Temporary workaround.

Bug: 37755687
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Change-Id: I001a42ea6463a1e137e1f5328755596f986323de

am: 89671020

Change-Id: Icbb3d5a87181e65d574007764d69c766d7b31e57

am: 22ebf24e

Change-Id: If8dc1ae0d2269cbe70617748fded75b5162780b8

am: b9d5d5cc

Change-Id: Ie43b0d5ad797501a965ff6f69c37ba619fb5f588

* changes:
  NFC HAL no longer violates socket access restrictions
  Remove access to sock_file for hal_nfc

am: adfc5db0

Change-Id: Id0f7e56ee0473a2cf8bc04e4d1d02d6fa23d649c

Test: bit FrameworksCoreTests:android.view.textclassifier.TextClassificationManagerTest
Bug: 34780396
Change-Id: I8b98fef913df571e55474ea2529f71750874941c

Test: compiles
Bug: 37640900
Change-Id: Ia9960af9da880fd130b5fb211a054689e2353f1d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

Test: manual
Bug: 37640900
Change-Id: I6987d60c1eb1578134b51f4e7417700fd462ba4d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit ad41fa8d)

am: 3259f98c

Change-Id: I9c4cea46a1b5272974b484eeaa01a87ac41a8bdf

am: 8ad09d93

Change-Id: I745c85dd761cc68e0301a7a3fa32b29269c624d2

am: 608969b3

Change-Id: I99225c48524600248d3d76a56368dc96da67caa0

am: 16eb632a

Change-Id: Ifb5f7fd54973cf1de256404344bd8690a4f13c02

am: eb710332

Change-Id: I15f27cd755e5a8556e189af50b8bca52f050ad8f

am: db5962ce

Change-Id: I4ce4248dd0f780c1d466a7798a159d854d30a09a

This was accidentally omitted from all_untrusted_app

While I'm here, split across mutiple lines and alphabetize.

Test: policy compiles.
Change-Id: I7fe1d1d0a4ef2ed3ab010931ee2ba15637c2be51

am: 9829506c

Change-Id: I7a05cbb58ebbe4d23c9fc13ef429b444301a912e

am: edc2fedb  -s ours

Change-Id: I956d5f593844db3ce9d8052a8c40c0ac14b64abc

am: 3c46d2ff  -s ours

Change-Id: I888bd469644077ccc1faec52e00134027f067eef

am: b0e13e81

Change-Id: If711595a894ad6c70f8d4df1ad5f76ad4a9ab50c

am: c78db706

Change-Id: I7b866f588980ebb068629e326155976629bf2223

am: 34b76844

Change-Id: Ibe76d1cecd92f46306faf2587d229dbfc4def199

am: 224b4eac

Change-Id: I2b9ef653a1d4b21661fb07a1634b2e8af75c826b

Rules defined in utrusted_app_all do not apply to all untrusted apps,
update the comments to reflect that.

Test: builds
Change-Id: I6f064bd93c13d8341128d941be34fdfaa0bec5da

Bluetooth needs the capability to set audio-related threads to be RT
scheduled.  Grant it sys_nice.

system_server needs to set priority for the Bluetooth HAL.  Allow it.

Bug 37518404
Test:  Play Bluetooth audio, confirm RT scheduling with systrace
Merged-In: Iaf7b85a11a51883744d72a50addfd320b6fbbc2f
Change-Id: Iaf7b85a11a51883744d72a50addfd320b6fbbc2f

(cherry picked from commit 6eee6eb2)

The fuse_device neverallow rules are too aggressive and are inhibiting
certain vendor customizations. Relax the /dev/fuse neverallow rules so
that they better reflect the security invariants we want to uphold.

Bug: 37496487
Test: policy compiles.
Change-Id: Ie73b0ba7c76446afc2a7a23ebed1275c977d932d

These were missing when the sepolicy was migrated.

Addresses denials:

E SELinux : avc:  denied  { find } for service=drm.drmManager pid=11769
uid=10018 scontext=u:r:mediaprovider:s0:c512,c768
tcontext=u:object_r:drmserver_service:s0 tclass=service_manager

W kworker/u16:2: type=1400 audit(0.0:1667): avc: denied { use } for
path="/storage/emulated/0/DCIM/Camera/IMG_20170425_124723.jpg"
dev="sdcardfs" ino=1032250 scontext=u:r:kernel:s0
tcontext=u:r:mediaprovider:s0:c512,c768 tclass=fd permissive=0

Bug: 37685394
Bug: 37686255
Test: Sync files
Test: Open downloaded file

Change-Id: Ibb02d233720b8510c3eec0463b8909fcc5bbb73d

am: a5647da3

Change-Id: I502e43626fd430da68f2a149704dafac024b3cc9

Merge "Allow Bluetooth sys_nice and system_server setsched for Bluetooth HAL" am: 2e8b0004 am: 1cc029ea
am: 1d4bb3ac

Change-Id: I319a76a77cab5f4af2f8eb98aaaa2752564e04b0

am: 1cc029ea

Change-Id: I4dc969584352c3181c3a0e49c90dff8a89940ea8

am: 2e8b0004

Change-Id: I2e8648728c5e63037686981c154d16c3010ac095