- Required to query cpusets information.

Bug: 22855417
Bug: 27381794
Bug: 27498731

Change-Id: I6d192aad2135d99a6c9cdaf97696b0822bd21897

no longer used nor desired.

Change-Id: Iac447fb2291371caa4a8ec255db114d9f7ccdddb

Bug: 27239233
Change-Id: I82e3451542f08de67ad950223be90e37a2d3e899

This reverts commit b5594c27.

Bug: 27239233
Change-Id: I407a2f3a313f3de801080f9bae46f6bac1a803c2

This reverts commit 54457959.

Change-Id: Idfa0254e66f9517cc26af3c37441b47cbb984bca

avc: denied { write } for path="/data/system_de/0/ringtones/ringtone_cache" dev="mmcblk0p44" ino=1602501 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:ringtone_file:s0 tclass=file permissive=0

Bug: 27366059
Change-Id: I120a69ac4f58c64db6f169ae4f9942ce357b0b1f

This is a special profile folder where apps will leave profile markers
for the dex files they load and don't own. System server will read the
markers and decide which apk should be fully compiled instead of
profile guide compiled.

Apps need only to be able to create (touch) files in this directory.
System server needs only to be able to check wheter or not a file with a
given name exists.

Bug: 27334750
Bug: 26080105

Change-Id: I2256e4aba1ec0e5117de6497123223b9a74f404e

Bluetooth uses the tun device for tethering. Allow access.

  STEPS TO REPRODUCE:
  0. Have two devices to test on, say Device A and Device B
  1. On Device A, Go to settings ->Bluetooth .
  2. Turn on the Bluetooth .
  3. Pair it with device B
  4. Tap on the paired device

  OBSERVED RESULTS:
  -Bluetooth share crash is observed with "Bluetooth share has stopped"
  error message
  -Unable to use Bluetooth tethering due to this issue

  EXPECTED RESULTS:
  No crash and Bluetooth devices should be able to connect for tethering

Addresses the following denial:

com.android.bluetooth: type=1400 audit(0.0:131): avc: denied { open }
for comm=425420536572766963652043616C6C path="/dev/tun" dev="tmpfs"
ino=12340 scontext=u:r:bluetooth:s0 tcontext=u:object_r:tun_device:s0
tclass=chr_file permissive=0

Bug: 27372573

(cherry picked from commit 9a1347ee)

Change-Id: Ibd16e48c09fe80ebb4f3779214de3b4806c12497

avc:  denied  { find } for service=SurfaceFlinger scontext=u:r:mediacodec:s0
tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager

Bug: 26990688
Change-Id: Ie7c5f6d879c286375eb52ef4c6b84726aa4f1ba2

It's a CTS requirement that all SELinux domains be in
enforcing mode. Add the same assertion to the build system
when targeting user builds.

In particular, this avoids a situation where device integrity
checking is enabled on user builds, but permissive denials
are being generated, causing the device to unexpectedly reboot
into safe mode.

A developer wanting to put an SELinux domain into permissive
mode for userdebug/eng purposes can write the following
in their policy:

  userdebug_or_eng(`
    permissive foo;
  ')

Bug: 26902605
Bug: 27313768

(cherry picked from commit bca98efa)

Change-Id: If6abe1fa70c79a1fccdbdd9ff273d92de7565a73

bug: 26782004
Change-Id: Ie3d9289d15446efa160550185a2d565e3be2980f

NetworkTimeUpdateService has been registered as a system service, so that
its dump state can be included into bugreports.

Bug: 23983739
Change-Id: I0d364009ba4630dcfd1d22c647195e33eedaa4e0

Bug: 26982110
Change-Id: I551f8cc926886de0feaf065da46d3cf5bdf5cfb5

Bug: 27305063
Change-Id: Ie9ac3fb971dbb989d7b26421e076139d3f48a916

neverallow access to other domains.

Bug: 27239233
Change-Id: I503d1be7308d0229db1cbe52cd511f7f40afa987

Address the following denial:
m.chrome.canary: type=1400 audit(0.0:15): avc: granted { read open } for path="/proc/meminfo" dev="proc" ino=4026544360 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file

Bug: 22032619
Chromium Bug: 586021

Change-Id: I584345c84d870c313da69ec97a0b1e54c0eb9ee1

Bug: 27323882
Change-Id: Idf3977d74817c4f90f9e993d2e1e5302cc56f41d

Remove all permissions not observed during testing.

Remove domain_deprecated

Bug: 27064332
Change-Id: Ie154af70aaf255721b46d29357e48d5337020b4b

Ringtones often live on shared media, which is now encrypted with CE
keys and not available until after the user is unlocked.  To improve
the user experience while locked, cache the default ringtone,
notification sound, and alarm sound in a DE storage area.

Also fix bug where wallpaper_file wasn't getting data_file_type.

Bug: 26730753
Change-Id: Ib1f08d03eb734c3dce91daab41601d3ed14f4f0d

Bug: 26879394

Change-Id: I09ac9027ca343e00488dedab8df1687fd32bb255
(cherry picked from commit 6b843bcf)

Bug: 26804329
Change-Id: I7b789c6fe8411e3a4a718da86d442a0f48c5c310

Bug: 27239233
Change-Id: Icc9d14008d2ff6334a8ec66805f7289aedd5d97d

Bug: 26902605
Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
(cherry picked from commit 9c168711)