am: 23d703ee

Change-Id: I98383d496812ced491a892c1ffb29527d77c63a9

Bug: 30156807
Change-Id: Ie9faf72d35579fa69b4397bdffc8d674f040736c

Change-Id: Ic549f8c8060a17981302f2af75debf34595475bb

* changes:
  adbd: allow reading apk_data_file
  adbd: allow reading rootfs dir

avc: denied { search } for comm=73657276696365203139 name="app" dev="sda35" ino=770049 scontext=u:r:adbd:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir permissive=0

Bug: 30000600
Change-Id: I86958ebcca815ee1779f85fb425592493f40101a

Bug: 30213958
Change-Id: I0449575a5ec6cc4997bc36a13676474505a4190f

am: afad0c35

Change-Id: Id4a4937cc3b7c2ddd6d363144e6fafc90be60498

am: ee69a2e7

Change-Id: If61f5720180243ec1b5aa9e16d66c95c37f49b88

am: 83348b0b

Change-Id: Ia19aeffe64e733deb695206dcbd8cb824c9db222

untrusted_app lost all of the domain_deprecated permissions in N,
including the ability to read asec_apk_file dirs.  This is used for
forward locked apps.

Addresses the following denials:
avc: denied { search } for name="asec" dev="tmpfs" ino=9298 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:asec_apk_file:s0 tclass=dir permissive=0
avc: denied { getattr } for path="/mnt/asec" dev="tmpfs" ino=9298 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:asec_apk_file:s0 tclass=dir permissive=0

(cherry-pick of internal commit: addd3c9f)

Bug: 30082229
Change-Id: I87758f1daee19197d9299bca261f0324e01af5e0

am: 87f2ca2d

Change-Id: Ia0ebfddad770c09ded5fecd2273f78d560507e9f

am: ad03e7db

Change-Id: I1fa0ced9c61bacc1b577ccee9c5a47459066d45f

Change-Id: I874557582d244956a5a7a4305c00ac2f0c190a88

Bug: 28936216
Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5

Since there is "write /proc/sys/vm/overcommit_memory 1" line in init.rc

Change-Id: I5899d2802e7fa56b438a06d4cadb4eb6827bfe16
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>

Strip whitespace and comments from service_context files
to reduce size. On an aosp_x86_64 build it saves 36 bytes.

However, on builds with more synclines and comments, further
space savings can be realized.

Change-Id: I3cb4effad1d1b404bf53605a3793e3070cb95651
Signed-off-by: William Roberts <william.c.roberts@intel.com>

Strip whitespace and comments from property_context files
to reduce size. On an aosp_x86_64 build it saves 851 bytes.

However, on builds with more synclines and comments, further
space savings can be realized.

Change-Id: I43caf1deaab53d4753c835918898c8982f477ef0
Signed-off-by: William Roberts <william.c.roberts@intel.com>

am: bc1986fb

Change-Id: I7707dfb170b31df7e344bf695c124e84a5049b11

Needed for jemalloc commit:

2f970c32b527660a33fa513a76d913c812dcf7c
Modify pages_map() to support mapping uncommitted virtual memory.

avc: denied { read } for name="overcommit_memory" dev="proc" ino=10544
scontext=u:r:wificond:s0 tcontext=u:object_r:proc:s0 tclass=file

Bug: 29773242
Change-Id: I78054c1ed576a7998c4ee1d1beca2f610c589c3a

am: d0feed89

Change-Id: Ic9bff29ec7fedafe6ff20ed8ef80d68394352ef1

avc: denied { search } for pid=394 comm="lmkd" name="lowmemorykiller" dev="sysfs" ino=7541 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs_lowmemorykiller:s0 tclass=dir permissive=0

(Cherry picked from commit 30a3ee4c)

Bug: 29558514
Change-Id: Iaae907a92976af2a9dcb58be5643b8614dcde174

avc: denied { search } for pid=394 comm="lmkd" name="lowmemorykiller" dev="sysfs" ino=7541 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs_lowmemorykiller:s0 tclass=dir permissive=0

Bug: 29558514
Change-Id: Iaae907a92976af2a9dcb58be5643b8614dcde174

am: 42aaf5a0

Change-Id: I6d8d76687f6ffbbd849424286d90d6cad6a65993

am: fafcf5a1

Change-Id: Ifa88db9920a8cc1645c6fa0f313dba9f79b76260

am: 797f32b2

Change-Id: Idcd263089437c91a9b70373430c32551228db61f

am: 9a38deff

Change-Id: Idfb80b6247f734f1ec42da269ee5f19d92e15e64

am: 108b74a1

Change-Id: I3c236c3d430176ceed724eae114af5c43f66f16f

update_engine launches the postinstall process and can suspend and
resume it by sending SIGSTOP and SIGCONT. This fixes the following
denials:

update_engine: type=1400 audit(0.0:88): avc: denied { sigstop } for scontext=u:r:update_engine:s0 tcontext=u:r:postinstall:s0 tclass=process permissive=1
update_engine: type=1400 audit(0.0:89): avc: denied { signal } for scontext=u:r:update_engine:s0 tcontext=u:r:postinstall:s0 tclass=process permissive=1

Bug: 28959137
TEST=`update_engine_client --suspend ; update_engine_client --resume` while the device is running postinstall.

Change-Id: I9890ad0ff7fe04bae1a54fa07c61aafca8de8e66

Cherrypicked from AOSP
(commit 51fdddaf).

BUG: 29455997
Change-Id: I9c0d1973f166da202d039eac883a6e53d53e24cb

These capabilities are required so it can run iptables, otherwise it
will cause failures such as:

06-20 16:19:02.650  5524  5524 W iptables: type=1400 audit(0.0:232): avc: denied { net_raw } for capability=13 scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=capability permissive=0
06-20 16:56:57.119  5070  5070 W iptables: type=1400 audit(0.0:13): avc: denied { net_admin } for capability=12 scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=capability permissive=0

BUG: 29455997
Change-Id: I9c0d1973f166da202d039eac883a6e53d53e24cb

am: 5143b6a2

Change-Id: I3e9c1bb011816a484d35469e4849db1c75eea14f

Addresses:
avc:  denied  { find } for service=nfc pid=3355 uid=1001 scontext=u:r:radio:s0 tcontext=u:object_r:nfc_service:s0 tclass=service_manager

BUG=29339762
Change-Id: I87479ef4607bd3e18a2fecb53909c4878e227e2b