am: 52719ea5

* commit '52719ea5':
  Add SELinux label for app fuse.

am: e3965aa2

* commit 'e3965aa2':
  Add SELinux label for app fuse.

am: eb3480b7

* commit 'eb3480b7':
  Allow domain to read proc dirs.

am: 8f611b6e

* commit '8f611b6e':
  Replace "neverallow domain" by "neverallow *"

am: abf31acb

* commit 'abf31acb':
  Allow domain to read proc dirs.

Ability to read all of proc was placed in domain_deprecated with the
intention of reducing information leaking from proc.  Many processes try
to read proc dirs, though.  Allow this with the belief that information
leakage is from the proc files themselves rather than dir structure.

Address the following denial:
avc: denied { read } for name="/" dev="proc" ino=1 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=dir permissive=0

Bug: 26833472
Change-Id: I975ae022c093e1cf80de21487dc11e49f938e5a3

am: 35a14514

* commit '35a14514':
  Replace "neverallow domain" by "neverallow *"

Modify many "neverallow domain" rules to be "neverallow *" rules
instead. This will catch more SELinux policy bugs where a label
is assigned an irrelevant rule, as well as catch situations where
a domain attribute is not assigned to a process.

Change-Id: I5b83a2504c13b384f9dff616a70ca733b648ccdf

Change-Id: I0cfc604676dc67701fdd5cdd1c143974d7200d07

The labels for filesystem and files are assigned by vold with using
context= mount option.

Change-Id: I8a9d701a46a333093a27107fc3c52b17a2af1a94

Add permissions to dex2oat, introduce otapreopt binary and otadexopt
service.

Bug: 25612095
Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7

Currently vdc emits logs to stderr, which makes sense for command
line invocations, but when exec'ed they're silently dropped unless
the caller uses logwrapper.

avc: denied { read write } for path="/dev/pts/2" dev="devpts" ino=5 scontext=u:r:vdc:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0

Bug: 25796509
Change-Id: Ib92e0a7f580b1934a9853a83684f95b24bdc355c

am: 47f95192

* commit '47f95192':
  persist.mmc.* only set in init

am: d1435604

* commit 'd1435604':
  persist.mmc.* only set in init

Bug: 26976972
Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118

am: f9065c89

* commit 'f9065c89':
  Fix SELinux warning when passing fuse FD from system server.

am: 4c42a0dc

* commit '4c42a0dc':
  Fix SELinux warning when passing fuse FD from system server.

Before applying the CL, Android shows the following error when passing
FD of /dev/fuse.

> Binder_2: type=1400 audit(0.0:38): avc: denied { getattr } for
> path="/dev/fuse" dev="tmpfs" ino=9300 scontext=u:r:system_server:s0
> tcontext=u:object_r:fuse_device:s0 tclass=chr_file permissive=0

Change-Id: I59dec819d79d4e2e1a8e42523b6f521481cb2afd

Address the following denial caused by systemui:
avc:  denied  { find } for service=voiceinteraction pid=10761 uid=10029 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:voiceinteraction_service:s0 tclass=service_manager permissive=0

Bug: 26842457
Change-Id: I8274d7f31a4390ccfb885389302e4fea9ce0e389

am: fa335306

* commit 'fa335306':
  init: allow to access console-ramoops with newer kernels

am: 84fbd53a

* commit '84fbd53a':
  init: allow to access console-ramoops with newer kernels

Also narrowly specify the domain for the local transport's bookkeeping.

Bug 26834865

Change-Id: I2eea8a10f29356ffecabd8e102f7afa90123c535

Bug 25454501

Change-Id: I31357e658ecdbcc69df47fbc2d22e4849dd1539b

This reverts commit 2afb217b.

Change-Id: Ie2ba8d86f9c7078f970afbb06230f9573c28e0ed

am: 15decd69

* commit '15decd69':
  mediaserver: grant perms from domain_deprecated

am: e02124ff

* commit 'e02124ff':
  logd: grant perms from domain_deprecated

am: d9fcee9d

* commit 'd9fcee9d':
  kernel: grant perms from domain_deprecated

am: 3d8391e7

* commit '3d8391e7':
  mediaserver: grant perms from domain_deprecated

am: 61e93860

* commit '61e93860':
  logd: grant perms from domain_deprecated

am: e48ab784

* commit 'e48ab784':
  kernel: grant perms from domain_deprecated