am: 8c7ad767

Change-Id: I9f93295332dc646bb31b5ab54daf09b2e142bdee

am: 460e3caf

Change-Id: Ibe53a60b40cb6d7cc941f7550a516cbe09060773

Add mapping compatibility file for sepolicy api lvl 26.0 am: de51e7de am: 97cfd1fd am: 1b29c5bb
am: df7e9eb7

Change-Id: Id5d0c7a7708e7d00707a85b6184a003453280c0e

am: 7bcd8d5b

Change-Id: I2479d531433b616a94ceabed4741132beac116f9

am: 83732d2e

Change-Id: Ic52e4cc29a5448cb5865095851bf2d02e23fcc0e

am: b1a8aa4f

Change-Id: Idcf01bfbe16e7237a60975004905b9cd79421972

am: 9aefc916

Change-Id: I460f3869954b78fa7cb5532cfd8fe9c3eec40402

am: d440cea1

Change-Id: I7dcf40b5d78c67e566c9c89201c14f49fa927ba4

am: 1b29c5bb

Change-Id: Ia4afe4dbc01bac08ad2603466c5130c209b481dd

am: a3d02508

Change-Id: I89c1785e6acea09314ceab680a6d46cb3e34ae43

am: 39029b26

Change-Id: Iee265fd34d2951d2e6c42729a81238f489651b0b

am: 97cfd1fd

Change-Id: Ia5edfdfc346029d8126a64b3a1402ce1aff03c73

am: 0989692e

Change-Id: I438b17d057a299dab2a32ec9a4247838efeec4c5

am: 3686efca

Change-Id: Id89ed4bbb4ff2391dbce3f4ac18bfa5da6289891

am: de51e7de

Change-Id: Iaa0ce172ecde91c9ade7a04843bba27f4b0b3fb5

am: fff3fe2f

Change-Id: I90fbe24c3e2f7c6d62234e49026b59064b156cbf

(cherry-pick of commit: 55c77504)

Bug: 37916906
Bug: 37896931
Test: none, just prebuilt update.
Change-Id: I55b5179f98703026699a59cce4b2e1afb166fd1d

More changes went into oc-dev after the freeze-date.  Reflect them.
(cherry-pick of commit: 148578a6)

Bug: 37916906
Bug: 37896931
Test: prebuilts - none.
Change-Id: I3300751ea7362d5d96b327138544be65eb9fc483

commit: 5c6a227e added the oc-dev
sepolicy prebuilts (api 26.0), but did not include the corresponding
base mapping file, which is to be maintained along with current
platform development in order to ensure backwards compatibility.
(cherry-pick of commit: 5e4e0d7f)

Bug: 37916906
Bug: 37896931
Test: none, this just copies the old mapping file to prebuilts.
Change-Id: Ia5c36ddab036352845878178fa9c6a9d649d238f

Copy the final system sepolicy from oc-dev to its prebuilt dir
corresponding to its version (26.0) so that we can uprev policy and
start maintaining compatibility files, as well as use it for CTS
tests targeting future platforms.

(cherry-pick of commit: 5c6a227e)

Bug: 37896931
Bug: 37916906
Test: none, this just copies the old policy.
Change-Id: Ib069d505e42595c467e5d1164fb16fcb0286ab93

Test: only a compile-time change (adds neverallow rules), so, did
     m -j sepolicy on the following targets:
  - marlin
  - sailfish
  - 2017 devices
Bug: 36162501
Change-Id: I1092aff40da9dcf09bd044400bedd1f549eb7e38

Don't create nonplat_service_contexts on full_treble devices am: e83f1e56 am: 0d5bca44 am: e06f443c
am: f3a6adfd  -s ours

Change-Id: I442d4a9579393ffc5a4bfd284ddf9dcb4c633845

am: e06f443c

Change-Id: Ib2245d6767275440d9c0ad775222d8c923e0281f

am: 0d5bca44

Change-Id: I31b9e976864301454fd82108d51f2ac9cda34578

am: e83f1e56

Change-Id: I6c7a9a6c52f670a8f18240def3b0b1f416001236

Concatenates all 'bug_map' files and places the file on device under
/system/etc/selinux/bug_mappings

Bug: 34997782
Test: the file appears properly on device when bug_map files are present
Change-Id: I12d6c90983932f7d5e1d1f7586fa30a5edd7b0c5

This change is the bare minimum needed to publish a new vold
Binder service and move the simple "reset" call over to go through
the new interface.

The new rules here are mirrored on the existing installd rules, but
with a handful of neverallow rules relaxed due to funky interactions
with hal_client_domain().

Test: builds, boots
Bug: 13758960
Change-Id: Ia9522ea7a68698cb0edce7879abfbf22b9d67c76

On full Treble devices, servicemanager should only host services
served from processes on /system; nonplat_service_contexts
should not be created at all in this case.

Bug: 36866029
Test: Build marlin and make sure nonplat_service_contexts is not
      created.

Change-Id: Id02c314abbb98fc69884198779488c52231d22c3
Merged-In: Id02c314abbb98fc69884198779488c52231d22c3

am: d79a822f  -s ours

Change-Id: I297a4a162de814979970a5c4bab4e35695c025e4

am: 59f23650  -s ours

Change-Id: I8563d9e3347f7c62d9fcd5b2c26c160a957be0b5

am: 8b6ceed0

Change-Id: I39a8c2a75f646f3943d925adc4444777a90b9076

am: 5b2ebd3b

Change-Id: I74209b877fdacaa485798b393678989029835924

This reverts commit 9216a6ad.

Bug: 65206688

Merged-In: I8e61b77a1abe9543e4fba77defb8062407676fcf
Change-Id: I8e61b77a1abe9543e4fba77defb8062407676fcf

On full Treble devices, servicemanager should only host services
served from processes on /system; nonplat_service_contexts
should not be created at all in this case.

Bug: 36866029
Test: Build marlin and walleye and make sure nonplat_service_contexts
      is not created.

Change-Id: Id02c314abbb98fc69884198779488c52231d22c3

am: e92b7f16

Change-Id: I0e0e1b2c525a26b5da8a3536df5ccfa72b9e79a8

am: a30b6a5c

Change-Id: I3f7ace8c849689d66558c38c149453564920d013

am: 4deeab5c

Change-Id: I74319e51a152ba35fdf076a4dffdeeb0dc69763b

am: cdaf97bf

Change-Id: Ibcb3d728c233530f7354b409bf3849a021532b5d