueventd denial.

Addresses the following denials:

<5>[    4.739128] type=1400 audit(804445.290:5): avc:  denied  { read } for  pid=205 comm="ueventd" name="mba.mdt" dev="mmcblk0p1" ino=3 scontext=u:r:ueventd:s0 tcontext=u:object_r:sdcard_external:s0 tclass=file
<5>[    4.739285] type=1400 audit(804445.290:6): avc:  denied  { open } for  pid=205 comm="ueventd" name="mba.mdt" dev="mmcblk0p1" ino=3 scontext=u:r:ueventd:s0 tcontext=u:object_r:sdcard_external:s0 tclass=file
<5>[    4.739474] type=1400 audit(804445.290:7): avc:  denied  { getattr } for  pid=205 comm="ueventd" path="/firmware/image/mba.mdt" dev="mmcblk0p1" ino=3 scontext=u:r:ueventd:s0 tcontext=u:object_r:sdcard_external:s0 tclass=file

Change-Id: I2927eaad3259424bf09c8ed7c0878a6643bc3214
am 077cefc2: hammerhead: Show LTE icon for KT operator

* commit '077cefc2423684fbfdd5f93951624f8379765555':
  hammerhead: Show LTE icon for KT operator
am 71cfe462: hammerhead: Remove logwrapper for wpa_supplicant

* commit '71cfe4623c29611169ac4ab001d7f527393106b1':
  hammerhead: Remove logwrapper for wpa_supplicant
am e6c9c815: Merge "Add power figures for Batched scan" into klp-dev

* commit 'e6c9c81514595c2fc454425fa8051cad7fd991bd':
  Add power figures for Batched scan
Move rmt into its own domain.

Don't run rmt in init's domain. /system/bin/rmt_storage
is a qualcomm specific daemon responsible for servicing modem
filesystem requests. It doesn't make sense to run rmt_storage
in init's domain, as doing so prevents us from fine tuning
its policy.

Keep the domain in permissive mode right now until we address
the following denials:

<5>[    4.745809] type=1400 audit(1394980.310:5): avc:  denied  { read write } for  pid=181 comm="rmt_storage" name="mem" dev="tmpfs" ino=5667 scontext=u:r:rmt:s0 tcontext=u:object_r:kmem_device:s0 tclass=chr_file
<5>[    4.746108] type=1400 audit(1394980.310:6): avc:  denied  { open } for  pid=181 comm="rmt_storage" name="mem" dev="tmpfs" ino=5667 scontext=u:r:rmt:s0 tcontext=u:object_r:kmem_device:s0 tclass=chr_file
<5>[    6.621710] type=1400 audit(1394981.710:14): avc:  denied  { read write } for  pid=181 comm="rmt_storage" path="/dev/mem" dev="tmpfs" ino=5667 scontext=u:r:rmt:s0 tcontext=u:object_r:kmem_device:s0 tclass=chr_file

We still need to get a better understanding of what rmt_storage
does and what rules should be applied to it.

Change-Id: I60df78bd453e11fe0527e68796468764085139e4
am 120fc0d4: Use special TMobile tethering APN on HH

* commit '120fc0d4a851a4ce51e22bf52e53772edd038e1f':
  Use special TMobile tethering APN on HH