Rewrite mediaserver socket rule using macro.

Addresses denials such as:
 avc:  denied  { ioctl } for  pid=31771 comm="mediaserver" path="socket:[217520]" dev="sockfs" ino=217520 scontext=u:r:mediaserver:s0 tcontext=u:r:mediaserver:s0 tclass=socket

Change-Id: Iecae88d88b5fbc1ff348077b8bb926b835fda2e5
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Rewrite mediaserver socket rule using macro."
Allow mpdecision to read mediaserver /proc/pid files.

Addresses denials such as:
avc:  denied  { search } for  pid=2341 comm="mpdecision" name="189" dev="proc" ino=9688 scontext=u:r:mpdecision:s0 tcontext=u:r:mediaserver:s0 tclass=dir

Change-Id: Ie32ea31d2d77929d0f7d4480208b50c099f71c7e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow thermald to connect to mpdecision.

Addresses denials such as:
 avc:  denied  { write } for  pid=1519 comm="thermal-engine-" name="mpdecision" dev="tmpfs" ino=8778 scontext=u:r:thermald:s0 tcontext=u:object_r:mpdecision_socket:s0 tclass=sock_file

Change-Id: Ib8d420fe04bb2e0bca3ad4d3849ec59e9de54a91
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow mediaserver to connect to mpdecision.

Both hammerhead and flo sepolicy allow this and the corresponding
allow rule for mpdecision to read mediaserver /proc/pid entries
seems to presuppose this one.

Change-Id: I5988fdd46f1377f1f9df58bdf83ea342fd3c14ed
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Allow removal of qmux sockets.

hammerhead and flo sepolicy already allow this, and it seems logical
for allowing the domain to remove its own socket files from the
directory.

Change-Id: I1fc5e40a0e15d37aaa581789e0db3414ed50e80f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Allow removal of qmux sockets."
Merge "Allow mediaserver to connect to mpdecision."
Merge "Allow thermald to connect to mpdecision."
Merge "Allow mpdecision to read mediaserver /proc/pid files."
Allow execution of /system/bin/ip commands.

netmgrd can run ip commands, allow this.
Remove dontaudit rules related to running external helpers.
This will generate some log noise on boot due to
sh -c 'rm /data/data_test/modem_port_status' commands but could
otherwise conceal denied execution of other helper programs.

Change-Id: I4ae3870c3d58a0b39eeb767310b045416265940c
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Allow execution of /system/bin/ip commands."
Allow netmgrd to execute sh.

It invokes helper programs such as /system/bin/ip via sh -c.
In the future, look at reworking netmgrd to directly invoke
the helper programs and/or to transition to a different domain
upon sh invocation to shed unnecessary permissions.

Also rewrite the system_file rule for /system/bin/ip to use
the rx_file_perms macro for consistency.

Change-Id: I407d4503868e928dd876cce932fe6a96fcbd4e0d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Allow netmgrd to execute sh."
Merge remote-tracking branch 'origin/master'