am: 96c619c8

Change-Id: Ib2d0ad551b0a8c4e3bf8529dd89fb8f563e5b651

This reverts commit 50889ce0.

Bug: 62427402
Test: Build and boot.
Change-Id: I32eae7997c901981d3228b61f33322a7c2c84301

am: 0f52004b

Change-Id: I5df1b7411cc87c6b983d80d716d9ec05f1ba9339

am: edcfb2e1

Change-Id: I86565448fa4d5ccd412772825decb5dc62cd6343

am: 06486796

Change-Id: Ia575329a0d4e83ff0d3a70b30ad3ef7e026c42f1

This broke the build on master. See b/17613910#comment17
for details.

This reverts commit ef1fd98b.

Change-Id: I11f7d463061a9b6340c11827135586266e26f016

am: 36efd0c4

Change-Id: I31b2eda5c305723b1f35ce2ba284e6593ac891b6

am: 9381cb3d

Change-Id: I3ae9005ee76b51105ec215cefc5a81c25405c482

am: ef1fd98b

Change-Id: I6d5e2f4b43b3b52708190e8111828e54a252d5a7

This is used to persist RFC 7217 stable secrets across device reboots.

Test: as follows
    - Manually tested that stable_secret is generated on first use and
      persists until reset of user data partition (factory reset).
    - Tested that "adb shell getprop" was denied access to
      persist.netd.stable_secret after running "adb unroot".
Bug: 17613910

Change-Id: I4dad00fb189d697aceaffae49ad63987c7e45054

Allow run-as to read/write unix_stream_sockets created by adbd. am: 1847a38b am: 23946193 am: 96df849f
am: 690ab198

Change-Id: I7e3c27dad722e2bd208281d74c475a39f91b04dc

am: 96df849f

Change-Id: I631667710b2998361b0e2db3f13f5fb7d2582420

am: 23946193

Change-Id: I0bfb94d859467848ce54e1b7e7581f543331c640

am: 1847a38b

Change-Id: I8c8351da5f2c41a284a6c6aa05e268f209242e00

Copy the final system sepolicy from oc-dev to its prebuilt dir
corresponding to its version (26.0) so that we can uprev policy and
start maintaining compatibility files, as well as use it for CTS
tests targeting future platforms.

Bug: 37896931
Test: none, this just copies the old policy.
Change-Id: Ib069d505e42595c467e5d1164fb16fcb0286ab93

am: c6ba60d8

Change-Id: I1a091cb4715577db620ec5e0b3e3dabfcd15ee6a

am: e546e81b

Change-Id: Iac0bb7ca4994a7921049881f94e767b34851052e

checkseapp does not expect filenames before the appearance of neverallow
rules against which to check.  They had previously been hidden by default
because they were only gathered from one file, but with the addition of
the BOARD_PLAT_[PUBLIC|PRIVATE]_SEPOLICY_DIRS to allow for /system policy
extensions, this may change.

Bug: 36467375
Bug: 62357603
Test: Builds with seapp_contexts extension.
Change-Id: I270bd60ae368aa3c082299d57c4bf12936ac2073

On Marlin ~120 ms of time is spent relabeling /sys/devices/system/cpu
every time we come out of suspend. Moving from file_contexts to
genfs_contexts as the labeling mechanism knocks this down to ~3 ms.

Bug: 32938130
Test: build and boot Marlin. Verify that files in
    /sys/devices/system/cpu have the proper label before and after
    suspend.

Change-Id: Ie71ea7e3dd5df250cabe4ba9600afbf67e69f720

am: e3aad5ed  -s ours

Change-Id: I00c4e09c718b06df5a47b3af7093d0dc01d292b6

am: 715955b7  -s ours

Change-Id: Idaf2e285bc60707aaa1141d9c141146e37c2526f

am: c85b8596  -s ours

Change-Id: I32f3b92444637ac4f62b53bc7b66daa64c6bd7dd

am: 0a53f1d4

Change-Id: I15df35ef6ab490530d20bfca4cab168607b72668

am: 8ae0bd62  -s ours

Change-Id: I53305cfdaa523542b6795bd1c31c7eaa6e3b91af

am: 1fc0682e

Change-Id: I5f6adf8043686e1dbc5327b6845d710e6f673256

am: e41af203

Change-Id: I586cf07d87339f83d66919871d1531e9b8d79c4e

am: bdfc0301

Change-Id: Ifafca851d39158cff053f4205583dd22f89070c8

This is to Allow commands like `adb shell run-as ...`.

Bug: http://b/62358246
Test: run commands manually.
Change-Id: I7bb6c79a6e27ff1224a80c6ddeffb7f27f492bb2

am: dde38d9b

Change-Id: I8ad39a6ba69fa936f6522e29820127adc80798d5

am: 9ff58c84

Change-Id: If0bc8e741af7cade57c76020db89516c1da69728

am: 7b19b081

Change-Id: I49de01eac93ff0f4c7a334cb899aa7ba75e275fa

am: 7aa08523

Change-Id: I9fcf646602327f1c54d28c3fabf19741a6b72ef4

It appears that selinux requires the write permission to receive
a writable pipe from dumpstate, for unclear reasons. Add the permission
for now.

Bug: http://b/62297059
Test: dumpstate
Merged-In: I0f25682177115aacd5c2203ddc0008228b0380ad
Change-Id: I0f25682177115aacd5c2203ddc0008228b0380ad
(cherry picked from commit 7aa08523)

On Marlin ~120 ms of time is spent relabeling /sys/devices/system/cpu
every time we come out of suspend. Moving from file_contexts to
genfs_contexts as the labeling mechanism knocks this down to ~3 ms.

Bug: 32938130
Test: build and boot Marlin. Verify that files in
    /sys/devices/system/cpu have the proper label before and after
    suspend.

Change-Id: Ie71ea7e3dd5df250cabe4ba9600afbf67e69f720

It appears that selinux requires the write permission to receive
a writable pipe from dumpstate, for unclear reasons. Add the permission
for now.

Bug: http://b/62297059
Test: dumpstate
Change-Id: I0f25682177115aacd5c2203ddc0008228b0380ad

Bug: 37008075
Test: build policy on Marlin
Change-Id: I53748f94c5df66fa17a53e7d0bed1be6b8603544
(cherry picked from commit e1ddc6df)