am 24247d18: am 4fc25052: Merge "Allow ppp to inherit/use mtp unix datagram socket."

* commit '24247d1898ac0e3158a8f3ba9f627345507d4aa4':
  Allow ppp to inherit/use mtp unix datagram socket.
am 1a1abe51: am f67e0ef3: Merge "Revisit kernel setenforce"

* commit '1a1abe51cf3c5cf90812d2ebc45fc14e9d5b6e2f':
  Revisit kernel setenforce
am d0313c12: am 24247d18: am 4fc25052: Merge "Allow ppp to inherit/use mtp unix datagram socket."

* commit 'd0313c12a83ed57fb5ffc985875905e4e59a79ec':
  Allow ppp to inherit/use mtp unix datagram socket.
am 24f18d69: am 1a1abe51: am f67e0ef3: Merge "Revisit kernel setenforce"

* commit '24f18d69f9c1841f863ea000b26ffb22fac4c7ea':
  Revisit kernel setenforce
DO NOT MERGE: Address system_server denials.

Label /proc/sysrq-trigger and allow access.
Label /dev/socket/mtpd and allow access.

Resolves denials such as:
avc:  denied  { getattr } for  pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { call } for  pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder

avc:  denied  { write } for  pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file

avc:  denied  { write } for  pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file

avc:  denied  { ptrace } for  pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process

avc:  denied  { sigkill } for  pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process

avc:  denied  { write } for  pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket

avc:  denied  { getattr } for  pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket

avc:  denied  { getattr } for  pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv
er:s0 tclass=udp_socket

avc:  denied  { getopt } for  pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket

avc:  denied  { getopt } for  pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket

avc:  denied  { read write } for  pid=21384 comm="rtsp" path="socket:[443742]"
dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s
0 tclass=tcp_socket

avc:  denied  { read write } for  pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket

avc:  denied  { setopt } for  pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket

avc:  denied  { setopt } for  pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket

avc:  denied  { getattr } for  pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file

avc:  denied  { read } for  pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file

avc:  denied  { unlink } for  pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file

avc:  denied  { getattr } for  pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { getopt } for  pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { read write } for  pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket

avc:  denied  { write } for  pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file

Bug: 14833575

Change-Id: I23425b4ef1552ff31486d0a52ee2c69d6236691d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
DO NOT MERGE: Fix broken halt while in healthd charger mode

Reboots/halts aren't working in healthd charger mode. This is
causing high power draw in an unplugged, powered off state.

Steps to reproduce (on Nexus 5):
  Unplug device from USB charger/computer
  Turn device off
  Wait for device to turn off
  Plug in USB cable/charger
  Wait for charge animation (wait for animation, not just lightning bolt, may have to press power button briefly to get animation going)
  Wait for panel to turn off
  Unplug USB cable/charger
  Press power button again, notice screen turns on at some frame in the animation.
  (not important) Each press of the power button advances the animation
  Power on.
  Examine denials from /proc/last_kmsg

Addresses the following denials:

[   24.934809] type=1400 audit(12534308.640:8): avc:  denied  { write } for  pid=130 comm="healthd" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:healthd:s0 tcontext=u:object_r:proc_sysrq:s0 tclass=file
[   24.935395] type=1400 audit(12534308.640:9): avc:  denied  { sys_boot } for  pid=130 comm="healthd" capability=22  scontext=u:r:healthd:s0 tcontext=u:r:healthd:s0 tclass=capability

Bug: 13229119
Bug: 14833575

(cherry picked from commit 9ada894a43b0542658b5bf68a7d9b41d05ee0974)

Change-Id: I6175ad9225e847a0a40d558ac65c3544b22803d5
resolved conflicts for merge of dfee702c to klp-modular-dev-plus-aosp

Change-Id: I20dc8bf1c8861c2152d5aa41f50cd4d44730056b
am 3ff8b536: DO NOT MERGE: Fix broken halt while in healthd charger mode

* commit '3ff8b53629c2204fd2c4aa45a3b285372f279626':
  DO NOT MERGE: Fix broken halt while in healthd charger mode
am aeb3eb7c: resolved conflicts for merge of dfee702c to klp-modular-dev-plus-aosp

* commit 'aeb3eb7c319b34de48b0994409f0e0e136846cfd':
  DO NOT MERGE: Address system_server denials.
am 5892d336: (-s ours) am 3ff8b536: DO NOT MERGE: Fix broken halt while in healthd charger mode

* commit '5892d336889b54280129b0398083111287e88c94':
  DO NOT MERGE: Fix broken halt while in healthd charger mode
DO NOT MERGE: remove duplicate rules.

klp-modular-dev-plus-aosp has duplicate SELinux rules in
system_server, which don't appear in AOSP or master. Delete
those duplicate rules, as they just make resolving merge
conflicts more difficult.

Change-Id: I0eaae453b887d08bddf16f963cef4c099fe2e9a6
DO NOT MERGE: remove system_server sdcard_type

klp-modular-dev-plus-aosp has a rule allowing system_server
access to sdcard file descriptors, but this change isn't
in AOSP nor internal master.

This line was removed in https://android-review.googlesource.com/84081 .
Pull the line out from the -plus-aosp tree. DO NOT MERGE because
this change is already in internal master.

Change-Id: I0a1b08f75d309a5a1acb5dc1a44212f9d35eaf3e
am 8393d4b8: (-s ours) DO NOT MERGE: remove duplicate rules.

* commit '8393d4b85363751fcc771959748c196bc5bc3c52':
  DO NOT MERGE: remove duplicate rules.
DO NOT MERGE: remove duplicate rules.

Another removal of duplicate rules, which don't occur in AOSP nor
internal master.

Change-Id: I363b6e8f5b87741ca5d837ab1858603d1bd8fb5b
am d733117a: (-s ours) DO NOT MERGE: remove system_server sdcard_type

* commit 'd733117a1e094b2dac5325be149f2fd55a161ce5':
  DO NOT MERGE: remove system_server sdcard_type
Merge "Restrict system_server to only the data file types needed."
am bc36ce13: Merge "Restrict system_server to only the data file types needed."

* commit 'bc36ce1385f938d3d6c69d280e1cada8680f3115':
  Restrict system_server to only the data file types needed.
am 6d439213: am bc36ce13: Merge "Restrict system_server to only the data file types needed."

* commit '6d4392137c7c71b80a73dcb63f61f8dbdb116a01':
  Restrict system_server to only the data file types needed.
am b372f246: (-s ours) DO NOT MERGE: remove duplicate rules.

* commit 'b372f2462fb958c9649576bfe75ad68fe5d0bf87':
  DO NOT MERGE: remove duplicate rules.
am a914acb1: am 6d439213: am bc36ce13: Merge "Restrict system_server to only the data file types needed."

* commit 'a914acb187f0cf2e5dc8fe14149dedf5dffbb8c6':
  Restrict system_server to only the data file types needed.