sepolicy: Start CM Common sepolicy

Rather than having to maintain out of tree changes, it is often
easier to maintain a hiearchy of changes, starting with the vendors
common config file. From there, inheriting products can pick up a base
and start to add or remove certain bits from it, making use of the
BOARD_SEPOLICY_* functions documented in external/sepolicy/README.

Conflicts:
	configs/common.mk
selinux: Mahdi-Rom policies are now inserted last

Inclusion of the makefile is done by the build system to enforce
the wanted order

selinux: Add Mahdi-Rom-specific file_contexts

selinux: Add missing seapp_contexts file
sepolicy: f2fs: Allow fs_use_xattr
selinux: Fix asec mounting

Change-Id: I92392f3d810dfaf8dfc35f5c9170178a651d28dc
sepolicy: treat fuseblk as sdcard_external

Allow fuse-mounted NTFS/exFAT file systems to be written to

Change-Id: I1492914dd269a305e27aba58e61064d853adf2bc
sepolicy: allow installd to query ASEC size

installd need to query ASEC size on sdcard_external
to show on the Settings -> Apps page correctly.

Change-Id: I2d9a49b8f0652f05d73d0ff464a3835595e2cc3c
sepolicy: allow vold to create files on external sdcard

This is required for ASEC support. Vold can already create and
access directories, but do not yet have the permission for files.

Change-Id: I5082bbff692e5dc53c7000e4b3a293e42d33f901
sepolicy: allow vold to mount ext4 sdcard

When vold mounts an ext4 sdcard, it needs to force the context to
sdcard_external.

avc:  denied  { relabelfrom } for  pid=190 comm=vold scontext=u:r:vold:s0 tcontext=u:object_r:labeledfs:s0 tclass=filesystem
avc:  denied  { relabelto } for  pid=190 comm=vold scontext=u:r:vold:s0 tcontext=u:object_r:sdcard_external:s0 tclass=filesystem
avc:  denied  { relabelfrom } for  pid=190 comm=vold scontext=u:r:vold:s0 tcontext=u:object_r:sdcard_external:s0 tclass=filesystem

Change-Id: I80f42fbdf738dee10958ce1bdc1893a41234f0d9
selinuxrelabel: Need to check in priv-app now

Change-Id: I67529c3b0f8baaac15fd475305eafd085feac112
sepolicy: allow vold to mount fuse-based sdcard

exfat and NTFS-3g requires access to /dev/fuse

Change-Id: I35b13ada586c8de3fbe04156c2d10bf5e3c07b3a
selinuxrelabel: Add a check for dalvik-cache

Change-Id: Ic8087450756ae81458e155aa1ca22d5055547664
Recheck /data for selinux labeling

This simply adds checks for selinux labels for
files under /data/misc/wifi which were not labeled
correctly for some devices

Change-Id: Iaacf6db792aaea1485502b424d639a1212c5841b
selinuxrelabel: Remove attempts to relabel /system

These are a no-op due to the additional block-device protection from
https://android.googlesource.com/platform/system/core/+/e18c0d508a6d8b4376c6f0b8c22600e5aca37f69
so get rid of them entirely. Any installing recovery (or equivalent
installation process) should handle the labeling of system components
on its own.

Change-Id: I14c50f08efa6f05b03fad4fbc404219cc504e1ff
TBD: Do we still want to label unlabeled files?