More changes went into oc-dev after the freeze-date.  Reflect them.

Bug: 37896931
Test: prebuilts - none.
Change-Id: I3300751ea7362d5d96b327138544be65eb9fc483

am: 3c7156b5

Change-Id: I20743966a8eedb8a5168356d6af3907234431e31

am: 581069bf

Change-Id: I58f7e0c44e68908101cb874789994885ed9a15e9

am: 77ea7ccb

Change-Id: I6ce8f52e97f0198cf712a60fd6af1e77090ec338

am: 1468f85f

Change-Id: Idd803017a8087ac9e9221c0ca6ac5893391db6de

am: 29713c8d

Change-Id: I7089b62f8c54e24af47263325e085f092231f29d

am: 39c4f76b

Change-Id: I54b821fa20f428eaad1c8ab934a7e479664a6038

am: 58d0d1e4

Change-Id: I1a2207be3509ec5bc7797b906e15da16099190ad

am: 58d0d1e4

Change-Id: Ia53beb365c39d501c9d6cd53a4cb72dec14b610b

Merge "Add extraneous neverallow rule to enforce attribute inclusion." into oc-dev am: b5aeaf6d am: 2f2fd365
am: 04d9f833

Change-Id: I0eaf6ae7cd00f3f53efd2243ffe15a1bb4e97442

am: dbd2b320

Change-Id: I1d4a04a8d79325f4dd7f06b995956e254668303b

Merge "Add extraneous neverallow rule to enforce attribute inclusion." into oc-dev am: b5aeaf6d am: 6f94efaf
am: 3b2bf73d

Change-Id: I666e91ca83ad916b04c325d4f75570d550fc0c61

am: 2f2fd365

Change-Id: Ice4004ddb745f5936fc430f7ff44d1df3236687a

am: d4faa3ce

Change-Id: I1791a5758eae1907dc0f15c2eeba36a0ad6577ce

am: 6f94efaf

Change-Id: I1aceeeb61ca9e558dd32b3ef33e07b6a551387e6

am: b5aeaf6d

Change-Id: Ib0ac9cf10c7cb9fd2462e0036307e2552d19b93b

am: b5aeaf6d

Change-Id: Ibcf17f7bbea4923abc5d1713227568bb35c6674b

This adds parellel rules to the ones added for media_rw_data_file
to allow apps to access vfat under sdcardfs. This should be reverted
if sdcardfs is modified to alter the secontext it used for access to
the lower filesystem

Change-Id: Idb123206ed2fac3ead88b0c1ed0b66952597ac65
Bug: 62584229
Test: Run android.appsecurity.cts.ExternalStorageHostTest with
      an external card formated as vfat
Signed-off-by: Daniel Rosenberg <drosen@google.com>

Bug: 62706738
Bug: 34133340
Test: Check that uid_time_in_state can't be read from
the shell without root permissions and that
"dumpsys batterystats --checkin| grep ctf" shows frequency
data (system_server was able to read uid_time_in_state)

Change-Id: Ic6a54da4ebcc9e10b0e3af8f14a45d7408e8686e

Due to the massively increased number of attributes in SELinux policy
as part of the treble changes, we have had to remove attributes from
policy for performance reasons.  Unfortunately, some attributes are
required to be in policy to ensure that our neverallow rules are being
properly enforced.  Usually this is not a problem, since neverallow rules
indicate that an attribute should be kept, but this is not currently the
case when the attribute is part of a negation in a group.

This is particularly problematic with treble since some attributes may
exist for HALs that have no implementation, and thus no types.  In
particular, this has caused an issue with the neverallows added in our
macros.  Add an extraneous neverallow rule to each of those auto-generated
neverallow rules to make sure that they are not removed from policy, until
the policy compiler is fixed to avoid this.  Also add corresponding rules
for other types which have been removed due to no corresponding rules.

Bug: 62591065
Bug: 62658302
Test: Attributes present in policy and CTS passes.  sepolicy-analyze also
works on platform-only policy.
Change-Id: Ic3fc034cdbd04a94167f8240cf562297e8d7c762

am: 8e955869

Change-Id: I7ccc82bc5590b099eee3a329bdd7a63fde7a8e0b

am: e729505e

Change-Id: Icedeefca21d21654af5e4fa2c7ddce389f1a96ea

am: ac8d43b3

Change-Id: I1a26e30fe47cabd7966afd2824d5bd2f584fb627

* changes:
  Merge changes from topic 'fix-neverallow-violation' into oc-dev am: 3692b318 am: 97a4c1c9
  radio: disalllow radio and rild socket for treble devices am: d3381cd9 am: 516d8555

am: 760674da

Change-Id: Ibf3d635255104966af4d0b3004cee8babeffc4f9

am: 97a4c1c9

Change-Id: I7397ec9386f7f2afdbd44186e2e81ecac1ac48b1

am: 516d8555

Change-Id: I30aae50a7e5f9d5c354fa9b459451b0f111d94de

am: 8aa283fe

Change-Id: I7593dd0f7f2888fb5b2aa5a20b258d3a370146fe

am: 3692b318

Change-Id: Ide1a5455e2b279ac1532bbdb88e852dba3ee2b28

am: 3692b318

Change-Id: I8affb6f117f842ebdf083ec24083e190dde0082a

am: d3381cd9

Change-Id: I33215b5c9d894823f3928742a8712ef42d803156

am: d3381cd9

Change-Id: Iaabe00cb6e919b4e35896c0d9ef1770aee3b2363

* changes:
  build: run neverallow checks on platform sepolicy
  radio: disalllow radio and rild socket for treble devices

CTS checks to make sure that the _contexts files on a device have
a superset of the AOSP entries.  This was removed due to concurrent
master and DR development.  Restore the entry to allow CTS to pass.

Bug: 38241921
Bug: 62348859
Test: Policy builds and is identical to oc-dev for prop ctxts.
Change-Id: I87ccbee7aadee57b8e46ede73280810362b618c0