Allow nfc application to set nfc property am: df964950 am: 7ceea484 am: b057d62e am: 062b7736
am: 3cb99005

Change-Id: I41630956c7075bfc026fd3a6aab1a9dbddeb0766

am: f2ba4b44

Change-Id: If9fd153f024612a6b91b1756c16de3ae08a743d5

am: 688861aa

Change-Id: Iba233c184347c7719db91a1d367db6e794c66610

am: 062b7736

Change-Id: Ic191ef4fafc87529857b1fae90b8609dfa5944d2

am: b057d62e

Change-Id: Ibfcf81f40d7bf50ba8dfb6c9f49f3ae159e4bc20

am: 61d9aaf9

Change-Id: Id4a7b604e7525c5cf78e2bc6788284126fab8f3c

am: 7ceea484

Change-Id: I82200626ae6a84728ce202e8f2ba829b4f3dc889

am: 3e1a8911

Change-Id: I10391f7ee62a151bd09b83fe4522a057aa8ddbfb

am: 0393dafd

Change-Id: Ida00cdf24a809888233ede97a83d42ed5c1a8574

am: 0393dafd

Change-Id: Ib8773a6973da28cfa161fbe34f701c191cab6f80

am: df964950

Change-Id: I5e793a78ad471b27fdc0bb88596ab23f6ac43dc4

type=1400 audit(1501520483.066:14): avc: denied { write } for pid=3330
comm=4173796E635461736B202331 name="property_service" dev="tmpfs"
ino=10749 scontext=u:r:nfc:s0 tcontext=u:object_r:property_socket:s0
tclass=sock_file permissive=0

Test: No sepolicy denials
Bug: 64010793
Change-Id: I8d73e8e19cd4d0a8c61f1f184820c53e5cc2b6d6
(cherry picked from commit df964950)

am: 8eea1ccf

Change-Id: Ia8ce13f839016b0f79813b583b1b48ec3ca7d7ce

am: 2cc55ff1

Change-Id: I6b05205469750e1d5e0fe2c2022a9a8874b49887

am: 079a98b8

Change-Id: Iff8db1f3c51c83a86408634e43505f29b337d391

am: 0785a72c

Change-Id: I250ef72980dd7cb6b471abfe4bbe61ae9b199680

Commit: 3eed3eac added the compatibility
statement for the new mediaprovider app domain, but it missed another
new, private type, mediaprovider_tmpfs, that is automatically created for
all appdomains.  It replaces priv_app_tmpfs, but since both types are
private, they do not need to be added to the actual mapping (vendor policy
cannot use it).

Bug: 62573845
Test: None.  Prebuilt-only change.
Change-Id: I62229a5be74cd928fe0ca82a45b73cb61d6f5223

Commit: 632bc494 added hwservice labeling
and was cherry-picked to oc-dev, but the hal_wifi_offload_hwservice type
was not part of the cherry-pick because the service was not in oc-dev.
Record the type for compatibility purposes.

Bug: 62573845
Test: None. Prebuilt change only.
Change-Id: Ib2c0fe862eddb566fbe6b0287238fa93dddae7b8

Merge "Merge "Add system_net_netd_hwservice." into oc-dr1-dev am: 23b986ce am: a3a9d4c0" into oc-mr1-dev-plus-aosp
am: f4e69962

Change-Id: Ie5dacc655ae8ac4314bb0ff0b6ba17e9808072dc

am: a89ee338

Change-Id: Ibe470d37a9aaff99192142b1b0d152ecf0d17b6f

Merge "Merge "Add system_net_netd_hwservice." into oc-dr1-dev am: 23b986ce am: a3a9d4c0" into oc-mr1-dev-plus-aosp

am: a3a9d4c0

Change-Id: I63ad7f7e6a2b19ca29d02624bf5dbf970b39dd32

am: 49460e93

Change-Id: Iaf04167b2d2ec3bd4d44df450f90367d103dd697

am: 23b986ce

Change-Id: I1bc8e3375fce75763efb8ba369715146a33f106b

am: 23b986ce

Change-Id: I15b6b70c8383316adcb3699de996a8a6b66db8b2

type=1400 audit(1501520483.066:14): avc: denied { write } for pid=3330
comm=4173796E635461736B202331 name="property_service" dev="tmpfs"
ino=10749 scontext=u:r:nfc:s0 tcontext=u:object_r:property_socket:s0
tclass=sock_file permissive=0

Test: No sepolicy denials
Bug: 64010793
Change-Id: I8d73e8e19cd4d0a8c61f1f184820c53e5cc2b6d6

system_server: allow writing to timerslack_ns am: 5c41d40e am: 4e960188 am: f1876d58 am: c29fd93c
am: 2faba8e8

Change-Id: I60cda930f137375e95f49ad6a243e6f83ac71134

am: c29fd93c

Change-Id: I0fb17936f69cf8b3c4080ba853c596786ff61d5f

am: f1876d58

Change-Id: I9b878eace2de33a483f648376f005277ef9283c6

am: 4e960188

Change-Id: I5dcc335c9bc9a1546709bef874c499b9d8eff03c

am: 624220fd

Change-Id: I096da4dae4aee96bbabcc2867c38eda9cf3de9c3

am: 5c41d40e

Change-Id: I6a60af407a6a95e3d48818de28619dc5ba44284f

Remove reference to non-existent attribute domain_deprecated.

Test: successfully build
Change-Id: I9b019147c033bf4019e37cb11736eb0a91284d9d

am: 862c195e  -s ours

Change-Id: I7cbcf027be556d04ac676a7465ca9aeba4637320

am: dd92ece4

Change-Id: I7dfccdd2709a95249d12f0898b9ca0dd35c37dd2

The only file in /proc/<pid>/ that is world writeable is
/proc/<pid>/timerslack_ns so granting selinux write permission to
a process's /proc/<pid>/ file only allows writing to timerslack_ns
(unless the process is running as system UID).

Addresses denials such as:
avc: denied { write } for comm="Binder:1117_2" name="timerslack_ns"
dev="proc" ino=27908 scontext=u:r:system_server:s0
tcontext=u:r:priv_app:s0 tclass=file permissive=1

Bug: 30675296
Test: build
Change-Id: I2cee8ce73a0dc05d771881c36da2fde5411859fb

am: 45074160

Change-Id: I0335754c8b2c93817d9447f4847cdedb111a6594

am: d22cbc8f

Change-Id: I9ce4b77de5cb1e19428732824ae5ab528ac64a04

am: f1b06df3

Change-Id: I0d98e192600c94f983d7b0347715e2ba6a8b8dab