am 64cdd184: am 1cb990de: Merge "Remove errant newline from generated policy file."

* commit '64cdd184b62698523092293fe6b82553708e336f':
  Remove errant newline from generated policy file.
merge in master-release history after reset to master
Drop dontaudit sys_admin rule from installd.

Old Android kernels (e.g. kernel/goldfish android-2.6.29 commit 2bda29)
fell back to a CAP_SYS_ADMIN check even before checking uids if the cgroup
subsystem did not define its own can_attach handler.  This doesn't appear
to have ever been the case of mainline, and is not true of the 3.4 Android
kernels.  So we no longer need to dontaudit sys_admin to avoid log noise.

Change-Id: I3822600a06c242764a94f9b67d9fcd6f599d3453
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Drop dontaudit sys_admin rule from rild.

Old Android kernels (e.g. kernel/goldfish android-2.6.29 commit 2bda29)
fell back to a CAP_SYS_ADMIN check even before checking uids if the cgroup
subsystem did not define its own can_attach handler.  This doesn't appear
to have ever been the case of mainline, and is not true of the 3.4 Android
kernels.  So we no longer need to dontaudit sys_admin to avoid log noise.

Change-Id: I2faade6665a4adad91472c95f94bd922a449b240
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Drop dontaudit sys_admin rule from rild."
am 016e6365: Drop dontaudit sys_admin rule from installd.

* commit '016e636539093b00787183cbf56b684b91f94220':
  Drop dontaudit sys_admin rule from installd.
am 888d283c: Merge "Drop dontaudit sys_admin rule from rild."

* commit '888d283c30784bb61d4bd10878c85634b31da1d3':
  Drop dontaudit sys_admin rule from rild.
am a07e3590: am 016e6365: Drop dontaudit sys_admin rule from installd.

* commit 'a07e35903b3980511082be4a2e877c38154ad1cb':
  Drop dontaudit sys_admin rule from installd.
am ad4d8942: am 888d283c: Merge "Drop dontaudit sys_admin rule from rild."

* commit 'ad4d89422328f184d56afcd6d541a1bd5746ca49':
  Drop dontaudit sys_admin rule from rild.
merge in master-release history after reset to master
Exclude audit-related capabilities from unconfined domains.

Require them to be explicitly granted by specific allow rules.
audit_write is required to write an audit message from userspace.
audit_control is required to configure the audit subsystem.

Change-Id: I5aa4e3228f9b0bde3570689fe7a0d68e56861a17
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
am e8c9fdac: Exclude audit-related capabilities from unconfined domains.

* commit 'e8c9fdac46c2ae972fd9e0f97b442d59b349e718':
  Exclude audit-related capabilities from unconfined domains.
am 7d3a4ca0: am e8c9fdac: Exclude audit-related capabilities from unconfined domains.

* commit '7d3a4ca0643da348337e154a875612591f587dc4':
  Exclude audit-related capabilities from unconfined domains.
label app_process64 as zygote_exec

... otherwise zygote 64 won't run in the correct SELinux domain.

Bug: 13647418
Change-Id: Iada2bf26623784535b70647c472f69b735b8f4fc
am 6bf9bbc8: label app_process64 as zygote_exec

* commit '6bf9bbc82951536645d2cc02de19d928b6be2889':
  label app_process64 as zygote_exec
am 2061b33e: am 6bf9bbc8: label app_process64 as zygote_exec

* commit '2061b33eb42a04025f3ed0a2a2111dd802d92034':
  label app_process64 as zygote_exec
Merge "Allow reading of radio data files passed over binder."
am 3fa9b4dd: Merge "Allow reading of radio data files passed over binder."

* commit '3fa9b4ddcb4dcab0f133e05430400194c7556a3b':
  Allow reading of radio data files passed over binder.
am bcb73df1: am 3fa9b4dd: Merge "Allow reading of radio data files passed over binder."

* commit 'bcb73df12424a0046309c103025aa810f859bee9':
  Allow reading of radio data files passed over binder.
Treat seinfo=default name=<anything> as an error.

check_app already checks for usage of name= entries
in seapp_contexts with no seinfo= specification to
link it back to a signer in mac_permissions.xml.
However, one can avoid this error by specifying
a seinfo=default which merely matches the default
stanza of mac_permissions.xml without actually ensuring
that it is tied to a specific certificate.  Catch
that error case too.

Change-Id: If33cf21501e8bfee44d31c92b6341dfa583552b2
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>