am: 5ed3131e

Change-Id: Idd271962226c30a157c1b04f6ee3c56afe1f7f28

am: f412cc62

Change-Id: I576ad54dc5526a022e0725b15a2e326df5432e31

Bug: 31254800
Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7

am: 030632f0

Change-Id: I2a2a4208770736207aeb1226f5d4f00b3eb3d57e

am: 8db0f254

Change-Id: I10537bd00dcb129741b10c3af960e7f6eacd459e

am: 35a0597a

Change-Id: I8ee43acea1274d46ca6071c472b8c7427101b384

am: 28e18c3a

Change-Id: I88bec1549bb1a28b70cb32b10911baa8d91669e9

am: a60342b7

Change-Id: I2d7c99660b6bb9b45922f1203cb1eafe90659238

bug: 30963384

(cherry picked from commit 63203a01)

Change-Id: Ifa4b9a645f8edcf51e3f025316106e5b65a4790d

am: 4af6d81b

Change-Id: I3ee22a0599e0333662a743a99ae92a8a46313135

am: 63203a01

Change-Id: I5beb026a80cf9c2c6613d77c1b798797aa10eeb5

bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5

am: ce84793b

Change-Id: Ief73a034bbd522f633cda815e7a4d0f319e78f49

am: a59830d9

Change-Id: Ibb2f08c673f62136d51b6c510b830bcc958ce236

am: 7e380216

Change-Id: I827a8b38264906bd06a8fefb9c3a8209dbc1035f

Bluetooth is sometimes started from init.

Addresses the following compiler error:

  libsepol.report_failure: neverallow on line 489 of
  system/sepolicy/domain.te (or line 9149 of policy.conf) violated by
  allow init bluetooth:process { transition };
  libsepol.check_assertions: 1 neverallow failures occurred
  Error while expanding policy

Change-Id: I2bc1e15217892e1ba2a62c9683af0f3c0aa16b86

am: 31bb306a

Change-Id: I542273a4affe02b0f7df0c90cf6bb33d77b79958

am: 76e85e8c

Change-Id: I6a7c4aa29186b32ab3dd94d028104ed50048735b

am: 69fe5d07

Change-Id: Iaaea2aaeaba08869a8885c88e07c436196134d11

am: 81fb2363

Change-Id: I129acfbecd2b8bb840c4d4897dbcc43f2ed0d2e2

am: c55cf17a

Change-Id: I48f8bbfab4cdd36e6f1555919ff5d032c07af0a2

am: eedacf83

Change-Id: I4b23d564c6a4787180fea2c1530cc78808cbd0d0

Apparently some manufacturers sign APKs with the platform key
which use renderscript. Renderscript works by compiling the
.so file, and placing it in the app's home directory, where the
app loads the content.

Drop platform_app from the neverallow restriction to allow partners
to add rules allowing /data execute for this class of apps.

We should revisit this in the future after we have a better
solution for apps which use renderscript.

Bug: 29857189
Change-Id: I058a802ad5eb2a67e657b6d759a3ef4e21cbb8cc

Previously appdomains allowed to execute off of /data
where whitelisted. This had the unfortunate side effect of
disallowing the creation of device specific app domains
with fewer permissions than untrusted_app. Instead grant
all apps a neverallow exemption and blacklist specific app
domains that should still abide by the restriction.

This allows devices to add new app domains that need
/data execute permission without conflicting with this rule.

Bug: 26906711

(cherry picked from commit c5266df9)

Change-Id: I4adb58e8c8b35122d6295db58cedaa355cdd3924

b/30832947

Change-Id: Icd5117d655f1197524b39fe7bc1b11c4d920093c

am: 1be3b599

Change-Id: Ic03e67552c00de2971476e09820895b7fa970e80

am: 028ed753

Change-Id: Iaa9668ca04cf60d0adf43b42c3a27da824f4f094

am: 6ef377a0

Change-Id: I5b2d822f8414feadd61ef195a9e357ccba8481ba

am: 88c51465

Change-Id: I0033d9fa5d4f46a73e7778690fab899464154def

Allow the otapreopt rename script to read file attributes. This is
being used to print the aggregate artifact size for diagnostic
purposes.

Bug: 30832951
Change-Id: Iee410adf59dcbb74fa4b49edb27d028025cd8bf9

am: 27f19427

Change-Id: I988cfc4a59a6e8c5142b052f39b00697be9f1ad9

The recovery flow for A/B devices allows to sideload an OTA downloaded
to a desktop and apply from recovery. This patch allows the "recovery"
context to perform all the operations required to apply an update as
update_engine would do in the background. These rules are now extracted
into a new attributte called update_engine_common shared between
recovery and update_engine.

Bug: 27178350

(cherry picked from commit d63084d3)

Change-Id: I1f3e1e83a21e37e09b69cd9c497f87b42b9cbeb1

DRM 3rd party application with platform signature
requires the permission.

Bug: 30352348
Change-Id: Idd673506764ae435db1be8cc8c13658541ffa687

am: 320a0f54

Change-Id: I6aec72f8175839f4fefeb50f86fedc4202c776b8

Change-Id: Ia938d73b1a49b9ba4acf906df37095d21edee22e