am: 66e4cf84

* commit '66e4cf84':
  Restore sysfs_devices_system_cpu to domain.te

am: 4e2d2245

* commit '4e2d2245':
  Restore sysfs_devices_system_cpu to domain.te

Lots of processes access CPU information. This seems to be triggered
by libraries loaded into every Android process. Allow the access.

Addresses the following denials:

adbd    : type=1400 audit(0.0:3): avc: denied { search } for name="cpu" dev="sysfs" ino=32 scontext=u:r:adbd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir permissive=1
adbd    : type=1400 audit(0.0:4): avc: denied { read } for name="online" dev="sysfs" ino=34 scontext=u:r:adbd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file permissive=1
adbd    : type=1400 audit(0.0:5): avc: denied { open } for path="/sys/devices/system/cpu/online" dev="sysfs" ino=34 scontext=u:r:adbd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file permissive=1
adbd    : type=1400 audit(0.0:6): avc: denied { getattr } for path="/sys/devices/system/cpu/online" dev="sysfs" ino=34 scontext=u:r:adbd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file permissive=1

Change-Id: Ie7bfae53bdf670028db724d2720447ead42bad35

Change-Id: I01bb0ad7c93e807cd76135bce554abf0908a54ab

am: 4b689152

* commit '4b689152':
  Remove core_property_type from ctl_* properties

am: f01453ad

* commit 'f01453ad':
  Remove core_property_type from ctl_* properties

Per https://android-review.googlesource.com/185392 , ctl.* properties
are not represented as files in the filesystem. So there's no need
to grant read access to them, since it's pointless.

Remove core_property_type from these properties, which has the net
effect of removing read access to these non-existent files.

Change-Id: Ic1ca574668a3511c335a7036a2bb7993ff02c1e3

am: 4c1bbc30

* commit '4c1bbc30':
  Remove property read access for non-core properties

am: 4cf49a91

* commit '4cf49a91':
  Revert "Migrate to upstream policy version 30"

am: 5a570a4b

* commit '5a570a4b':
  Remove property read access for non-core properties

am: 5ca5696e

* commit '5ca5696e':
  Revert "Migrate to upstream policy version 30"

Instead of allowing global read access to all properties,
only allow read access to the properties which are part of
core SELinux policy. Device-specific policies are no longer
readable by default and need to be granted in device-specific
policy.

Grant read-access to any property where the person has write
access. In most cases, anyone who wants to write a property
needs read access to that property.

Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918

This reverts commit 2ea23a6e.

Change-Id: I5e9efa56d74ab22030611cab515e050e0bb77aca

This reverts commit 2ea23a6e.

Change-Id: I5e9efa56d74ab22030611cab515e050e0bb77aca

am: ac60c3a4

* commit 'ac60c3a4':
  Allow update_verifier to access bootctrl_block_device.

am: 7a0b8efe

* commit '7a0b8efe':
  Allow update_verifier to access bootctrl_block_device.

am: 85af2526

* commit '85af2526':
  Allow update_verifier to access bootctrl_block_device.

am: e8b176ed

* commit 'e8b176ed':
  Allow update_verifier to access bootctrl_block_device.

am: 14b6f449

* commit '14b6f449':
  Allow update_verifier to access bootctrl_block_device.

Bug: 26039641
Change-Id: Ifd96b105f054b67f881529db3fe94718cab4a0f4
(cherry picked from commit 8eaf2585)

am: def6593d

* commit 'def6593d':
  Change /dev/ion from read-only to read-write

am: 637af04e

* commit '637af04e':
  Change /dev/ion from read-only to read-write

am: 71fd337f

* commit '71fd337f':
  Change /dev/ion from read-only to read-write

Even though /dev/ion can allocate memory when opened in read-only mode,
some processes seem to unnecessarily open it in read-write mode.
This doesn't seem to be harmful, and was originally allowed in
domain_deprecated. Re-allow it.

Bug: 25965160
Change-Id: Icaf948be89a8f2805e9b6a22633fa05b69988e4f

Change-Id: I6f07a36af3ff3cf5ba13322e1910b4455d2adbb7

am: af56999e

* commit 'af56999e':
  Migrate to upstream policy version 30

am: 3dd51b99

* commit '3dd51b99':
  shell.te: Restore /proc/net access

am: 862e4ab1

* commit '862e4ab1':
  Migrate to upstream policy version 30

am: ce890bf8

* commit 'ce890bf8':
  shell.te: Restore /proc/net access

am: 9a3d490e

* commit '9a3d490e':
  Migrate to upstream policy version 30

am: 99c78bf2

* commit '99c78bf2':
  shell.te: Restore /proc/net access

Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow
priv_sock_perms to disallow access to MAC address and ESSID.

Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3

The removal of domain_deprecated from the shell user in
https://android-review.googlesource.com/184260 removed /proc/net access.
Restore it.

Bug: 26075092
Change-Id: Iac21a1ec4b9e769c068bfdcdeeef8a7dbc93c593

Bug: 26039641
Change-Id: Ifd96b105f054b67f881529db3fe94718cab4a0f4

Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker am: 44826cb5 am: 7fe25900
am: 713ad50b

* commit '713ad50b':
  Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker

am: 1d3cebc7

* commit '1d3cebc7':
  adbd: allow ddms screen capture to work again