am: 379ce55b

Change-Id: Ibbe9f31d2df586b12f5cda7d49ba655ede42f822

am: 88fe61cd

Change-Id: Ic18f5e03886e8e3049e9b8f2148e8dd040dd6b26

am: fa120106

Change-Id: Ie16d45133ca244b408098b11f23fa64d8d6a3fd2

am: a058b569

Change-Id: If71062f721f57462d6238248e77b6189669847ab

This improves readability and consistency for HAL implementation
domains which have only one implementation.

Test: No change to policy according to sesearch
Test: No change to which types are associated with haldomain according to "sepolicy-analyze <sepolicy file> attribute haldomain"
Bug: 34180936
Change-Id: Ice599ea4971cdfbd8b835b1fd02ad1e14c7a0386

Bug: 33746484
Test: Successfully boot with original service and property contexts.
      Successfully boot with split serivce and property contexts.

Change-Id: Ide67d37d85273c60b9e387e72fbeb87be6da306a
Signed-off-by: Sandeep Patil <sspatil@google.com>

am: 06d17805

Change-Id: I29d2820e5be5f212b16c71df97a0ad58a03eb448

am: f41d89eb

Change-Id: I8f32e2e80fc7bfc08ce9fe3655968a8d7dfc94e8

This marks all HAL domain implementations with the haldomain attribute
so that rules can be written which apply to all HAL implementations.

This follows the pattern used for appdomain, netdomain and
bluetoothdomain.

Test: No change to policy according to sesearch.
Bug: 34180936
Change-Id: I0cfe599b0d49feed36538503c226dfce41eb65f6

am: af57c85e

Change-Id: I171f0ef3e6f1f8d70de8ba5aeb8d82e7ca300636

am: ddb52d82

Change-Id: I724ff53a9709d53c02091838166092b5264eb23e

This is to ensure that hal_audio can access memory shared by
audioserver.

Bug: 34261005
Change-Id: I84103b0d4692fd10afc56846fb116fec6a7b3dc7

am: 55c46c7c

Change-Id: Ic6b3209dac49e9f149bf34f18d10a9081c6a0d7c

am: 597a8a49

Change-Id: I1a055e9dea9317b719ba6bb467679f2e51818755

am: a76de201

Change-Id: Ia051957fe6a115e96161270f304c915b8d7b6b67

am: 14658c93

Change-Id: I8a5ac00a41c1b66c8339b9a79d48c87af00800eb

Move from fingerprintd to new fingerprint_hal and update SeLinux policy.

Test: Boot with no errors related to fingerprint sepolicy
Bug: 33199080
Change-Id: Idfde0cb0530e75e705033042f64f3040f6df22d6

am: 67c5cdfd

Change-Id: Ie9f8de8bac96b5b8088f58ac54c3e76dd90c40ee

am: 953c4396

Change-Id: Ia67c8271cfd6641a117415d439ce1c75b63e2580

The following are the avc denials that are addressed:

avc: denied { call } for pid=889 comm="system_server"
scontext=u:r:system_server:s0 tcontext=u:r:hal_gnss_default:s0
tclass=binder permissive=0

avc: denied { call } for scontext=u:r:hal_gnss_default:s0
tcontext=u:r:system_server:s0 tclass=binder permissive=0

avc: denied { read } for name="hw" dev="mmcblk0p43" ino=1837
scontext=u:r:hal_gnss_default:s0 tcontext=u:object_r:system_file:s0
tclass=dir permissive=0

avc: denied { open } for path="/system/lib64/hw" dev="mmcblk0p43"
ino=1837 scontext=u:r:hal_gnss_default:s0
tcontext=u:object_r:system_file:s0 tclass=dir permissive=0

Bug:31974439

Test: Checked that there no more related avc denial messages related to
the GNSS HAL in dmesg.

Change-Id: I5b43dc088017a5568dd8e442726d2bf52e95b1d5

am: 845a8e80

Change-Id: Ida5c1667e23b991c803b6fe141e40fb510dc9746

am: 9e7a5b0a

Change-Id: Ice41f3c804a4dd0aad058e39a2a8a0bcff80eb5a

It seems likely that there is no reason to keep around a number of
devices that are configured to be included into the pixel kernels. Init
and ueventd should be the only processes with r/w access to these
devices, so auditallow rules have been added to ensure that they aren't
actually used.

/dev/keychord was given its own type since it's one of the few character
devices that's actually legitimately used and would cause log spam in
the auditallow otherwise.

Bug: 33347297
Test: The phone boots without any apparent log spam.

Change-Id: I3dd9557df8a9218b8c802e33ff549d15849216fb

am: 82a8f40c

Change-Id: Ib4381b68788d5b8bd768d5a39cb4f914e51a1856

am: 926dc331

Change-Id: I0ea98702d907e04d0fe1f3af242e0ec4a0712582

Merge commit 'adf210d6' into nougat-mr1-cts-dev am: 48c63657 am: f9181a2e
am: 0cab2a17

Change-Id: If365e1a87d47a3c56c7214fe3eaa78bd8d303746

am: f9181a2e

Change-Id: I46ffea21cccb896ef17d8434b009db263ba70e6e

am: 48c63657

Change-Id: I6e38561883d6a898cb0a719d10b6f2726a947354

nougat-mr1-cts-dev

(The change is already present as 320a0f54).

BUG: 33090058
Change-Id: I2451c334d3a1a42d2d5a46f8f6d22dc5d503f034

Test: run a gtest in /data/nativetest/ with no permission denial
Change-Id: Id644ed7dbea59becaf84b6073c9144711ad07c10

am: 4749f6e8

Change-Id: I44bac7413170102a4bd35dfdc01d36f55e1f0b79

am: d5db9de5

Change-Id: I47d4498737a339c3cc05296db19a79a591dbe0eb

am: 398249a6

Change-Id: I00f2cd2807593b9ed6b1eec97d729908b641d083

am: 1b7512a1

Change-Id: I713efb431275bfc4307b43f35dbb44965ccc0a84

Bug: 34231014
Test: Boot angler to ensure no additional denials are reported.

Change-Id: Ic2372d55f7072c65e7ea17036a8eb40dc531d60e
Signed-off-by: Sandeep Patil <sspatil@google.com>