Update SE Policy to allow calls to and callbacks from Wifi Offload HAL
HIDL binderized service.
Cherry pick from d56aa1982d15acfc2408271138dac43f1e5dc987

Bug: 32842314
Test: Unit tests, Mannual test to ensure Wifi can be brought up and
connected to an AP, ensure that Offload HAL service is running and that
that wificond can get the service handle by calling hwservicemanager.

Change-Id: I0fc51a4152f1891c8d88967e75d45ded115e766e

am: 7138973f

Change-Id: I19217d9c4f428223beef29605ab4fd4f0a0db4b7

am: 484a277c

Change-Id: Iaa779c0d07bc503e27d0d9b65816347e819daa8a

am: 2261cab6

Change-Id: Id44a7c591e8d7640c89e74cb9e88ce7849439c29

am: 1871fc0a

Change-Id: I2d474b6d04d0fa2af7ad35d7af068e38477609ee

am: 4234d95f

Change-Id: I5bf5e7a14936c275d78c1ae3438dcad88da33233

am: fbccda34

Change-Id: I1dd3889756bcc6324f80d20aeecba95587e68f20

Test: works on internal marlin
Bug: 34274385
Change-Id: Idd35e5cdccb595b4e5994eb1d78fdeece0aec0a6

am: a21b8b0e

Change-Id: I959ce59a098036326ebfc3244972519fd129f364

am: 29f273ce

Change-Id: I0dc5693bddd9574eb36ee4a711652b4130afdd8e

am: f89f35ec

Change-Id: I34301b22c7ee6e041326f37ffd398245672fe926

am: c3a9e7df

Change-Id: Ifcb4f63b7111252ee3a0deb58e6471b06df58587

am: 2afd3383

Change-Id: I8447d7aeefdfd314244c16c223b23219fd95bbc4

am: bab5872c

Change-Id: I0341e66bd3a8fcbddf9daf7da84187430b5747d6

am: 2ec492f1

Change-Id: I996307180bc21742c5039ab53a6d9764925916ad

am: 9337a4dd

Change-Id: Ib3273650207e0b64cdca1d6e0e3bbdf48d292a6b

Test: Test: make cts && \
      cts-tradefed run singleCommand cts --skip-device-info \
      --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
      --module CtsSecurityHostTestCases \
      -t android.security.cts.SELinuxHostTest#testNoExemptionsForBinderInVendorBan
      Fails as expected.
Bug: 36002573

Change-Id: I298c526789b25734d5f18666c64497e5d1e181d0

So we can limit vndservicemanager access to
just vndservice_contexts.

Bug: 36052864
Test: servicemanager,vndservicemanager work
Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188

am: 81e1c12f

Change-Id: I08fa8d70c193dfc2c8c79f41b546bbb564b3822f

am: 0c31c85a

Change-Id: I2e6c151eb6b3413054f52d0dea5ab93c91065319

am: 7e9f5352

Change-Id: Ib23d7b2edadfbc7d188d21d5142f28e7c19b45ac

am: a1c06508

Change-Id: I7e586b6bf9c22ab0380f9982889f0c8c86115df1

"tee" domain is a vendor domain. Hence its rules should live on the
vendor image.

What's left as public API is that:
1. tee domain exists and that it is permitted to sys_rawio capability,
2. tee_device type exists and apps are not permitted to access
   character devices labeled tee_device.

If you were relying on system/sepolicy automatically labeling
/dev/tf_driver as tee_device or labeling /system/bin/tf_daemon as
tee_exec, then you need to add these rules to your device-specific
file_contexts.

Test: mmm system/sepolicy
Test: bullhead, angler, and sailfish boot up without new denials
Bug: 36714625
Bug: 36714625
Bug: 36720355
Change-Id: Ie21619ff3c44ef58675c369061b4afdd7e8501c6

Bug: 36855921
Test: compile, wifi works with toggling
Change-Id: Ib0819a2d552472e482e192a69530441cfc2c0fd7

am: 888bc0bb

Change-Id: Ic14649c9ecba4879547300030717e2176ce8ca53

am: ed82acb9

Change-Id: I2c7dc59f0ea468fba1e34d38a55cc2e8e6cc3289

am: 3c0561b1

Change-Id: I05d63291a5e7af356e158483255ce1c5b73a1539

am: a299bc80

Change-Id: I94b99a1ace48fafeb47280d1d6764cac70fb9464

am: f9b6368a

Change-Id: I94973e72c33c15d0c856df05ec3a12f2490f170d