Rename sdcard_internal/external types.

Rename sdcard_internal/external types to fuse and vfat
respectively to make it clear that they are assigned to any
fuse or vfat filesystem by default (absent a context= mount option)
and do not necessarily represent the SDcard.

The sdcard_type attribute is still assigned to both types and
can still be used in allow rules to permit access to either the
internal or external SDcard.

Define type aliases for the old names to preserve compatibility
on policy reload and for device-specific policies that may not yet
be updated.

Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Merge "Rename sdcard_internal/external types."
support newer-style adbd interface in recovery

Support opening the ffs-based interface for adbd in recovery.  (Copied
from adbd.te.)

Bug: 16183878
Change-Id: Ib80e5b910d9ad4252cb80e7ce2f85e478cd94816
Put dex2oat in it's own sandbox

Currently, dex2oat runs in the installd sandbox, and has
all the SELinux capabilities that installd does. That's too
excessive.

dex2oat handles untrusted user data, so we want to put it in
it's own tighter sandbox.

Bug: 15358102
Change-Id: I08083b84b9769e24d6dad6dbd12401987cb006be
Merge "Put dex2oat in it's own sandbox"
Remove domain:process from unconfined

Prune down unconfined so it doesn't allow process access
to all other domains. Use domain_trans() for transitions to
seclabeled domains.

Change-Id: I8e88a49e588b6b911e1f7172279455838a06091d
Allow oemfs search for system_server and bootanim

Address denials in devices that use /oem

Change-Id: I80b76bb58bab9b6c54d6550eb801664d82a4d403
am d2d172a3: Allow dumpstate to read the list of routing tables.

* commit 'd2d172a33ec747299961649e3cdb3095a38eef01':
  Allow dumpstate to read the list of routing tables.
am e844113b: Allow SystemServer to start PersistentDataBlockService

* commit 'e844113bc114484339b0c74a978c0fa5cfa250e1':
  Allow SystemServer to start PersistentDataBlockService
am d3356826: Let DCS read staged APK clusters.

* commit 'd33568264f0843feafc2d17c38e863f914f1fc57':
  Let DCS read staged APK clusters.
am 2cd9c9bd: Merge "Typedef+rules for SysSer to access persistent block device"

* commit '2cd9c9bd3fa54ca78d0847763df4bca5fe940dcf':
  Typedef+rules for SysSer to access persistent block device
am 5d60f04e: sepolicy: allow system server to remove cgroups

* commit '5d60f04e5d43d084992d59c38a631a034b88e715':
  sepolicy: allow system server to remove cgroups
am 99d86c7a: ensure that untrusted_app can\'t set properties

* commit '99d86c7a77d402a106a1b3fe57af06dbb231c750':
  ensure that untrusted_app can't set properties
am f5835666: Don\'t use don\'t

* commit 'f58356661632d4c08870122f2cf944ea4edfe810':
  Don't use don't
am b59dc27a: Drop sys_rawio neverallow for tee

* commit 'b59dc27a1b580a13c50477d2af1cbdaf95601d8f':
  Drop sys_rawio neverallow for tee
am 1d2ff869: allow ueventd sysfs_type lnk_file

* commit '1d2ff869634649955fab0be3fb724d8b937c80bf':
  allow ueventd sysfs_type lnk_file
am 2b3c5de2: Merge "install_recovery: start enforcing SELinux rules"

* commit '2b3c5de21e96668f203628cddf88241774b3735d':
  install_recovery: start enforcing SELinux rules
Add access control for each service_manager action.

Add SELinux MAC for the service manager actions list
and find. Add the list and find verbs to the
service_manager class. Add policy requirements for
service_manager to enforce policies to binder_use
macro.

Change-Id: I224b1c6a6e21e3cdeb23badfc35c82a37558f964
am 4da3bb14: Merge "Rename sdcard_internal/external types."

* commit '4da3bb1481e4e894a7dee3f3b9ec8cef6f6b1aed':
  Rename sdcard_internal/external types.
am bad4e91d: support newer-style adbd interface in recovery

* commit 'bad4e91dd2c7c043707d93b347b06d45f1f9b25b':
  support newer-style adbd interface in recovery