Snap for 4787078 from 4c2e89ba to pi-release

Change-Id: I93bfe02fcef6ed82d97c914735ac345d0412528a

prebuilts/api/28.0/public/domain.te

@@ -466,7 +466,7 @@ neverallow {
 }:file no_x_file_perms;
 
 # The test files and executables MUST not be accessible to any domain
-neverallow domain nativetest_data_file:file_class_set no_w_file_perms;
+neverallow { domain userdebug_or_eng(`-kernel') } nativetest_data_file:file_class_set no_w_file_perms;
 neverallow domain nativetest_data_file:dir no_w_dir_perms;
 neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
 

prebuilts/api/28.0/public/kernel.te

@@ -69,7 +69,7 @@ allow kernel asec_image_file:file read;
 # and for LTP kernel tests (b/73220071)
 userdebug_or_eng(`
   allow kernel update_engine_data_file:file read;
-  allow kernel nativetest_data_file:file read;
+  allow kernel nativetest_data_file:file { read write };
 ')
 
 # Access to /data/media.

prebuilts/api/28.0/public/property_contexts

@@ -292,6 +292,7 @@ ro.product.vendor.name u:object_r:exported_default_prop:s0 exact string
 ro.vendor.build.date u:object_r:exported_default_prop:s0 exact string
 ro.vendor.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.vendor.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.vndk.lite u:object_r:exported_default_prop:s0 exact bool
 ro.vndk.version u:object_r:exported_default_prop:s0 exact string
 ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
 wifi.direct.interface u:object_r:exported_default_prop:s0 exact string

public/domain.te

@@ -466,7 +466,7 @@ neverallow {
 }:file no_x_file_perms;
 
 # The test files and executables MUST not be accessible to any domain
-neverallow domain nativetest_data_file:file_class_set no_w_file_perms;
+neverallow { domain userdebug_or_eng(`-kernel') } nativetest_data_file:file_class_set no_w_file_perms;
 neverallow domain nativetest_data_file:dir no_w_dir_perms;
 neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
 

public/kernel.te

@@ -69,7 +69,7 @@ allow kernel asec_image_file:file read;
 # and for LTP kernel tests (b/73220071)
 userdebug_or_eng(`
   allow kernel update_engine_data_file:file read;
-  allow kernel nativetest_data_file:file read;
+  allow kernel nativetest_data_file:file { read write };
 ')
 
 # Access to /data/media.

public/property_contexts

@@ -292,6 +292,7 @@ ro.product.vendor.name u:object_r:exported_default_prop:s0 exact string
 ro.vendor.build.date u:object_r:exported_default_prop:s0 exact string
 ro.vendor.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.vendor.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.vndk.lite u:object_r:exported_default_prop:s0 exact bool
 ro.vndk.version u:object_r:exported_default_prop:s0 exact string
 ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
 wifi.direct.interface u:object_r:exported_default_prop:s0 exact string