Merge "domain_deprecated: remove tmpfs dir access am: ca5bb337 am: 453f4a51 am: 407e9457 am: 8b0f89e4"

am: 8b0f89e4

Change-Id: I6a75dc96a8e5994f22a8776a413d8a6a01da4fdd

Merge "domain_deprecated: remove tmpfs dir access am: ca5bb337 am: 453f4a51 am: 407e9457 am: 8b0f89e4"

Merge "Merge "Preserve attributes needed for CTS" into oc-dr1-dev am: 1eff6417 am: d006aea0  -s ours"

am: 8b0f89e4

Change-Id: I02aefb28ad044dc7d85956156fde638c101bdbe5

Merge "Merge "Preserve attributes needed for CTS" into oc-dr1-dev am: 1eff6417 am: d006aea0  -s ours"

am: d006aea0  -s ours

Change-Id: Ie76a6c836163a8755507232b5b493a24a7b84da8

am: d006aea0  -s ours

Change-Id: Ifce7d19ce6469f5526a2e4d2b40db07c6524e368

Merge "Merge changes from topic 'am-52eed220ada34c3aba959fcbb20dfeab' into oc-dr1-dev-plus-aosp am: c436013b  -s ours"

am: c436013b  -s ours

Change-Id: I8af59aba167dfd27cd4773eb573978d539dec1ff

am: c436013b  -s ours

Change-Id: I89a0c3cfab8e44218b7978c32c577717df522069

am: 407e9457

Change-Id: If277928809ec2bcaf7f72ef9cba5dd5d45d333ca

am: 453f4a51

Change-Id: Iff9292a4a92fdd78eebdf2ec5fab8d571fc755f6

am: ca5bb337

Change-Id: I185d127216ee72821c64daf31601fdcbe1a9c069

am: 1eff6417

Change-Id: I095df5cbd680d495fac54186ab16e2287d454c3a

Commit: 4dc88795 changed the label of
uid_time_in_state from proc to proc_uid_time_in_state.  This file
could have been used by vendor services.  Add a compat mapping.

Bug: 62573845
Test: None. Prebuilt change only.
Change-Id: I2e5222c4d4fe12cb0bbc4e85ba53c1f59b714d61

Merge "remove mke2fs rules from global file_contexts am: 0d32323c  -s ours am: 7acd39d2  -s ours"

* changes:
  remove mke2fs rules from global file_contexts am: 0d32323c  -s ours am: 91748747  -s ours
  move e2fs tools from /sbin to /system/bin am: ae047956 am: a8beb22e  -s ours

am: 7acd39d2  -s ours

Change-Id: I16bc3700ae6e363512b647a4f4f8c9d6646e5066

am: 91748747  -s ours

Change-Id: Ic1c432a08d80a03f574676b50b1805e2e0f7bc09

am: a8beb22e  -s ours

Change-Id: Icb5f4e4dec18f62df41d0e89ffa4909a74a5fa63

am: 91748747  -s ours

Change-Id: If702e73a84560aa6dd98b95113f5c2798636c5f7

am: a8beb22e  -s ours

Change-Id: Id5fdb2f361a0ef1757c0db18dfacb18914b826b3

* changes:
  remove mke2fs rules from global file_contexts am: 0d32323c  -s ours
  move e2fs tools from /sbin to /system/bin am: ae047956

am: 0d32323c  -s ours

Change-Id: I2283da4878b60860400d31eaff019faef2b2c888

am: ae047956

Change-Id: I6b61f896f97bfe7ed9d2dfeb876d76e0101e093a

am: 0d32323c  -s ours

Change-Id: I9cb9b52f452394a32c51ec2aefd502e21896c61d

am: ae047956

Change-Id: Id8c7b9ab97ad80332b65fd02ba9ca61e67dac218

Address "granted" audit messages for dumpstate use of df.

avc: granted { getattr } for comm="df" path="/mnt" dev="tmpfs"
scontext=u:r:dumpstate:s0 tcontext=u:object_r:tmpfs:s0
tclass=dir
avc: granted { search } for comm="df" name="/" dev="tmpfs"
scontext=u:r:dumpstate:s0 tcontext=u:object_r:tmpfs:s0
tclass=dir

Bug: 28760354
Test: Build, check logs.
Change-Id: I920948a5f0bce1b4bd2f15779730df8b3b1fea5a

Change fb889f23 "Force expand all hal_* attributes" annotated all
hal_* attributes to be expanded to their associated types. However
some of these attributes are used in CTS for neverallow checking.
Mark these attributes to be preserved.

In addition, remove the hacky workaround introduced in oc-dev
for b/62658302 where extraneous neverallow rules were introduced
to prevent unused or negated attributes from being auto-expanded
from policy.

Bug: 62658302
Bug: 63135903
Test: cts-tradefed run cts -m CtsSecurityHostTestCases -t \
    android.cts.security.SELinuxNeverallowRulesTest

    armeabi-v7a CtsSecurityHostTestCases completed in 4s.
    501 passed, 0 failed, 0 not executed
Merged-In: I989def70a16f66e7a18bef1191510793fbe9cb8c
Change-Id: I989def70a16f66e7a18bef1191510793fbe9cb8c

Change fb889f23 "Force expand all hal_* attributes" annotated all
hal_* attributes to be expanded to their associated types. However
some of these attributes are used in CTS for neverallow checking.
Mark these attributes to be preserved.

In addition, remove the hacky workaround introduced in oc-dev
for b/62658302 where extraneous neverallow rules were introduced
to prevent unused or negated attributes from being auto-expanded
from policy.

Bug: 62658302
Bug: 63135903
Test: cts-tradefed run cts -m CtsSecurityHostTestCases -t \
    android.cts.security.SELinuxNeverallowRulesTest

    armeabi-v7a CtsSecurityHostTestCases completed in 4s.
    501 passed, 0 failed, 0 not executed
Change-Id: I989def70a16f66e7a18bef1191510793fbe9cb8c

The code used to look like this, but in commit
4cae28d4 we replaced the generic
regexes to improve performance.  Now that we've switched to genfs,
this no longer affects performance, so let's simplify the labeling.

Bug: 62413700
Test: Built, flashed, and booted two devices.  Verified that all of
the files have the correct context and that wifi, camera, and traceur
work.

Change-Id: I1a859d17075fa25543ee090cc7a7478391bc45c1

This should slightly improve performance, as file_contexts is slower
than genfs_contexts.

Now that the kernel patch enabling genfs labeling of tracefs has
landed, we can re-enable this.

Bug: 62413700
Test: Built, flashed, and booted two devices.  Verified that all of
the files have the correct context and that wifi, camera, and traceur
work.

Change-Id: Ifc1c6ac634b94e060ed1f311049bd37f6fcc8313

move them to device-specific files.

Bug: 62908056
Change-Id: I299819785d5a64e6ecdde1cd7da472477fe1e295
Merged-In: If92352ea7a70780e9d81ab10963d63e16b793792