Rename domain "system" to "system_server".

Now that the "system" domain is just about the system_server, it's
clearer if the domain is called "system_server".

This CL depends on the renaming in external/sepolicy performed in
https://android-review.googlesource.com/#/c/65502/

Change-Id: I90a6850603dcf60049963462c5572d36de62bc00

Conflicts:
	BoardConfig.mk
	sepolicy/compatibility.te
New sensors-config selinux policy.

init.grouper.rc:
 We chown both /data/sensors and /data/lightsensor
 to avoid dac_override denials. sensors-config runs
 as root and will otherwise generate denials
 when trying to access /data/sensors and
 /data/lightsensor. The sensors-config
 binary does a chown to system,system
 as its final operation.

sensors_config.te:

1) Allow executing toolbox:
 denied  { execute } for  pid=139 comm="sensors-config" name="mksh" dev=mmcblk0p3 ino=194 scontext=u:r:sensors_config:s0 tcontext=u:object_r:shell_exec:s0 tclass=file
 denied  { read open } for  pid=139 comm="sensors-config" name="mksh" dev=mmcblk0p3 ino=194 scontext=u:r:sensors_config:s0 tcontext=u:object_r:shell_exec:s0 tclass=file
 denied  { execute_no_trans } for  pid=139 comm="sensors-config" path="/system/bin/mksh" dev=mmcblk0p3 ino=194 scontext=u:r:sensors_config:s0 tcontext=u:object_r:shell_exec:s0 tclass=file
 denied  { execute_no_trans } for  pid=144 comm="sh" path="/system/bin/toolbox" dev=mmcblk0p3 ino=262 scontext=u:r:sensors_config:s0 tcontext=u:object_r:system_file:s0 tclass=file

2) Mounting and reading from PER block device:
 denied  { mounton } for  pid=127 comm="sensors-config" path="/data/calibration" dev=mmcblk0p9 ino=225345 scontext=u:r:sensors_config:s0 tcontext=u:object_r:sensors_data_file:s0 tclass=dir
 denied  { mount } for  pid=127 comm="sensors-config" name="/" dev=mmcblk0p7 ino=1 scontext=u:r:sensors_config:s0 tcontext=u:object_r:sdcard_external:s0 tclass=filesystem
 denied  { unmount } for  pid=128 comm="sensors-config" scontext=u:r:sensors_config:s0 tcontext=u:object_r:sdcard_external:s0 tclass=filesystem
 denied  { read } for  pid=127 comm="sensors-config" name="KXTF9_Calibration.ini" dev=mmcblk0p7 ino=113 scontext=u:r:sensors_config:s0 tcontext=u:object_r:sdcard_external:s0 tclass=file
 denied  { open } for  pid=127 comm="sensors-config" name="KXTF9_Calibration.ini" dev=mmcblk0p7 ino=113 scontext=u:r:sensors_config:s0 tcontext=u:object_r:sdcard_external:s0 tclass=file
 denied  { getattr } for  pid=128 comm="sensors-config" path="/data/calibration/sensors/KXTF9_Calibration.ini" dev=mmcblk0p7 ino=113 scontext=u:r:sensors_config:s0 tcontext=u:object_r:sdcard_external:s0 tclass=file
 denied  { search } for  pid=128 comm="sensors-config" name="block" dev=tmpfs ino=5252 scontext=u:r:sensors_config:s0 tcontext=u:object_r:block_device:s0 tclass=dir
 denied  { search } for  pid=127 comm="sensors-config" name="/" dev=mmcblk0p7 ino=1 scontext=u:r:sensors_config:s0 tcontext=u:object_r:sdcard_external:s0 tclass=dir

3) Chown and chmod /data/lightsensor, /data/sensors
 denied  { chown } for  pid=408 comm="chown" capability=0  scontext=u:r:sensors_config:s0 tcontext=u:r:sensors_config:s0 tclass=capability
 denied  { fowner } for  pid=403 comm="chmod" capability=3  scontext=u:r:sensors_config:s0 tcontext=u:r:sensors_config:s0 tclass=capability

4) Mount and umount commands
 denied  { sys_admin } for  pid=128 comm="sensors-config" capability=21  scontext=u:r:sensors_config:s0 tcontext=u:r:sensors_config:s0 tclass=capability

Change-Id: I08a523766b9b55620c36fcc85793f1a27275edbc
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Remove sensors-config as a permissive domain.

