In f5446eb1 I forgot to let violators
of "no Binder in vendor" rule keep their access to /dev/binder. This
commit fixes the issue.

Test: mmm system/sepolicy
Bug: 35870313
Bug: 36657020
Change-Id: I3fc68df1d78e2a2da94ac9bf036a51923e3a9aae

am: a4960ef9

Change-Id: Ia6fbb2aae4d5c66e868e43b279748a7a96ae3bf7

am: 92229884

Change-Id: Idd03a8f1a6b3a315ee6be221ea7d91b06be9477e

am: 3f724c95

Change-Id: Ia390c3537b7efe897154380ee836dbb7ac0ed742

This is a special file that can be mounted as a loopback device to
exercise adoptable storage code on devices that don't have valid
physical media.  For example, they may only support storage media
through a USB OTG port that is being used for an adb connection.

avc: denied { read } for path="/data/misc/vold/virtual_disk" dev="sda35" ino=508695 scontext=u:r:kernel:s0 tcontext=u:object_r:vold_data_file:s0 tclass=file permissive=0

Bug: 34903607
Change-Id: I84721ec0e9495189a7d850461875df1839826212

am: d33a51c3

Change-Id: Ife99cd6fc85b77ea77ca1edc9a8c741ee0d204ee

am: a6152592

Change-Id: I7f1ad41abd96abaef416d4cb3352fa475cffff5d

am: 2224f30a

Change-Id: I184272269fed360807e41a1cac1fe099477685e6

am: 518e14e6

Change-Id: I2b9c58cf3e7f583d8a099545696f06e741e7d2b2

am: 5ebf1975

Change-Id: I1033e791b718bd1c374885f3a16b176994bb957f

am: 133d5298

Change-Id: I934f58768bd30de9c62d33e83b6a1b60f0d0fb9b

Per loop(4), this device is the preferred way of allocating new
loop devices since Linux 3.1.

avc: denied { read write } for name="loop-control" dev="tmpfs" ino=15221 scontext=u:r:vold:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=0

Bug: 34903607
Change-Id: I1f5f62cf0a1c24c6f6453100004812af4b8e1503

am: 45353737

Change-Id: Ifbd0f8bc238fe7ec49299b20dec36b0a07a580df

am: 72bdc353

Change-Id: I461829999d3413254a837ffb4612316d9d992acd

am: 5d0c2e41

Change-Id: I30a0587f8bb4a99a97ddce7d989302f9a89a02af

secilc is being used without -f which is causing a file_contexts
file to be generated in the root of the tree where the build tools
run:

$ stat $T/file_contexts
  File: 'file_contexts'
  Size: 0         	Blocks: 0          IO Block: 4096   regular empty file
Device: fc00h/64512d	Inode: 5508958     Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/wcrobert)   Gid: ( 1000/wcrobert)
Access: 2017-03-23 11:23:41.691538047 -0700
Modify: 2017-03-23 11:23:41.691538047 -0700
Change: 2017-03-23 11:23:41.691538047 -0700

Test: remove $T/file_contexts, touch a policy file and make sepolicy,
      ensure file is not regenerated. Also, ensure hikey builds and
      boots.

Change-Id: I0d15338a540dba0194c65a1436647c7d38fe3c79
Signed-off-by: William Roberts <william.c.roberts@intel.com>

am: 81e48f97

Change-Id: I0f30763ac163bb5032d296097b346eec10ed2dc2

am: adabd898

Change-Id: I1eb82bf76bfef80bbb51e636d166e55a30b234bf

am: 987014c8

Change-Id: I97a2e56097ca2f4a23ae682afcb86c47d9fd8749

Test: `adb shell am hang --allow-restart` -> Watchdog dumps
  hal traces (eventually)
Bug: 36414311

Change-Id: I57e6875998b1f06a7deec1b8774facb75148d2c1

This adds mediacodec to the list of temporary exemptions from the "no
Binder in vendor" rule.

Test: mmm system/sepolicy
Bug: 35870313
Change-Id: I0f00d4bfb90d6da45ae2fed65864bb8fb0a4e78e

am: f91f369d

Change-Id: I58593c82cd9b7b1dc7fcdfa8916f4bf55a3d9ab4

am: 5d8fcf3b

Change-Id: I5f88b48df906acb9381dc853d61dcd5ef8d5e4e4

am: 73a6f38b

Change-Id: I24d9be712209ee22a33ae858001c4e38e0eb763a

am: f535a40d

Change-Id: I66da4d14a2388b1241b755280682f6e7d93d3830

am: e1742ef0

Change-Id: I007ae4064a8daf690b15bc5196131169727cbec9

am: 6b558dcb

Change-Id: I82c412038e43bb343dc355c9d1e56a11f6da6542

This change associates all domains which are clients of Allocator HAL
with hal_allocator_client and the, required for all HAL client
domains, halclientdomain.

This enables this commit to remove the now unnecessary hwallocator_use
macro because its binder_call(..., hal_allocator_server) is covered by
binder_call(hal_allocator_client, hal_allocator_server) added in this
commit.

Unfortunately apps, except isolated app, are clients of Allocator HAL
as well. This makes it hard to use the hal_client_domain(...,
hal_allocator) macro because it translates into "typeattribute" which
currently does not support being provided with a set of types, such as
{ appdomain -isolated_app }. As a workaround, hopefully until
typeattribute is improved, this commit expresses the necessary
association operation in CIL. private/technical_debt.cil introduced by
this commit is appended into the platform policy CIL file, thus
ensuring that the hack has effect on the final monolithic policy.

P. S. This change also removes Allocator HAL access from isolated_app.
Isolated app shouldn't have access to this HAL anyway.

Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
      successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92

This is a follow-up to f5446eb1 where
I forgot to associate su and perfprofd domains with coredomain.

Test: mmm system/sepolicy
      sepolicy-analyze $OUT/root/sepolicy attribute coredomain
Bug: 35870313
Change-Id: I13f90693843f7c6fe9fea8e5332aa6dd9558478a

This couldn't be done in earlier because this domain does not yet exist
in AOSP master.

Test: mmm system/sepolicy -- no errors
Bug: 35870313
Change-Id: I323e5c22e471cd1900b88d0d1d4edfb5973a33d7

am: 49ce4394

Change-Id: I1b38d903e61188594d0de80be479e7d9e045fb26

am: 2fe065d7

Change-Id: Ieefcec5619fc2b941a675b473661dc561864ffc9

am: f5446eb1

Change-Id: I23d5d274ae05a9b0bdac6872be86c3f56aec734e

On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor
apps) are not permitted to use Binder. This commit thus:
* groups non-vendor domains using the new "coredomain" attribute,
* adds neverallow rules restricting Binder use to coredomain and
  appdomain only, and
* temporarily exempts the domains which are currently violating this
  rule from this restriction. These domains are grouped using the new
  "binder_in_vendor_violators" attribute. The attribute is needed
  because the types corresponding to violators are not exposed to the
  public policy where the neverallow rules are.

Test: mmm system/sepolicy
Test: Device boots, no new denials
Test: In Chrome, navigate to ip6.me, play a YouTube video
Test: YouTube: play a video
Test: Netflix: play a movie
Test: Google Camera: take a photo, take an HDR+ photo, record video with
      sound, record slow motion video with sound. Confirm videos play
      back fine and with sound.
Bug: 35870313
Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95

am: da6c88c9

Change-Id: I9b2c1457c7c8cf3a6c8edde11e4dad8883bbf34c