Add selinux policies for init script and shell script to unzip a tar
containing ASAN libraries on boot.

Bug: 36458146
Test: m && m SANITIZE_TARGET=address
Test: manual (build steps for tar missing)
Change-Id: I5c3cb233aae93ee9985431090af902b0e3c1b0a7

am: 3ccbea52

Change-Id: Ib402849b6efff93fd763d7b2bddf470c79067c47

Merge "Refactor sanitized library on-disk layout - SELinux." am: a2e9664c am: ebe26cbb am: ba0c430b
am: 91b0903c

Change-Id: I3315811aa97328a00ae123ac7ea9b454ebaa8ba6

am: d14187d6

Change-Id: I16abf8a56c0a3e4dc0fe8a6bbd585286fa2b273e

am: bb51a941

Change-Id: Ibeacdffdbcd24e0a34617ef1f259764242db2d3e

am: ba0c430b

Change-Id: I81611c73460132d34d9bc4c30df6d99b3f0d97a4

am: 5af76fca

Change-Id: I705f9a6cc45c6c8829d148d2c2ba333ba23759ac

am: 58cb5787

Change-Id: I219d6074cf3ff7253ef74ebc6d8aa5372d296243

am: ebe26cbb

Change-Id: If6ca7b2337a0b80b6fe2c0163e9a8bec2e7d6829

am: 6b92e26a

Change-Id: Ie76aa1f95e72b6183c13be4f9dc86481a2d63077

am: a2e9664c

Change-Id: I184d353b6ca0c8e5b712da11b4de777e04a5b79f

am: 7ba028a6

Change-Id: Ic545bb7a00acc0bf0b106ec67d05715f40e3bdd2

am: fc8bbd7e

Change-Id: I1f7323f857093bc793bd03f956c64626170e503f

am: f81e48b6

Change-Id: Ied9a916f080a85d41165cb9e427ad8e696e695ed

am: eca32251

Change-Id: I22930eb5a18047b235b6d1028a3fc49e5a6b0989

This futher restricts neverallows for sockets which may be exposed as
filesystem nodes. This is achieved by labelling all such sockets
created by core/non-vendor domains using the new coredomain_socket
attribute, and then adding neverallow rules targeting that attribute.

This has now effect on what domains are permitted to do. This only
changes neverallow rules.

Test: mmm system/sepolicy
Bug: 36577153
Change-Id: I633163cf67d60677c4725b754e01097dd5790aed

am: 1eb656f0

Change-Id: I88aa508e35a59924715acb6d77e37344e41b55fe

am: ea0a3027

Change-Id: I20ec1ec4f217d3c6622f5bc263c268ba343bf493

This removes access to
* contexthub_service
* device_policy_service
* ethernet_service
* fingerprint_service
* shortcut_service
* trust_service
* usb_service

Test: cts-tradefed run commandAndExit cts-dev -m
CtsAppSecurityHostTestCases -t
android.appsecurity.cts.EphemeralTest
Bug: 33349998

Change-Id: Iad9302041d7674ae6ebeb1c559c64d13df62c304

Test: adb kill-server && adb shell dumpsys storaged
Bug: 36492915
Change-Id: I3a1a2ad2f016ddd5770d585cae82c8be69001df9

am: e777112e

Change-Id: I893aff73fa2beb83bee0e17aec849ac49d03c639

am: f4739f40

Change-Id: Ie07e3ababe6836f6b5c2522c3a3255367d01b662

am: ff61a10c

Change-Id: Ie0c415ee9e79628f0048ff30d0daffbd89420f74

am: b5081ea0

Change-Id: I3decd5c29ee797486d563393212cfc09666b77e1

the list to update was determined by looking
at who currently has access to surfaceflinger
for ipc and FD use.

Test: try some media stuff
Bug: 36333314
Change-Id: I474d0c44f8cb3868aad7a64e5a3640cf212d264d

am: 8f288f56

Change-Id: Ic1ff068363790a030eb15776fda5b32704b9a465

Runas/libselinux needs access to seapp_contexts_file to determine
transitions into app domains.

Addresses:
avc: denied { read } for pid=7154 comm="run-as" name="plat_seapp_contexts"
dev="rootfs" ino=9827 scontext=u:r:runas:s0
tcontext=u:object_r:seapp_contexts_file:s0 tclass=file

Bug: 36782586
Test: Marlin policy builds
Change-Id: I0f0e937e56721d458e250d48ce62f80e3694900f

am: a21b3b19

Change-Id: I3e0bb56e66f2e4dc2ac04288e96c79070a710490

am: 6f700ae5

Change-Id: I6d58dcfa6037dc916d9ab5b995d2132e559783e1

am: 02d9d21d

Change-Id: I29861f9cc52001f2968c2313f48031dd01afe8c7

am: 52ae8351

Change-Id: I7a84acb504ffb803e3e782d0c5b2d4daf7565e8f

am: ef2057a6

Change-Id: I1c706c034571de2470fdb4458ab7c1ea43e4f52e