Do not include common SE policies automatically

Automatic additions to BOARD_SEPOLICY_UNION from Android.mk do not
guarantee order or precedence of rules. More often than not, these
rules get included _after_ the device's own, which makes
it impossible for the device to extend them, or even to use types
defined here.

Manually include these in the device's BoardConfig with
"include device/qcom/sepolicy/sepolicy.mk" before
its own specific BOARD_SEPOLICY_DIRS (if any) instead. Or just
include files piecemeal.

Change-Id: I2ce0c3ec325906a46570b26c5f0c2018390d2ec9
thermal: Fix labeling the thermal sockets

Change-Id: Iffdaca86f539ede159aa9c02f8839e0f69bfc1d9
mediaserver: Fix access to perflock (thermal)

Change-Id: I30edc8e6aa189d4c5da2b83e90d27ec53c1f044d
camera: Fix domain socket labeling

Change-Id: I42094eb1064eca4cf227ee7af559427b160f476e
thermal: Allow socket creation at /dev/socket

Change-Id: I090179b83404c0a19917a79d705b74a57a982971
time_daemon: Fix labeling the time atom data files

Change-Id: I49c270cfb6853f0e6f94335b9d84bc85ab97e1e2
sepolicy: add rule for dpm

add rule for DPM data file for db file
and removed duplicate rules

Change-Id: Ieed4f0b1cf19df06c04528245a0c6b799518542a
Seandroid: Added rules to thermal-engine

Added rules to thermal-engine for access to thermal-sockets which
is needed for  mediaserver ,camera and couple of other services.

Change-Id: I7f5f89c112357ee595f275b20325fede40439924
sepolicy: Update policy for time daemon

This patch updates the socket permission for time-daemon.

Change-Id: Ifc7d377585e9699a21ed569fe0402de35992c13b
Sepolicy: Fix camera & surface flinger denials

Device node were not proper /dev/msm_camera was
labelled as audio_device which is wrong and
/dev/msm_rotator as well as audio_device, so
changing the label to appropriate to fix the false positive
denials.

Change-Id: I7b3ebbcb9999d794823ee7c0d7cad330d50be02e
sepolicy: Update policy for secure components

Playready stores license under /data/data/app_ms. All TZ apps including
Playready would create their own directory under /data/misc/qsee.
To get test apps working with older dir structure, userdebug mode
build would have permision to create directory under /data/data.
Test apps based on newer targets must move to new structure.
Also add policies for secureUI.

Change-Id: Ibc4412ca9e8e065d54263bb46333bd223dfb553d
SEAndroid: Fixing few denials

This fixes the below issues

1. 744304 - SELinux Surf port Enumeration issue
   Files changed - mdm_helper.te
                 - rild.te
                 - file_contexts
                 - file.te
                 - rmt_storage.te
                 - device.te
2. 751137 - WIFI is not turning ON
   Files Changed - wpa.te
                 - system_server.te

3. Issues related to CTS testInitDomain and boot up
   denials for other domains.

CRs-fixed: 744304 751137

Change-Id: I2785e85592a10468a667be363e6115e27b76707f
msm8960: Add rules for bridgemgr

Most Fusion devices have this to talk to rmnet.
Add common rules for it

Change-Id: If2989904be017b6f979da99bfd321ac62ddbbfbb
mpdecision: Let mpdecision tune KSM

Change-Id: I6d7511d94996dcec974b671d681fd70a8dbc4290
HAX: Enable access to diag on user builds

This should be temporary. Some components (radio and display, mostly)
still rely on diag for logging, and its absence makes the whole subsystem
spin and break things. Pending fixing those components, re-enable diag.

Change-Id: Ic6badb3f89d08ef247455bc669392bea53c33bab