While here, remove a lot of extra permissions that we apparently
had because hostapd was inheriting fds from netd.

Bug: 30041118
Test: netd can request init to start/stop hostapd without denials.

Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd

Needed for setting up VPN and PAN networks.

avc: denied { ioctl } for pid=1926 comm="Binder:1088_6" path="socket:[21847]" dev="sockfs" ino=21847 ioctlcmd=8922 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=udp_socket permissive=0

avc: denied { ioctl } for comm=425420536572766963652043616C6C path="socket:[152297]" dev="sockfs" ino=152297 ioctlcmd=8927 scontext=u:r:bluetooth:s0 tcontext=u:r:bluetooth:s0 tclass=udp_socket permissive=0

Change-Id: Id29c2f91ff16a02fe75a04d2828896f501ba127f

Merge \\\\"init.te: allow writting to /proc/sys/vm/overcommit_memory\\\\" am: 87f2ca2d am: 47b12481 am: 91eecd34
am: 90eb79b9

Change-Id: I67cd5ab8b6ed8b3b14274808025ae41081b42e59

Merge \\\"init.te: allow writting to /proc/sys/vm/overcommit_memory\\\" am: 87f2ca2d am: 47b12481
am: 91eecd34

Change-Id: If199e52c747a6769c628c796d4882e5fc4a4ced5

am: 47b12481

Change-Id: I8c64aa93dead6d8363f42eaa9da9dc5892f5dd28

am: 87f2ca2d

Change-Id: Ia0ebfddad770c09ded5fecd2273f78d560507e9f

am: 7cff3841

Change-Id: Ibf229fad8ff7b8b9844be333cc7861b8c465bec3

am: 58c19e3d

Change-Id: I252fead242abbacc8c1499a0bfd6d99c340d8e0e

am: a86ae374

Change-Id: I525a4c3b995b0c9f090739fa51a14f4ed13355ee

am: ad03e7db

Change-Id: I1fa0ced9c61bacc1b577ccee9c5a47459066d45f

am: 14b2fedc

Change-Id: I6cb0d86781cc1b0f79a2563328e48411d64d252f

am: 135bf1eb

Change-Id: I5f5ac7ec1ee88221d8e7f7d2d6e918809896d12b

am: 43c1d482

Change-Id: I97ce8fdc250882bc166839c3c9e3f2311006d3c8

Change-Id: I874557582d244956a5a7a4305c00ac2f0c190a88

Bug: 28936216
Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5

Since there is "write /proc/sys/vm/overcommit_memory 1" line in init.rc

Change-Id: I5899d2802e7fa56b438a06d4cadb4eb6827bfe16
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>

Change-Id: Ic4ca5f3824696b991542bb0e441e98d51243f6d2

am: 8f40b41e

Change-Id: I8e674a6a1b19abde7eaa7ab010289e68a83b05ea

bug 24503801

Change-Id: I6cf1afb3982c4da4f5e57188d3e24ac01c4bd416

am: f5e50596

Change-Id: I1be9c5c9986026460314a3b352f694c0e015d167

am: ad5b4be3

Change-Id: Ifcbba22f28194f830ac757163a189cf53e6c7583

Required for using native audio in BootAnimation

Bug: 29055299
Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478

WifiStateMachin: type=1400 audit(0.0:24): avc: denied { call } for
scontext=u:r:system_server:s0 tcontext=u:r:wificond:s0 tclass=binder
permissive=0

Bug: 29607308
Test: Above denial disapears

Change-Id: I9b5cfe414683991ffb6308eea612ca6750f1b8ec

avc: denied { create } for scontext=u:r:wificond:s0
tcontext=u:r:wificond:s0 tclass=udp_socket permissive=0

avc: denied { net_raw } for capability=13 scontext=u:r:wificond:s0
tcontext=u:r:wificond:s0 tclass=capability permissive=0

avc: denied { read } for name="psched" dev="proc" ino=4026535377
scontext=u:r:wificond:s0 tcontext=u:object_r:proc_net:s0 tclass=file
permissive=0

Test: fixes above avc denials
Bug: 29579539

Change-Id: Ie1dff80103e81cfba8064a22b5dd3e1e8f29471b

wificond would like to be able to set WiFi related properties
without access to the rest of the system properties.  Today,
this only involves marking the driver as loaded or unloaded.

avc: denied { write } for name="property_service" dev="tmpfs" ino=10100
scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0
tclass=sock_file permissive=0

Bug: 29579539
Test: No avc denials related to system properties across
      various WiFi events.

Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f

avc: denied { write } for name="fwpath" dev="sysfs" ino=6863
scontext=u:r:wificond:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0
tclass=file permissive=0

Test: wificond and netd can write to this path, wifi works
Test: `runtest frameworks-wifi` passes

Bug: 29579539

Change-Id: Ia21c654b00b09b9fe3e50d564b82966c9c8e6994

Add the necessary permissions for |wpa_supplicant| to expose a binder
interface. This binder interface will be used by the newly added
|wificond| service (and potentially system_server).
|wpa_supplicant| also needs to invoke binder callbacks on |wificond|.

Changes in the CL:
1. Allow |wpa_supplicant| to register binder service.
2. Allow |wpa_supplicant| to invoke binder calls on |wificond|.
3. Allow |wificond| to invoke binder calls on |wpa_supplicant|

Denials:
06-30 08:14:42.788   400   400 E SELinux : avc:  denied  { add } for
service=wpa_supplicant pid=20756 uid=1010 scontext=u:r:wpa:s0
tcontext=u:object_r:default_android_service:s0 tclass=service_manager
permissive=1

BUG:29877467
TEST: Compiled and ensured that the selinux denials are no longer
present in logs.
TEST: Ran integration test to find the service.

Change-Id: Ib78d8e820fc81b2c3d9260e1c877c5faa9f1f662

am: 1a73385f

Change-Id: Ib676af7d9f3a5224c72e6152471b93468f0044ce

am: f4c4907b

Change-Id: I6d0a19de889e947e424bb1b032240ff71040e483

Bug: 29278988
Change-Id: I199572377a6b5c33116c718a545159ddcf50df30

Merge commit \\\'2931f84c\\\' into HEAD am: 92b58b81 am: 084c52c8
am: d9ad7eca

Change-Id: I211b1a525d52bee422295c57516dcaec4a572e3d

am: 084c52c8

Change-Id: If99ed6b19b5a56679f9a8a4030448e5cfc66926c

am: 92b58b81

Change-Id: I22d96506d1495b788d7e8b8ab3271fb5c581116c