am: 7138973f

Change-Id: I19217d9c4f428223beef29605ab4fd4f0a0db4b7

am: 484a277c

Change-Id: Iaa779c0d07bc503e27d0d9b65816347e819daa8a

am: 2261cab6

Change-Id: Id44a7c591e8d7640c89e74cb9e88ce7849439c29

am: 1871fc0a

Change-Id: I2d474b6d04d0fa2af7ad35d7af068e38477609ee

am: 4234d95f

Change-Id: I5bf5e7a14936c275d78c1ae3438dcad88da33233

am: fbccda34

Change-Id: I1dd3889756bcc6324f80d20aeecba95587e68f20

Test: works on internal marlin
Bug: 34274385
Change-Id: Idd35e5cdccb595b4e5994eb1d78fdeece0aec0a6

am: a21b8b0e

Change-Id: I959ce59a098036326ebfc3244972519fd129f364

am: 29f273ce

Change-Id: I0dc5693bddd9574eb36ee4a711652b4130afdd8e

am: f89f35ec

Change-Id: I34301b22c7ee6e041326f37ffd398245672fe926

am: c3a9e7df

Change-Id: Ifcb4f63b7111252ee3a0deb58e6471b06df58587

am: 2afd3383

Change-Id: I8447d7aeefdfd314244c16c223b23219fd95bbc4

am: bab5872c

Change-Id: I0341e66bd3a8fcbddf9daf7da84187430b5747d6

am: 2ec492f1

Change-Id: I996307180bc21742c5039ab53a6d9764925916ad

am: 9337a4dd

Change-Id: Ib3273650207e0b64cdca1d6e0e3bbdf48d292a6b

Test: Test: make cts && \
      cts-tradefed run singleCommand cts --skip-device-info \
      --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
      --module CtsSecurityHostTestCases \
      -t android.security.cts.SELinuxHostTest#testNoExemptionsForBinderInVendorBan
      Fails as expected.
Bug: 36002573

Change-Id: I298c526789b25734d5f18666c64497e5d1e181d0

So we can limit vndservicemanager access to
just vndservice_contexts.

Bug: 36052864
Test: servicemanager,vndservicemanager work
Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188

am: 81e1c12f

Change-Id: I08fa8d70c193dfc2c8c79f41b546bbb564b3822f

am: 0c31c85a

Change-Id: I2e6c151eb6b3413054f52d0dea5ab93c91065319

am: 7e9f5352

Change-Id: Ib23d7b2edadfbc7d188d21d5142f28e7c19b45ac

am: a1c06508

Change-Id: I7e586b6bf9c22ab0380f9982889f0c8c86115df1

"tee" domain is a vendor domain. Hence its rules should live on the
vendor image.

What's left as public API is that:
1. tee domain exists and that it is permitted to sys_rawio capability,
2. tee_device type exists and apps are not permitted to access
   character devices labeled tee_device.

If you were relying on system/sepolicy automatically labeling
/dev/tf_driver as tee_device or labeling /system/bin/tf_daemon as
tee_exec, then you need to add these rules to your device-specific
file_contexts.

Test: mmm system/sepolicy
Test: bullhead, angler, and sailfish boot up without new denials
Bug: 36714625
Bug: 36714625
Bug: 36720355
Change-Id: Ie21619ff3c44ef58675c369061b4afdd7e8501c6

Bug: 36855921
Test: compile, wifi works with toggling
Change-Id: Ib0819a2d552472e482e192a69530441cfc2c0fd7

am: 888bc0bb

Change-Id: Ic14649c9ecba4879547300030717e2176ce8ca53

am: ed82acb9

Change-Id: I2c7dc59f0ea468fba1e34d38a55cc2e8e6cc3289

am: 3c0561b1

Change-Id: I05d63291a5e7af356e158483255ce1c5b73a1539

am: a299bc80

Change-Id: I94b99a1ace48fafeb47280d1d6764cac70fb9464

am: f9b6368a

Change-Id: I94973e72c33c15d0c856df05ec3a12f2490f170d

am: 814edf8c

Change-Id: I9a8cd19a081ab7731f8caf098e406d0af9ce9c48