am: 0393dafd

Change-Id: Ib8773a6973da28cfa161fbe34f701c191cab6f80

type=1400 audit(1501520483.066:14): avc: denied { write } for pid=3330
comm=4173796E635461736B202331 name="property_service" dev="tmpfs"
ino=10749 scontext=u:r:nfc:s0 tcontext=u:object_r:property_socket:s0
tclass=sock_file permissive=0

Test: No sepolicy denials
Bug: 64010793
Change-Id: I8d73e8e19cd4d0a8c61f1f184820c53e5cc2b6d6
(cherry picked from commit df964950)

am: 23b986ce

Change-Id: I15b6b70c8383316adcb3699de996a8a6b66db8b2

am: f1876d58

Change-Id: I9b878eace2de33a483f648376f005277ef9283c6

am: 4e960188

Change-Id: I5dcc335c9bc9a1546709bef874c499b9d8eff03c

am: 5c41d40e

Change-Id: I6a60af407a6a95e3d48818de28619dc5ba44284f

The only file in /proc/<pid>/ that is world writeable is
/proc/<pid>/timerslack_ns so granting selinux write permission to
a process's /proc/<pid>/ file only allows writing to timerslack_ns
(unless the process is running as system UID).

Addresses denials such as:
avc: denied { write } for comm="Binder:1117_2" name="timerslack_ns"
dev="proc" ino=27908 scontext=u:r:system_server:s0
tcontext=u:r:priv_app:s0 tclass=file permissive=1

Bug: 30675296
Test: build
Change-Id: I2cee8ce73a0dc05d771881c36da2fde5411859fb

am: 45074160

Change-Id: I0335754c8b2c93817d9447f4847cdedb111a6594

am: d22cbc8f

Change-Id: I9ce4b77de5cb1e19428732824ae5ab528ac64a04

am: f1b06df3

Change-Id: I0d98e192600c94f983d7b0347715e2ba6a8b8dab

long live domain.te!

Remove all references.

Bug: 28760354
Test: build
Merged-In: I99953ecc7d275fdbe8e56d8f47a27d1f9e1cc09a
Change-Id: I99953ecc7d275fdbe8e56d8f47a27d1f9e1cc09a

Merge "Add missing comment from my previous merge in 47966cec." into stage-aosp-master am: 55f0ecb7
am: 05928953

Change-Id: Ia89eaaa654e9421f895e20916ebdec0099f30042

am: 55f0ecb7

Change-Id: I8d46aa5e2b38de80ef0cd0d8028c8b2d13809b15

This hidl service provides functionality for oem networking
configuration to vendor services which is required by
at least some vendor radio modules.

Test: VtsHalNetNetdV1_0TargetTest, netd_integration_test, netd_unit_test
Test: no denials
Bug: 36682246
Change-Id: I86ac9082166b406b2fc814972375ba737460ad7b

am: 770d5f7e

Change-Id: I8e04c8b85aa2e7d6c9f7bb545cfa6de0afdaa422

am: 4ebe609a

Change-Id: I96a2b977bf125006e2453537670d1c3030872aee

am: bfbe96ac

Change-Id: I12a2ed20022edf9da528f0ab5941cc5df8e418ab

am: 7cb39b2b  -s ours

Change-Id: Ie6f611872338b24d7a3ceb1e47c1178e35ddf880

am: 427a0c7b  -s ours

Change-Id: I0a169fa4aecf078f35b8f18144e6634ef5fa49de

am: faaf86bc

Change-Id: I546b7be93591d638ad82978aca5f4823e7b6ab93

am: faaf86bc  -s ours

Change-Id: I6ac64581e0e879c4ad077eaab748ecf33dd3a73a

am: e934bee6

Change-Id: I9943ee2240a108031b10f7e5123a8b239ef872bf

am: 8e589af6

Change-Id: I5d9f0e7908d62aa4a0c3e5d626ad40dd281c50b0

am: 275f6dd5

Change-Id: I02b2eb1a5bbd0cf3a4bbeffbe70e442ba4cf8ee6

am: e3ebb591

Change-Id: Ib9588de643e54cada696392b1957bd78325e857b

avc: denied { read } for pid=1704 comm="top" name="stat" dev="proc" ino=4026532297 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_stat:s0 tclass=file permissive=0
avc: denied { read } for pid=1636 comm="dumpstate" name="lcd-backlight" dev="sysfs" ino=16592 scontext=u:r:dumpstate:s0 tcontext=u:object_r:sysfs_leds:s0 tclass=lnk_file permissive=0
avc: denied { call } for pid=2230 comm="dumpsys" scontext=u:r:dumpstate:s0 tcontext=u:r:installd:s0 tclass=binder permissive=0
avc: denied { create } for pid=1700 comm="ip" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=netlink_xfrm_socket permissive=0

Bug: 62410287
Bug: 35350306
Change-Id: I65be3678c64214ebeb544e0e155bce88b21adf02
Signed-off-by: Tim Kryger <tkryger@google.com>

Clean up the remaining granted permissions in domain_deprecated.

avc: granted { read open } for comm="uncrypt"
path="/sys/firmware/devicetree/base/firmware/android/fstab/compatible"
dev="sysfs" ino=17591 scontext=u:r:uncrypt:s0
tcontext=u:object_r:sysfs:s0 tclass=file
avc: granted { getattr } for comm="uncrypt"
path="/sys/firmware/devicetree/base/firmware/android/compatible"
dev="sysfs" ino=17583 scontext=u:r:uncrypt:s0
tcontext=u:object_r:sysfs:s0 tclass=file

vc: granted { read open } for comm="update_engine"
path="/sys/firmware/devicetree/base/firmware/android/fstab" dev="sysfs"
ino=17258 scontext=u:r:update_engine:s0 tcontext=u:object_r:sysfs:s0
tclass=dir
avc: granted { getattr } for comm="update_engine"
path="/sys/firmware/devicetree/base/firmware/android/fstab/compatible"
dev="sysfs" ino=17259 scontext=u:r:update_engine:s0
tcontext=u:object_r:sysfs:s0 tclass=file

Bug: 28760354
Test: build
Change-Id: Id318ce84894c1001361923f5205de093a15c1e6a

am: d7989e8b

Change-Id: I1e148607abab46b1733bfeafa3faef6e250ecc47

am: 4fc64f2f

Change-Id: I7dd6ea7bb5d767afb98a39e56214dd05d4585c93

Test: I solemnly swear I tested this conflict resolution.

Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5
Change-Id: Id19f3f30daa4bff64db75d8d4a48a8f077bfc75d

Test: Built.
Change-Id: Ia5f5b52e10e9411cd87901053675d9e77a622529

am: 47966cec

Change-Id: If294b49998475d4cdfb4435d720a494f10325ab8

Test: I solemnly swear I tested this conflict resolution.

Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5
Change-Id: I1f087fe5e7a71761a16673331619f52998473b44

Relax neverallow rule restricting binder access to/from netd so that
netd can export hwbinder services to vendor components.

Continue to disallow app access to netd via binder.

Bug: 36682246
Test: build
Merged-In: I8e558ea1add6c36b966ec1da204062ea82df3f3f
Change-Id: I063df6dded94d8b0f5214b2c94c4f46bdafb03d7

Relax neverallow rule restricting binder access to/from netd so that
netd can export hwbinder services to vendor components.

Continue to disallow app access to netd via binder.

Bug: 36682246
Test: build
Change-Id: I8e558ea1add6c36b966ec1da204062ea82df3f3f