(cherry picked from commit 24ad5862)

avc:  denied  { find } for service=drm.drmManager pid=4320 uid=1027 scontext=u:r:nfc:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager

Arrange in alphabetical order.

Bug: 30112127
Change-Id: I6592497a937c6a6d2c7c3d444beba3db333f4852

Add a macro to make this easier for other processes
as well.

Change-Id: I489d0ce042fe5ef88dc767a6fbdb9b795be91601
(cherry picked from commit c2b9c1561e4bd7ac86d78b44ca7927994e781da0)

Change-Id: I07d188e4dd8801a539db1e9f3edf82a1d662648e
(cherry picked from commit 61a082a55dbc2798d50d0d4b766151d69334729a)

(cherry picked from commit 88c51465)

Allow the otapreopt rename script to read file attributes. This is
being used to print the aggregate artifact size for diagnostic
purposes.

Bug: 30832951
Change-Id: Iee410adf59dcbb74fa4b49edb27d028025cd8bf9

(cherry picked from commit eb717421)

The new A/B OTA artifact naming scheme includes the target slot so
that the system is robust with respect to unexpected reboots. This
complicates the renaming code after reboot, so it is moved from the
zygote into a simple script (otapreopt_slot) that is hooked into
the startup sequence in init.

Give the script the subset of the rights that the zygote had so that
it can move the artifacts from /data/ota into /data/dalvik-cache.
Relabeling will be done in the init rc component, so relabeling
rights can be completely removed.

Bug: 25612095
Bug: 28069686
Change-Id: Iad56dc3d78ac759f4f2cce65633cdaf1cab7631b

(cherry picked from commit d2dbc899)

bug: 30087072
bug: 29937024
Change-Id: I8bf3032b8455556ff5332f538f43aeb514d3b290

Needed for legacy VPN access.

Note that ioctl whitelisting only uses the type and command fields
of the ioctl so only the last two bytes are necessary, thus 0x40047438
and 0x7438 are treated the same.

Bug: 30154346
Change-Id: I45bdc77ab666e05707729a114d933900655ba48b

(cherry picked from commit ec4b9d67)

Vendor apps are usually not preopted, so A/B dexopt should pick
them up. update_engine is not mounting the vendor partition, so
let otapreopt_chroot do the work.

This change gives otapreopt_chroot permission to mount /vendor
into the chroot environment.

Bug: 25612095
Bug: 29498238
Change-Id: I5a77bdb78a8e478ce10f6c1d0f911a8d6686becb

Isolated_app no longer has the domain_deprecated attribute.

Bug: 31364540
Change-Id: I37e39becf24f98d6ee427bc8d039852e6a322ca6

No "granted" messages for the removed permissions observed in three
months of log audits.

Bug: 28760354
Change-Id: I2b45284893e150575992befeef48e1bd53a2fba2

No "granted" messages for the removed permissions observed in three
months of log audits.

Bug: 28760354
Change-Id: I46b6b79b3a13108020114f3c3555adeac021b0a9

(cherry picked from commit 6c3f2831)

Allow priv_app, uncrypt, update_engine to access the OTA packages at
/data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks
the existence of the folder, and downloads the package there if present.

Bug: 28944800
Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5

(cherry picked from commit e123f061)

b/30832947

Change-Id: Icd5117d655f1197524b39fe7bc1b11c4d920093c

(cherry picked from commit 8cac2586)

More read rights are required now.

Bug: 25612095
Change-Id: I766b3b56064ca2f265b9d60e532cd22712f95a42

(cherry picked from commit 63203a01)

bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5

(cherry picked from commit e01654f9)

For Retail Demo mode, we need to preload photos in
/data/preloads and allow regular apps to access the
photos returned by the media provider from the preloads
directory.

Bug: 29940807
Change-Id: Ic1061dac55ace1b125ae04b5b0c70aae9aa0c732

(cherry picked from commit d47c1e93)

To include target slot names in the naming of A/B OTA artifacts,
and new path has been implemented. Instead of passing through
the system server and forking off of installd, otapreopt_chroot
is now driven directly from the otapreopt script.

Change the selinux policy accordingly: allow a transition from
postinstall to otapreopt_chroot, and let otapreopt_chroot inherit
the file descriptors that update_engine had opened (it will close
them immediately, do not give rights to the downstream executables
otapreopt and dex2oat).

Bug: 25612095
Bug: 28069686
Change-Id: I6b476183572c85e75eda4d52f60e4eb5d8f48dbb

(cherry picked from commit cf63957d)

This is needed in order to include profile files in bugreports.

Bug: 28610953
Change-Id: I025189a4ac66b936711fdb4e20b10c2b0a7427d1

(cherry picked from commit f23b870a)

avc: denied { read } for comm="generic" path="/data/system_de/0/ringtones/ringtone_cache" dev="sda35" ino=1114120 scontext=u:r:drmserver:s0 tcontext=u:object_r:ringtone_file:s0 tclass=file

Change-Id: I40992733d779743be92c15a094d166a3df64a10f
Fixes: 30167454

(cherry picked from commit d3edd6b5)

Bug: 29278988
Change-Id: I199572377a6b5c33116c718a545159ddcf50df30

(cherry picked from commit ad5b4be3)

Required for using native audio in BootAnimation

Bug: 29055299
Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478

* changes:
  fix build: exclude bluetooth from neverallow restriction
  Remove platform_app from neverallow execute from /data
  Rework neverallow for /data execute permission

This addresses error messages like:

11-30 18:00:15.196  6917  6917 W Binder:6596_2: type=1400 audit(0.0:46):
avc: denied { fowner } for capability=3 scontext=u:r:netd:s0
tcontext=u:r:netd:s0 tclass=capability permissive=0

11-30 18:00:15.200  6596  6917 E /system/bin/netd:
android::WriteStringToFile fchmod failed: Operation not permitted

11-30 18:00:15.200  6596  6917 E Netd    : failed to write to
/data/misc/net/rt_tables (Operation not permitted)

Bug: 31147892
Change-Id: Id11704f8e2b8c08db92de374ed44913b70d6ae66