Remove the ioctl permission for most socket types. For others, such as
tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist
that individual domains may extend (except where neverallowed like
untrusted_app). Enforce via a neverallowxperm rule.

Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe

am: 6248c75a

Change-Id: Ic79735153f0f87d7d546381f47b2ed0fe880a1eb

am: 4a69f2d5

Change-Id: I17be0bc6e4338728ce6d9cb258061096b6ccbf0c

am: b590d49b

Change-Id: I9c1f30177518c894ee5caa56d40876e1f20babdf

am: c21551db

Change-Id: Id77be7ffd921dc22d889c8a10c07a0287671fb90

am: f8f4d3e1

Change-Id: If2975c226b86c11595f5c41a964783f7e9caa171

am: f8f4d3e1

Change-Id: I6d7e8d7e0a3f67269fec0ee12fc3910b0ecb010f

It no longer needs access to audio and camera

Bug: 22775369
Change-Id: I1de1f0e3504b214d6943733bf60eb83654b71048

am: 73da97d0

Change-Id: I15581718916627a83878039af8b2d885a2a91819

am: 9931a075

Change-Id: I9f9583f39d75c4f4ad7d2df6ba6e45d70e2b23c2

am: 0a968a72

Change-Id: I2ef77aed3cf6898b148f33f0930d74b4118c5f89

am: 0146886b

Change-Id: Ia6e44490a08ce375fc05c68bd68376dbcb056def

am: 48cb87ad

Change-Id: Iadd1d93075f9be9895cd2e3d144e488edaf6dced

am: 2770feb1

Change-Id: Icf6f90d22560697262b4b299c77d28e5c43e701f

am: 288cc2ae

Change-Id: I22526c4e28ead7a53f99ccabdf0d002170adaffb

am: cb8b2e37

Change-Id: If630fed608189181d83e02899c1467d758a8ff7d

am: c878a025

Change-Id: I485a1724a7323f43d722ed53bf19e7741b06f539

am: c878a025

Change-Id: I386059682c8fbbfec7ad9ad009a296bc4454869c

Addresses:
avc: denied  { find } for service=media.camera pid=1589 uid=1001 scontext=u:r:radio:s0 tcontext=u:object_r:cameraserver_service:s0 tclass=service_manager permissive=0

Bug: 29190415
Change-Id: I77c0337500b8ab2f5d7d3d5982c7416fc39b1522

update_engine can trigger a factory-reset when the update to an older
version or an incompatible version requires it.

Bug: 28700985
TEST=Updated a device with a factory-reset required and the BCB was
written.

(cherry picked from commit 15105ce7)

Change-Id: I7d2efc0e7f164d618cbb3fe190882e4fa8a89bac

am: 7f09d218

Change-Id: I91aee342816214a7e8338581981acaf87e3d0228

am: dfc68513

Change-Id: Ibcc4e56fec43d2476df4bab42135a482ce1b95d2

am: 6890b729

Change-Id: Ibde18735336458720ae42607bff5d64da6f02533

am: 15105ce7

Change-Id: I6490872dd88b7da786f5ae671661acf3e5864b28

Addresses:
avc: denied  { find } for service=media.camera pid=1589 uid=1001 scontext=u:r:radio:s0 tcontext=u:object_r:cameraserver_service:s0 tclass=service_manager permissive=0

Bug: 29190415
Change-Id: I77c0337500b8ab2f5d7d3d5982c7416fc39b1522

update_engine can trigger a factory-reset when the update to an older
version or an incompatible version requires it.

Bug: 28700985
TEST=Updated a device with a factory-reset required and the BCB was
written.

Change-Id: Ief3dd386a14b669141d75b561122a3095efc0a6f

Merge \\\\"ueventd: allow getattr on blk and chr types.\\\\" am: c7927b8d am: a7f70ac0 am: 2b165b1e
am: 1ff54eb2

Change-Id: Idd3dc1ea795c953a4c602669fdefba509484df8c

am: 2b165b1e

Change-Id: Ia9f13afb4a5b81991c6860c3dd732db1438dd1ac

am: a7f70ac0

Change-Id: Ief3af01f7b53a274e0c4e5ed19983feae5cd5888

am: c7927b8d

Change-Id: If83353ea4abc05d95ec70719ca0c66d6f740cab4

Remove audit messaged.

Addresses:
avc:  granted  { read } for  pid=1 comm="init" name="cmdline" dev="proc" ino=4026535448 scontext=u:r:kernel:s0 tcontext=u:object_r:proc:s0 tclass=file
avc:  granted  { read open } for  pid=1 comm="init" path="/proc/cmdline" dev="proc" ino=4026535448 scontext=u:r:kernel:s0 tcontext=u:object_r:proc:s0 tclass=file

Bug: 28760354
Change-Id: I48ea01b35c6d1b255995484984ec92203b6083be

Merge \"Merge \\\"dumpstate: Change SELinux policy to allow reading /data/misc/profiles\\\" into nyc-dev am: f31a55c0 am: 77a44a26\" into nyc-mr1-dev-plus-aosp
am: 4d2c5733

Change-Id: Idaa5769f65cb0dc437680e4acfd01d7a607b400d

Merge \\\"dumpstate: Change SELinux policy to allow reading /data/misc/profiles\\\" into nyc-dev am: f31a55c0 am: 44798870
am: f260f790

Change-Id: I1a7f1e5c9e8c525ed462e4e7e3f0f233bdb3b09a

Merge "Merge \\"dumpstate: Change SELinux policy to allow reading /data/misc/profiles\\" into nyc-dev am: f31a55c0 am: 77a44a26" into nyc-mr1-dev-plus-aosp

Merge \\"dumpstate: Change SELinux policy to allow reading /data/misc/profiles\\" into nyc-dev am: f31a55c0
am: 77a44a26

Change-Id: Ib5a687b08e8e68bc0512facc3c8d417b7be9b9c9

Merge \\"dumpstate: Change SELinux policy to allow reading /data/misc/profiles\\" into nyc-dev am: f31a55c0
am: 44798870

Change-Id: Ib63e7483bf99100b2a9157d33c1e3cc584ac5081