Various policy updates.

Assortment of policy changes include:
 * Bluetooth domain to talk to init and procfs.
 * New device node domains.
 * Allow zygote to talk to its executable.
 * Update system domain access to new device node domains.
 * Create a post-process sepolicy with dontaudits removed.
 * Allow rild to use the tty device.

Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>

Android.mk

@@ -77,10 +77,12 @@ $(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
 $(sepolicy_policy.conf) : $(call build_policy, security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te roles users initial_sid_contexts fs_use genfs_contexts port_contexts)
 	@mkdir -p $(dir $@)
 	$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@
+	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
 
 $(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
+	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
 
 built_sepolicy := $(LOCAL_BUILT_MODULE)
 sepolicy_policy.conf :=

bluetooth.te

@@ -26,3 +26,9 @@ allow bluetoothdomain bluetooth:unix_stream_socket { read write shutdown };
 # tethering
 allow bluetooth self:{ tun_socket udp_socket } { ioctl create };
 allow bluetooth efs_file:dir search;
+
+# Talk to init over the property socket.
+unix_socket_connect(bluetooth, property, init)
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file rw_file_perms;

device.te

@@ -30,8 +30,10 @@ type qemu_device, dev_type;
 type kmsg_device, dev_type;
 type null_device, dev_type, mlstrustedobject;
 type random_device, dev_type;
+type sensors_device, dev_type;
 type serial_device, dev_type;
 type socket_device, dev_type;
+type timerirq_device, dev_type;
 type tty_device, dev_type;
 type urandom_device, dev_type;
 type video_device, dev_type;
@@ -46,6 +48,7 @@ type watchdog_device, dev_type;
 type uhid_device, dev_type;
 type tun_device, dev_type, mlstrustedobject;
 type usbaccessory_device, dev_type;
+type usb_device, dev_type;
 
 # All devices have a uart for the hci
 # attach service. The uart dev node

file.te

@@ -5,6 +5,7 @@ type sockfs, fs_type;
 type rootfs, fs_type;
 type proc, fs_type;
 type qtaguid_proc, fs_type, mlstrustedobject;
+type proc_bluetooth_writable, fs_type;
 type selinuxfs, fs_type;
 type cgroup, fs_type, mlstrustedobject;
 type sysfs, fs_type, mlstrustedobject;

file_contexts

@@ -41,6 +41,7 @@
 /dev/block/loop[0-9]*	u:object_r:loop_device:s0
 /dev/block/ram[0-9]*	u:object_r:ram_device:s0
 /dev/block/mtdblock5	u:object_r:radio_device:s0
+/dev/bus/usb(.*)?       u:object_r:usb_device:s0
 /dev/cam		u:object_r:camera_device:s0
 /dev/console		u:object_r:console_device:s0
 /dev/cpuctl(/.*)?	u:object_r:cpuctl_device:s0

mediaserver.te

@@ -49,4 +49,4 @@ allow mediaserver qtaguid_proc:file rw_file_perms;
 allow mediaserver qtaguid_device:chr_file r_file_perms;
 
 # Allow abstract socket connection
-allow mediaserver rild:unix_stream_socket connectto;
+allow mediaserver rild:unix_stream_socket { connectto read write setopt };

rild.te

@@ -37,3 +37,5 @@ allow rild radio_prop:property_service set;
 
 # Read/Write to uart driver (for GPS)
 allow rild gps_device:chr_file rw_file_perms;
+
+allow rild tty_device:chr_file rw_file_perms;

system.te

@@ -221,3 +221,10 @@ allow system backup_data_file:dir { relabelto relabelfrom };
 allow system cache_backup_file:file { relabelto relabelfrom };
 # LocalTransport creates and relabels /cache/backup
 allow system cache_backup_file:dir { relabelto relabelfrom create_dir_perms };
+
+# Allow system to talk to usb device
+allow system usb_device:chr_file rw_file_perms;
+allow system usb_device:dir r_dir_perms;
+
+# Allow system to talk to sensors and timer irq
+allow system { sensors_device timerirq_device }:chr_file rw_file_perms;

zygote.te

@@ -37,3 +37,6 @@ allow zygote sdcard_type:dir { write search setattr create add_name mounton };
 dontaudit zygote self:capability fsetid;
 allow zygote tmpfs:dir { write create add_name setattr mounton search };
 allow zygote tmpfs:filesystem mount;
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file { execute_no_trans open };