Commit 3fbc536d allowed untrusted
app to read radio data files passed via binder, but didn't allow
write access. Write access is needed when sending MMS messages.

Steps to reproduce:
1) have some photos on the device
2) Launch messaging app
3) Attach a MMS (Picture, capture video, capture picture, audio recording etc..)
4) Send

EXPECTED RESULTS:
No crash

OBSERVED RESULTS:
- Messaging crashes on sending MMS
- messages are stuck in sending state

Additional details:
  05-05 10:14:01.196  2457  2457 W Binder_3: type=1400 audit(0.0:20): avc:  denied  { write } for  path="/data/data/com.android.providers.telephony/app_parts/PART_1399310041183_temp.jpg" dev="mmcblk0p23" ino=604417 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:radio_data_file:s0 tclass=file
  05-05 10:14:01.202 27809 28219 E JavaBinder: !!! FAILED BINDER TRANSACTION !!!
  05-05 10:14:01.203 27809 28219 E PduPersister: Failed to open Input/Output stream.
  05-05 10:14:01.203 27809 28219 E PduPersister: java.io.FileNotFoundException: Failed opening content provider: content://mms/part/4
  05-05 10:14:01.203 27809 28219 E PduPersister:        at android.content.ContentResolver.openAssetFileDescriptor(ContentResolver.java:966)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at android.content.ContentResolver.openOutputStream(ContentResolver.java:674)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at android.content.ContentResolver.openOutputStream(ContentResolver.java:650)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.google.android.mms.pdu.PduPersister.persistData(PduPersister.java:837)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.google.android.mms.pdu.PduPersister.persistPart(PduPersister.java:761)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.google.android.mms.pdu.PduPersister.persist(PduPersister.java:1398)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.android.mms.data.WorkingMessage.createDraftMmsMessage(WorkingMessage.java:1577)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.android.mms.data.WorkingMessage.sendMmsWorker(WorkingMessage.java:1431)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.android.mms.data.WorkingMessage.access$700(WorkingMessage.java:82)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at com.android.mms.data.WorkingMessage$2.run(WorkingMessage.java:1228)
  05-05 10:14:01.203 27809 28219 E PduPersister:        at java.lang.Thread.run(Thread.java:818)
  05-05 10:14:01.221 27809 28219 E AndroidRuntime: FATAL EXCEPTION: WorkingMessage.send MMS
  05-05 10:14:01.221 27809 28219 E AndroidRuntime: Process: com.android.mms, PID: 27809
  05-05 10:14:01.221 27809 28219 E AndroidRuntime: java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String android.net.Uri.getLastPathSegment()' on a null object reference
  05-05 10:14:01.221 27809 28219 E AndroidRuntime:      at android.content.ContentUris.parseId(ContentUris.java:85)
  05-05 10:14:01.221 27809 28219 E AndroidRuntime:      at com.android.mms.model.SlideshowModel.finalResize(SlideshowModel.java:691)
  05-05 10:14:01.221 27809 28219 E AndroidRuntime:      at com.android.mms.data.WorkingMessage.sendMmsWorker(WorkingMessage.java:1448)
  05-05 10:14:01.221 27809 28219 E AndroidRuntime:      at com.android.mms.data.WorkingMessage.access$700(WorkingMessage.java:82)
  05-05 10:14:01.221 27809 28219 E AndroidRuntime:      at com.android.mms.data.WorkingMessage$2.run(WorkingMessage.java:1228)
  05-05 10:14:01.221 27809 28219 E AndroidRuntime:      at java.lang.Thread.run(Thread.java:818)
  05-05 10:14:01.222   659  5253 W ActivityManager:   Force finishing activity com.android.mms/.ui.ComposeMessageActivity

Bug: 14562421
Change-Id: Iba6914eeec4bf0c8c04ee83584327a4824c0a9a9