Change-Id: Iad874375528ce848cb4cf54237d93cf1c7db7757
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Move sysfs_devices_system_cpu to the central policy.

Every device has a CPU. This is not device specific.

Get rid of redundant allow rules, which are already allowed
by the base policy.

Change-Id: I4766dc571762d8fae06aa8c26828c070b80f5936

Conflicts:
	BoardConfigCommon.mk
	sepolicy/app.te
	sepolicy/file.te
Fix ueventd denial.

Fix the following denials on grouper:

<5>[    7.548916] type=1400 audit(1383869369.940:4): avc:  denied  { write } for  pid=107 comm="ueventd" name="uevent" dev=sysfs ino=776 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=file
<5>[    7.549091] type=1400 audit(1383869369.940:5): avc:  denied  { open } for  pid=107 comm="ueventd" name="uevent" dev=sysfs ino=776 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=file

Change-Id: I1255488a9d2a5623ff29f8ae05499355b6ad72de
Label tegra gpu memory management node.

Use existing label nvhost_writable_device
which is being used for tegra graphics nodes
that are world readable and writable. The
new labeling is needed because the nvmap
node has been dropped from the generic policy.

Change-Id: I2a7000f69abf3185724d88d428e8237e0ca436ec

Conflicts:
	sepolicy/file_contexts
Fix new selinux denials.

* Surfaceflinger access to tegra sysfs nodes.
    denied  { search } for  pid=124 comm="surfaceflinger" name="tegradc.0" dev=sysfs ino=775 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=dir
    denied  { read } for  pid=124 comm="surfaceflinger" name="device" dev=sysfs ino=3406 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=lnk_file
    denied  { read } for  pid=124 comm="surfaceflinger" name="enable" dev=sysfs ino=3432 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=file

* Allow mediaserver read/write to tegra video driver.
    denied  { read write } for  pid=17350 comm="Binder_2" name="nvhost-vi" dev=tmpfs ino=5363 scontext=u:r:mediaserver:s0 tcontext=u:object_r:nvhost_device:s0 tclass=chr_file

Change-Id: I683d93a65bb6dba9b803fd628d08916dc536b000

Conflicts:
	sepolicy/surfaceflinger.te
Remove btmacreader.te policy file.

Commit 747317fac1e6e0063a2f8de22aaab2403934d7d6
removed the btmacreader binary. Therefore, we
no longer need policy for it.

Change-Id: Id7af2c4d0192855286f707b42ee7ebac4ba9d018
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Rename nvhost_writable_device to gpu_device

In particular, this allows the nakasi boot animation to
work with bootanim in enforcing, and addresses the
following fatal denials:

11.953395   type=1400 audit(1386989602.240:5): avc:  denied  { read write } for  pid=345 comm="BootAnimation" name="nvmap" dev=tmpfs ino=5305 scontext=u:r:bootanim:s0 tcontext=u:object_r:nvhost_writable_device:s0 tclass=chr_file
11.955950   type=1400 audit(1386989602.240:6): avc:  denied  { read write } for  pid=345 comm="BootAnimation" name="nvhost-ctrl" dev=tmpfs ino=5360 scontext=u:r:bootanim:s0 tcontext=u:object_r:nvhost_writable_device:s0 tclass=chr_file

Change-Id: Id2d9711ce14ec755cc48f67d89e6a726e0f7706a

Conflicts:
	sepolicy/device.te
	sepolicy/system_server.te
Add execmem permission to gpsd and keystore domains.

