For additional context-

The denials related to init_tmpfs are of the form:

denied  { read } for  pid=12315 comm=""dboxed_process0"" path=2F6465762F6173686D656D2F64616C76696B2D68656170202864656C6574656429 dev=""tmpfs"" ino=9464 scontext=u:r:isolated_app:s0 tcontext=u:object_r:init_tmpfs:s0 tclass=file

(the path above is "/dev/ashmem/dalvik-heap (deleted)")

The denials related to executing things from the dalvik cache are of the form:

enied  { execute } for  pid=3565 comm=""dboxed_process0"" path=""/data/dalvik-cache/system@app@Chrome.apk@classes.dex"" dev=""mmcblk0p28"" ino=105983 scontext=u:r:isolated_app:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file

The denials related to isolated_app and the init socket are:

denied  { getattr } for  pid=3824 comm=""Binder_2"" path=""socket:[14059]"" dev=""sockfs"" ino=14059 scontext=u:r:isolated_app:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket

The getopt denials for the aforementioned socket are:

denied  { getopt } for  pid=3824 comm=""Binder_2"" path=""/dev/socket/dumpstate"" scontext=u:r:isolated_app:s0 tcontext=u:r:init:s0 tclass=unix_stream_socket

Change-Id: I3c57702e2af5a779a7618da9aa40930e7f12ee49

At this point, we still don't understand the root cause of
bug 10290009, or if it's even a real bug.  Rollback
29d0d406 so we an get a device
in this state and figure out the root cause of this problem.

This reverts commit 29d0d406.

Bug: 10290009

Change-Id: Ie0947f79c63f962220d3c9316c5d5d82f677821f

This fixes another bug encountered while taking bugreports.

Bug: 10498304
Change-Id: Ie33e869ccd28c5461f4f3736c078b2a865aa7cdd

Bug: 10498304
Change-Id: I312665a2cd09fa16ae3f3978aebdb0da99cf1f74

* commit 'cec3c1e4':
  Add capabilities to Zygote to fix valgrind.

* commit 'e0362602':
  Add capabilities to Zygote to fix valgrind.

Change-Id: I898bb4ee8fdb95b48e58c98bffdb381b03c719bb

Bug: 10455872
Change-Id: I98885e8cd1e4f9ab0d3e2af6d79b078a000db539

This is based on Joshua Brindle's sepolicy-inject.

Change-Id: Ie75bd56a2996481592dcfe7ad302b52f381d5b18

* commit '81cdd6c6':
  Fix insertkeys.py to resolve keys.conf path entries in a portable way

* commit '1b46b2fe':
  Fix insertkeys.py to resolve keys.conf path entries in a portable way

* commit '553bafef':
  Add the ability to write shell files to the untrusted_app domain.

* commit '29d0d406':
  Add the ability to write shell files to the untrusted_app domain.

Bug: 10290009
Change-Id: Ic794299261672b36a2b630893b65ab176c3eee6b
(cherry picked from commit eaa4e844e4c8549c9b4808a1272876a6995ca5a7)

* commit 'b74efd33':
  Move isolated_app.te / untrusted_app.te into permissive
  Grant fsetid Linux capability to vold.
  Add "shell" to seapp_contexts

Change-Id: If9a2d360a37a8641a70fb475c7f5422d0cf8b900

Currently a path to a key in keys.conf must be fully qualified or have
the -d option appended. This fix will allow paths to have environment
variables that will be expanded. This will give portability to the
entries. For example the following entry will now be resolved correctly:
[@NET_APPS]
ALL : $ANDROID_BUILD_TOP/device/demo_vendor/demo_dev/security/net_apps.x509.pem

Change-Id: If4f169d9ed4f37b6ebd062508de058f3baeafead
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>

Bug: 10175701
Change-Id: I185df22bdbaafd56725760ec6c71340b67455046

Change-Id: Ided2cf793e94bb58529789c3075f8480c0d0cf4e

OTAs aren't properly labeling /system, which is causing SELinux
breakage. Temporarily put isolated_app.te and untrusted_app.te
into permissive.

Bug: 9878561
Change-Id: Icaf674ad6b3d59cbca3ae796c930c98ab67cae9c

OTAs aren't properly labeling /system, which is causing SELinux
breakage. Temporarily put isolated_app.te and untrusted_app.te
into permissive.

Bug: 9878561
Change-Id: Icaf674ad6b3d59cbca3ae796c930c98ab67cae9c

Bug: 9872463
Change-Id: I47eabeace3387afd24c0fd4bee70e77c0a3586d5

Bug: 9859477
Change-Id: Iadd26cac2f318b81701310788bed795dadfa5b6b

This is needed to support "Verify App" functionality.
During side loading, the Verify App functionality reads the APK
to determine if it's safe to install.

Bug: 9863154
Change-Id: I33f6b0fd012f6cb194e253d5d92cf6189d6aa222

/sys was getting labeled as a rootfs file, but according to
genfs_contexts, it's really a sysfs file. This conflict is causing
problems when patch f29c533c49ab1c90eae612b1c454f2c6879a6658 from
system/core is applied.

Change-Id: I3f34c9ee68bedb171ebebfcd356e924c987b58ff

For some reason, the debuggerd socket isn't getting properly
labeled. Work around this bug for now by allowing all domains
to connect to all unix stream sockets.

Bug: 9858255
Change-Id: If994e51b0201ea8cae46341efc76dc71a4e577c8

This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef3
with extensive modifications, some of which are included below.

* Allow communication with netd/dnsproxyd, to allow netd to handle
  dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
  the DAC allows access.

In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.

This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.

Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35