am: 97cfd1fd

Change-Id: Ia5edfdfc346029d8126a64b3a1402ce1aff03c73

am: 0989692e

Change-Id: I438b17d057a299dab2a32ec9a4247838efeec4c5

am: de51e7de

Change-Id: Iaa0ce172ecde91c9ade7a04843bba27f4b0b3fb5

am: fff3fe2f

Change-Id: I90fbe24c3e2f7c6d62234e49026b59064b156cbf

commit: 5c6a227e added the oc-dev
sepolicy prebuilts (api 26.0), but did not include the corresponding
base mapping file, which is to be maintained along with current
platform development in order to ensure backwards compatibility.
(cherry-pick of commit: 5e4e0d7f)

Bug: 37916906
Bug: 37896931
Test: none, this just copies the old mapping file to prebuilts.
Change-Id: Ia5c36ddab036352845878178fa9c6a9d649d238f

Copy the final system sepolicy from oc-dev to its prebuilt dir
corresponding to its version (26.0) so that we can uprev policy and
start maintaining compatibility files, as well as use it for CTS
tests targeting future platforms.

(cherry-pick of commit: 5c6a227e)

Bug: 37896931
Bug: 37916906
Test: none, this just copies the old policy.
Change-Id: Ib069d505e42595c467e5d1164fb16fcb0286ab93

am: 0d5bca44

Change-Id: I31b9e976864301454fd82108d51f2ac9cda34578

am: e83f1e56

Change-Id: I6c7a9a6c52f670a8f18240def3b0b1f416001236

On full Treble devices, servicemanager should only host services
served from processes on /system; nonplat_service_contexts
should not be created at all in this case.

Bug: 36866029
Test: Build marlin and make sure nonplat_service_contexts is not
      created.

Change-Id: Id02c314abbb98fc69884198779488c52231d22c3
Merged-In: Id02c314abbb98fc69884198779488c52231d22c3

am: 8b6ceed0

Change-Id: I39a8c2a75f646f3943d925adc4444777a90b9076

am: 5b2ebd3b

Change-Id: I74209b877fdacaa485798b393678989029835924

This reverts commit 9216a6ad.

Bug: 65206688

Merged-In: I8e61b77a1abe9543e4fba77defb8062407676fcf
Change-Id: I8e61b77a1abe9543e4fba77defb8062407676fcf

am: 4deeab5c

Change-Id: I74319e51a152ba35fdf076a4dffdeeb0dc69763b

am: cdaf97bf

Change-Id: Ibcb3d728c233530f7354b409bf3849a021532b5d

Test: SANITIZE_HOST=true m treble_sepolicy_tests
Change-Id: I9190dc06715bbbac8a267a143801f99f911decf3

am: adf68570

Change-Id: Ida2b4c0d8f400c753566861bd48bcf5459fc40b7

am: b22278e4

Change-Id: Id1c46283531412a75ffe46f1beb26d5cdc732b8f

am: 1019861b

Change-Id: Id63c00a6cef89bd745947d9611d08b522426d8d1

am: f58f1499

Change-Id: Id2eecfe21cfffec6ef95a194f0119d19ef43573e

Change-Id: I721a48a441c4a416c1119b17086462f7cb8e5097

am: 03015901

Change-Id: I9d37f7b1b15b32e2f9b69bbddd30276611019924

am: 851d5b64

Change-Id: Idc8aef8e3d250b7b7f40d0a51a528988f629298c

Currently lmkd is not able to read memcg info. The mem/swap usage
info are used by lmkd to ugrade medium pressure events to critical
level.

Test: tested on gobo
Bug: 65180281
Change-Id: I19d0eb53d5e754c176ffeda1b5d07049e6af8570

am: 6fea1f4f

Change-Id: I0de11e3aea6a0aa41305078a5f37161fc2392fa2

am: 6a1e6a9c

Change-Id: I2584b969c384083fc3601a2213cf0037d4e88bda

Iot would like to allow bootanim to load libraries from /oem but in order for
device-specfic sepolicies to grant exec this global restriction needs to
be relaxed.

Bug: 37992717
Test: Tested with Iot sepolicies in effect and bootanim can exec.
Change-Id: I6462bf510562eb3fb06304e50b68fba05d37b285

am: 9d23d8eb

Change-Id: Icdf8cf91dc3dd5e8c778e50138d61aca215dd83a

am: 94e3dfc3

Change-Id: I63f038889fcf85c9393ec78ae0ac8a30b5806707

This is needed to retain app's previous access to
/sys/devices/system/cpu. When these files were previously
labeled in file_contexts, symlinks were labeled as
sysfs_devices_system_cpu. When labeling was moved to genfs_contexts
symlinks all have the default sysfs label.

avc: denied { getattr } for comm="main"
path="/sys/devices/system/cpu/cpu0/cpufreq" dev="sysfs" ino=41897
scontext=u:r:untrusted_app_25:s0:c512,c768
tcontext=u:object_r:sysfs:s0 tclass=lnk_file permissive=0

Change-Id: Idaa565390bca13d3819e147fcea4214956c0f589
Bug: 64270911
Test: build aosp_marlin

Bug: 63910933
Test: boot sailfish in normal mode, checks adbd is started
Test: boot sailfish in recovery mode, checks adbd is started
Test: boot bullhead in normal mode, checks adbd is started
Test: boot bullhead in recovery mode, checks adbd is started

Change-Id: I35ed78a15a34626fbd3c21d030e2bf51033f7b79
Merged-In: I35ed78a15a34626fbd3c21d030e2bf51033f7b79
(cherry picked from commit e2423d14)

am: e028be05

Change-Id: I835ca57fa962cd382646604139fc56c742b2de97

am: d27aee33

Change-Id: Ia64de6f9da61ce31ae10d8258a3692ce5a0e5815

am: b1b36bf2

Change-Id: I7cf6a6cf435022cb56a1b4899158fb5f390390fe

am: 36ee91d4

Change-Id: I9af35533587e962c63b6dd2543b047bf9899fb5e

Bug: 36899958
Test: Builds 'n' boots.
Change-Id: I5836a18f9d0a9a976dda7304045e3b9e1e84565e
Merged-In: I5836a18f9d0a9a976dda7304045e3b9e1e84565e
(cherry picked from commit c0713e86)