Removed from domain so we need to add it back to individual domains
as required.

Change-Id: I902ac6f8cf2e93d46b3a976bc4dabefa3905fce6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Conflicts:
	BoardConfigCommon.mk
Add new label to address new denials.

Include radio_device label for ACM node.
This will also fix the following denials.
  avc:  denied  { read write } for  pid=183 comm="rild" name="ttyACM0" dev=tmpfs ino=5389 scontext=u:r:rild:s0 tcontext=u:object_r:device:s0 tclass=chr_file
  avc:  denied  { open } for  pid=183 comm="rild" name="ttyACM0" dev=tmpfs ino=5389scontext=u:r:rild:s0 tcontext=u:object_r:device:s0 tclass=chr_file
  avc:  denied  { ioctl } for  pid=183 comm="rild" path="/dev/ttyACM0" dev=tmpfs ino=5389 scontext=u:r:rild:s0 tcontext=u:object_r:device:s0 tclass=chr_file

Change-Id: Ic092fe7f8dd4449510206d1a2d1ec16d75934188
Allow access to sysfs files.

Due to a bug in Linux < 3.3, sysfs inodes can lose a security context
set via setfilecon/setxattr and revert to the base sysfs type if the
security context is set before setting owner or mode on the inode and
the inode is later evicted from memory and subsequently refreshed.
This was fixed in mainline Linux by commit
93518dd2ebafcc761a8637b2877008cfd748c202.

As a workaround, allow any domain that can write to any sysfs type
to also write to the base sysfs type in the grouper sepolicy and
anything that inherits from it.

Change-Id: I14b0530387edce1097387223f0def9b59e4292e0
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Fix file_contexts entry for update_fw.

Needs to use the real pathname in order for restorecon_recursive("/sys")
to work correctly, unlike the old individual restorecon commands.

Change-Id: I9a0ab7a0efe69d31890d51137454847d198555e5
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Relabel /sys/devices/tegradc nodes correctly.

Use the fs_type and sysfs_type attributes instead
of the dev_type attribute.

Change-Id: I5ca3716780a20662fc4339d2594b241769d5ac4e
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Label /dev/tegra_camera as a camera_device.

tegra_camera has the camera group id. Because
of this, the node should use the camera_device
label. We only allow mediaserver access to
camera_device versus broader access to a
video_device.

Change-Id: I46cf4e2d3e40c03282d37febe1481772587b65f3
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Move SELinux diag_device policy to userdebug/eng.

Also just remove all specific domain access and instead
allow diag_device access for all domains on the
userdebug/user builds.

Change-Id: I2a35de3d4d407fad97e3b3ef9fadef962ecff901
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Drop sensors block device label.

While there is a defined type there is no
policy. Drop the type and the restorecon
on the block device.

Change-Id: Iba234e0a6c38281f53c72126cb49f0c2f18d33d5
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Allow lmkd write to sysfs files on grouper/nakasi.

Bug in kernel < 3.3 causes sysfs inodes to lose their security context
and revert to the base sysfs type, so we need to allow this.
Revert when/if the kernel fix is merged:
https://android-review.googlesource.com/#/c/78930/

Change-Id: Ie6cb0e6576c7268220b8557a1dfd07a1f0e47c08
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Drop redundant restorecon line from rc file.

Since init performs a recursive restorecon
we don't need to perform a separate one here.

Change-Id: I7ae10ef81a6c5e5fc85865c6ccdb6d4340e108d6
Push wpa_supplicant modules down to the leaf product config.

Since 558477c0b2a5a7db679c1ad7551d43e6364d1df2 in
external/wpa_supplicant_8 we don't need those modules if
WPA_SUPPLICANT_VERSION is not set by the BoardConfig.mk.

Change-Id: Idca392a07689ed398b9f876d31212d042801a8ed