Test: hidl_test, device boots with allocator
Bug: 35327976
Change-Id: I6232a2823ff16058c70f173ec2332772048563f4

am: ac6081e7

Change-Id: Iadd638f507171153a63972537bc66576f4194971

am: 0aa2046d

Change-Id: I82458248ea9873dda5574de3287ce92eb29fbb75

am: 205d5cec

Change-Id: If3be3ae7ec1640ae9b417ec16f0a9f12396bb20d

am: 3a8426bf

Change-Id: I03b6277ec93b56d9aa079add503effa9ebc7df26

This switches Camera HAL policy to the design which enables us to
conditionally remove unnecessary rules from domains which are clients
of Camera HAL.

Domains which are clients of Camera HAL, such as cameraserver domain,
are granted rules targeting hal_camera only when the Camera HAL runs
in passthrough mode (i.e., inside the client's process). When the HAL
runs in binderized mode (i.e., in another process/domain, with clients
talking to the HAL over HwBinder IPC), rules targeting hal_camera are
not granted to client domains.

Domains which offer a binderized implementation of Camera HAL, such
as hal_camera_default domain, are always granted rules targeting
hal_camera.

Test: Take non-HDR photo using Google Camera app
Test: Take HDR photo using Google Camera app
Test: Record video using Google Camera app
Bug: 34170079
Change-Id: I463646cf79fede57f11ccd4ec2cbc37a4fff141e

Merge "Label /vendor/bin/hw on devices without vendor partition" am: e7f923f0 am: ed1813fa am: beac41dd
am: 1476d0cf

Change-Id: I7f0bbda231b8f760a12d56f637ccea386def5735

am: beac41dd

Change-Id: If3d34503993e9f808f82f6ae8f59481b6deb81bc

am: ed1813fa

Change-Id: I887df6cd21809c0001b06987d1645affc351022c

am: e7f923f0

Change-Id: I3cee3aa452b0914f70bf3a0c5bf45f20c25c5a01

am: b569f770

Change-Id: Id1a8279bbf42a22bc4283b17d20b0e8ceca38795

am: 56e6b9e0

Change-Id: Ieb4d7a134b91b95be23704bec06e0ac69eec3fa3

am: 3766ef05

Change-Id: Idddf42b0f333c6f94559ed848505c0890fd30847

am: 8852f147

Change-Id: I606e7143adb4f3a20e089bb014f07366ad4de736

am: 6a25a388

Change-Id: Iad2bd4dc9ac64ac9a41800ff96dd9b6da358a77c

am: c3358ae3

Change-Id: Idf3912a1324840ebc850c5da616580f8508ea7f1

am: cce8513c

Change-Id: I4fa0bca933289c60894403cfb70650608da5cee0

am: e1101287

Change-Id: Id6e6c7b7571b6d2a5dd7fdfed524a5685333082f

* changes:
  crash_dump: allow appending to pipes.
  Revert "crash_dump: temporarily make permissive."

am: 8d20cbb7

Change-Id: Ib17bf510dcd792578bbe4794e443fd4d3adb0f86

am: 0f9b2a94

Change-Id: Iccd8aa9c5f8d045b947f6db06c1c0bf581e09e95

am: 8f09aac3

Change-Id: I94be261e024e57a33ea74d640a4a4c26ffbcf380

am: 929da014

Change-Id: I899820e782722b61b94306532e81e3d3445ee631

SELinux labeling of filesystem files ignores symlinks. Unfortunately,
/vendor is a symlink on devices without vendor partition
(e.g., hikey). Thus, policy in directories which are used both for
devices with vendor partition and for devices without vendor partition
must be adjusted to match both /vendor and /system/vendor. It is
assumed that the /vendor symlink, if it exists at all, always points
to /system/vendor.

The alternative solution of adjusting vendor policy file labelling
rules at vendor policy build time, when the actual on-device paths are
known, was considered to make it harder to see how files are labelled
by looking solely at the source tree.

Test: Files under /vendor/bin/hw correctly labelled on sailfish,
      angler, and a device which uses the /vendor symlink.
Bug: 35431549
Change-Id: If6ccb2c9cb85b0589db03ab86de8071e15d5366f

am: d15ca85e

Change-Id: I0ab56652fec10b5efe547ab48d8f20337c8be208

am: b4936339

Change-Id: Ied3c0d7f56e78fec1388ee384fb123abb0ffee2d

Add a label to /proc/config.gz, so we can distinguish this file from
other /proc files in security policy.

For now, only init is allowed read access. All others are denied.
TODO: clarify exactly who needs access. Further access will be granted
in a future commit.

Bug: 35126415
Test: policy compiles and no device boot problems.
Change-Id: I8b480890495ce5b8aa3f8c7eb00e14159f177860

am: 9de07e51

Change-Id: I29d46d9314fa9aeca36f9ee354f17d08467f8062

am: d419ed8f

Change-Id: I0a449ac49e026c36fe6ca2ec05350cb10e63b097

CAP_SYS_PTRACE is no longer used by crash_dump. There's no reason to
exclude it from the neverallow compile time assertion.

Test: policy compiles.
Change-Id: Ib2dced19091406553c16e6ce538cfb68bbc1e5aa

am: fe50f731

Change-Id: I726a205ac8443ead251329c6637a9a410718dbe7

am: 762ed72f

Change-Id: I0da8029cee9fb3e47a1b454df544d0d59781a7be

am: 7f125557

Change-Id: Ib3ff74a30e1ce356de43c66d2b6b6146eb078409

am: ca5b5351

Change-Id: I39a5f0d5ce23af56cbc4e02d8da5ffd895ac496a

System server: Allow get/setsched to hal_camera domain. am: 6d9be831 am: 02dd665d am: 288e3941
am: 02b87a8d

Change-Id: If95377cb995acb9b2e7491c3282e405cf6be29a3