Do not change ownership on /sys/fs/selinux/enforce.

There is no longer any reason to permit system UID to set enforcing mode.

Change-Id: Ie28beed1ca2b215c71f2847e2390cee1af1713c3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 9ce39c06784d34f1870dfbcc8ba5b4a61a98c533)
Run the console service shell in the shell domain.

This allows it to be permissive in userdebug/eng builds
but confined/enforcing in user builds.

Change-Id: Ie322eaa0acdbefea2de4e71ae386778c929d042b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 5f5bc4f07d3930199bf6e89037d41fcda95c95e6)
Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls.

If checkreqprot == 1, SELinux only checks the protection flags passed
by the application, even if the kernel internally adds PROT_EXEC for
READ_IMPLIES_EXEC personality flags.  Switch to checkreqprot == 0
to check the final protection flags applied by the kernel.

Change-Id: Ic39242bbbd104fc9a1bcf2cd2ded7ce1aeadfac4
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 0ad86b4ec9818a2665d06d97039702bc266ca386)
Set security context of /adb_keys and /data/misc/adb/adb_keys.

I97b3d86a69681330bba549491a2fb39df6cf20ef introduced a separate type
for the adb_keys file.  Set the security context of the adb_keys file
accordingly by adding restorecon commands to init.rc.

Change-Id: I30e4d2a1ae223a03eadee58a883c79932fff59fe
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit c37b2b81e9c13e5cfaf47c1a906dbf403a879722)
Move restorecon and restorecon_recursive code to libselinux.

This requires telling libselinux to use the sehandle already
obtained by init rather than re-acquiring it internally.  init
retains ownership of the sehandle because it performs the
initial load, uses the sehandle for other purposes (e.g. labeling
of directories created via mkdir and labeling of socket files),
and handles the policy reload property trigger.

Change-Id: I4a380caab7f8481c33eb64fcdb16b6cabe918ebd
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 38e85b93f4157ada294687ed117f98ff3224be58)
Move creation of /data/misc/wifi and /data/misc/dhcp to main init.rc file.

mkdir /data/misc/wifi subdirectories and /data/misc/dhcp is performed
in the various device-specific init*.rc files but seems generic.
Move it to the main init.rc file.

Drop the separate chown for /data/misc/dhcp as this is handled by mkdir
built-in if the directory already exists.

Add a restorecon_recursive /data/misc/wifi/sockets.

Change-Id: I51b09c5e40946673a38732ea9f601b2d047d3b62
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit e6d6bcdfa8a6dcd02b576966afb50daa69e2bd11)
Trigger a policy reload from post-fs-data.

Once userdata is available and decrypted, trigger a policy reload to pick
up any policy update files stored under /data/security.

Change-Id: Ic2b3121c3395429b108c40d1d7f5a3124a5896c5
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit d9ef0ee2e70afa63a3065ecc78cd5f4091d25df4)
Apply restorecon_recursive to all of /data.

With the following prior changes:
I77bf2a0c4c34b1feef6fdf4d6c3bd92dbf32f4a1
I698b1b2c3f00f31fbb2015edf23d33b51aa5bba1
I8dd915d9bb80067339621b905ea2b4ea0fa8d71e
it should now be safe (will correctly label all files)
and reasonably performant (will skip processing unless
file_contexts has changed since the last call) to call
restorecon_recursive /data from init.rc.

The call is placed after the setprop selinux.policy_reload 1 so that
we use any policy update under /data/security if present.

Change-Id: Ib8d9751a47c8e0238cf499fcec61898937945d9d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 78e03a24369f9ace9a2d259ee969d86814d43685)
Revert "toolbox: Add levelFromUid categorization support to restorecon"

This reverts commit 679e2100087be07878a506ff0f7748a32811a40d.

Change-Id: Ifaa97a7e2552667d7f8dcef75bb877d1692f5c88
(cherry picked from commit 84fa9beee6a2bce85b22b2083d6d009831147a25)
Unify toolbox restorecon and libselinux restorecon implementations.

Extend the libselinux restorecon implementation to allow reuse
by the toolbox restorecon command.  This simply requires adding
support for the nochange (-n) and verbose (-v) options to the
libselinux functions and rewriting the toolbox restorecon command
to use the libselinux functions.   Also add a force (-F) option to
support forcing a restorecon_recursive even if the restorecon_last
attribute matches the current file_contexts hash so that we can
continue to force a restorecon via the toolbox command for testing
or when we know something else has changed (e.g. for when we support
relabeling /data/data and package information has changed).

Change-Id: I92bb3259790a7195ba56a5e9555c3b6c76ceb862
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 5b2e126cd6e0b9ab193379b20683c9a491a5e31a)
Convert all selinux_android_restorecon and _setfilecon calls to new API.

libselinux selinux_android_restorecon API is changing to the more
general interface with flags and dropping the older variants.

Also get rid of the old, no longer used selinux_android_setfilecon API
and rename selinux_android_setfilecon2 to it as it is the only API in use.

Change-Id: I1e71ec398ccdc24cac4ec76f1b858d0f680f4925
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit cdd5238dc6c2e33eea19cd4e429be1abded2300e)
Add -D option to restorecon for relabeling /data/data.

This depends on change I137588013ed1750315702c0dbe088ce3e4a29e83.

Change-Id: I5a4fef9affd6cddf98d72dc9d54899be25741779
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit ca9afa9fbde3c6bddebf5571d6a235e0535f6cea)
Expose /dev/hw_random to group "system".

This is needed to let EntropyMixer (runs inside system_server) read
from /dev/hw_random.

Change-Id: Ifde851004301ffd41b2189151a64a0c5989c630f
(cherry picked from commit 267338a28d3a1164ecb32785a0f36578d6f3e601)
Handle policy reloads within ueventd rather than restarting it.

Restarting ueventd upon policy reloads has reportedly created
stability problems for some users and could cause events to be lost.
Stop restarting ueventd and instead handle policy reloads within ueventd.

Also stops restarting installd upon policy reloads.

Change-Id: Ic7f310d69a7c420e48fbc974000cf4a5b9ab4a3b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 6154f7c381d6d18c7a6d952c8b934c1bda425ddd)
Revert "Apply strict SELinux checking of PROT_EXEC on mmap/mprotect calls."

This reverts commit 0ad86b4ec9818a2665d06d97039702bc266ca386.

(cherry picked from commit 647ceac5c36327281cb0bab7b4fe5cf784fbba9d)