am: 1cb7fa83

Change-Id: Iefb398cf0eff6199aa1f9be67b0a130a22bf8f9e

am: 74e408c4

Change-Id: Ie54bee4b5bb68460394e552305a16c61e62405a1

am: 3ede597e

Change-Id: Ie3b4a150c35a5c08fc202c27921eeac8c6d9d2b0

am: 8c87c2ad

Change-Id: I0e0aa1f84fce0bcf4fe6912f453ff6c9221e6c2d

am: 680fa3d6

Change-Id: I2cbcf36454b9034f57e830e5f0c969c0bfe9ccdf

am: 2787c19f

Change-Id: I8c1c40e266ccc54e3a436eb7935fae132c929288

am: 602575ec

Change-Id: I6ad1399b8adf591eea47bcd375f868ef0f313777

am: 9eb4de16

Change-Id: I6343d29e2f4d4298c40ef782d7aa85825eccf7e8

am: 3dff9ab4

Change-Id: I6080271008eff31de9bf407250cf64c4001f8ff4

am: 8c8ed1f0

Change-Id: I51f11f3d4296ed4a349221c567b953499576c31d

* changes:
  Use PLATFORM_SEPOLICY_COMPAT_VERSIONS
  Move PLATFORM_SEPOLICY_VERSION to make/core/config.mk

am: 32755e68

Change-Id: I5fe16fe8e4c99e0458674704f1a987f6354d8034

am: 5d6077bc

Change-Id: Ibb74ddbd3ca4352ad6b47cf0c783367733e6a1a8

Test: m framework_compatibility_matrix.xml -j
Test: device boots

Bug: 67920434
Bug: 69390067

Change-Id: I3461873c22f704b9bbaa3a4e6f7e1df34d6b61a3

This is a list of sepolicy versions that the framework supports.

Test: builds and boots

Bug: 67920434
Change-Id: I0f408fa3967214b47a64101760dbbb2542023dcf

Bug: 72878750
Test: build sepolicy
Change-Id: Ifa6822e042beed0e5971c85155aa526912807c8a

And grant explicit exemption from system_executes_vendor_violators
neverallow rules.

This does not change the policy, but is needed to test the violator
attribute for emptiness.

Bug: 72662597
Test: build sepolicy
Change-Id: Iba79bb42e1381b221fe0dc53470f62f8267a4791

This should fix presubmit tests.

Bug: 73068008
Test: Built policy.
Change-Id: Ib27fbad2803eb86ff12526f0ae42eb35917ce59b

am: dc357d0c

Change-Id: Ib4ac1a0db9fcf51d6b07b7b1ea9506c2f2777f14

am: 648dd417

Change-Id: Ie53b447e4c2149de84f8a2a1854616de16e3216d

am: 178be151

Change-Id: I6aaf5bc486fbce2134a71affa0cddc9d9d8c7e5c

am: 4e9b1c6b

Change-Id: I062afe1974bacf4795271ca93029ceb871eff6b0

am: 17aa011d

Change-Id: Id8e2a441c6fa2e80ac59136246ec6b6ac3885aa8

am: 2904db67

Change-Id: I1905f28cdcfee2e96d69ffde8adfe77865a882d2

* changes:
  Add 27.0 mapping file to system image.
  Add missing types to 27.0[.ignore].cil.
  Temporary fix to avoid expandattribute value conflicts.
  Remove reboot_data_file from 27 mapping file.

A change in the "open" syscall between kernel 4.4 and 4.9 means that
the "create" action is now checked and makes system_server trigger
an SELinux denial when PackageSettings is removing a user ID from
Settings.java/writeKernelRemoveUserLPr() in PackageManager.

Bug: 70150770
Test: Manual
- Add a new user on the device, no need to perform setup.
- Wait 30s
- Remove the added user
- While running, check the result of:
    adb logcat -v time -b events | grep audit | grep system_server
Change-Id: I1f490ea95d5bcb2adc76cba041bffbea131b447a

This reverts commit fad0b04d.

Reason for revert: This change crashed facebook App on dogfood build.

Bug: 72977484
Change-Id: I4f35b00c11afbd4914f572d3cc0378d740403ed2

Bug: 69390067
Test: 27.0.cil is installed to /system/etc/selinux/mapping/27.0.cil

Change-Id: If5b37ca7920a66b4fceaa031b6e8e9bafd18ac47

Bug: 69390067
Test: build sepolicy
Test: 27.0.ignore.cil is a subset 26.0.ignore.cil
Change-Id: I6b9a1cfa8b38df4e97e5d63e2938ee9d5a4c83ec

Bug: 69390067
Bug: 72757373
Test: build sepolicy
Change-Id: I44aeb547ff7ab7042eddfa780df8cbb7dcec71b4

reboot_data_file was already removed from 26.cil by aosp/505397

Bug: 69390067
Test: build sepolicy
Change-Id: Ieff68cbdaf5b0ddc02d0d3e463765ba3716994ba

am: e8913ef5

Change-Id: Id9e96f0552cbfe29b74ed31fe53a8f731ef8c7e3

am: 64146090

Change-Id: I8159ae601ad48b4068386da6eb0d6e14b4e80ada

am: cfbe2a1f

Change-Id: I11ab803358ed847ae299d1bf315e0577816a411b

am: cbe2d7d7

Change-Id: Ifae1ad6ec012f3f56e645357fce9ceb912d367ff