Test: only a compile-time change (adds neverallow rules), so, did
     m -j sepolicy on the following targets:
  - marlin
  - sailfish
  - 2017 devices
Bug: 36162501
Change-Id: I1092aff40da9dcf09bd044400bedd1f549eb7e38

Don't create nonplat_service_contexts on full_treble devices am: e83f1e56 am: 0d5bca44 am: e06f443c
am: f3a6adfd  -s ours

Change-Id: I442d4a9579393ffc5a4bfd284ddf9dcb4c633845

am: e06f443c

Change-Id: Ib2245d6767275440d9c0ad775222d8c923e0281f

am: 0d5bca44

Change-Id: I31b9e976864301454fd82108d51f2ac9cda34578

am: e83f1e56

Change-Id: I6c7a9a6c52f670a8f18240def3b0b1f416001236

Concatenates all 'bug_map' files and places the file on device under
/system/etc/selinux/bug_mappings

Bug: 34997782
Test: the file appears properly on device when bug_map files are present
Change-Id: I12d6c90983932f7d5e1d1f7586fa30a5edd7b0c5

This change is the bare minimum needed to publish a new vold
Binder service and move the simple "reset" call over to go through
the new interface.

The new rules here are mirrored on the existing installd rules, but
with a handful of neverallow rules relaxed due to funky interactions
with hal_client_domain().

Test: builds, boots
Bug: 13758960
Change-Id: Ia9522ea7a68698cb0edce7879abfbf22b9d67c76

On full Treble devices, servicemanager should only host services
served from processes on /system; nonplat_service_contexts
should not be created at all in this case.

Bug: 36866029
Test: Build marlin and make sure nonplat_service_contexts is not
      created.

Change-Id: Id02c314abbb98fc69884198779488c52231d22c3
Merged-In: Id02c314abbb98fc69884198779488c52231d22c3

am: d79a822f  -s ours

Change-Id: I297a4a162de814979970a5c4bab4e35695c025e4

am: 59f23650  -s ours

Change-Id: I8563d9e3347f7c62d9fcd5b2c26c160a957be0b5

am: 8b6ceed0

Change-Id: I39a8c2a75f646f3943d925adc4444777a90b9076

am: 5b2ebd3b

Change-Id: I74209b877fdacaa485798b393678989029835924

This reverts commit 9216a6ad.

Bug: 65206688

Merged-In: I8e61b77a1abe9543e4fba77defb8062407676fcf
Change-Id: I8e61b77a1abe9543e4fba77defb8062407676fcf

On full Treble devices, servicemanager should only host services
served from processes on /system; nonplat_service_contexts
should not be created at all in this case.

Bug: 36866029
Test: Build marlin and walleye and make sure nonplat_service_contexts
      is not created.

Change-Id: Id02c314abbb98fc69884198779488c52231d22c3

am: e92b7f16

Change-Id: I0e0e1b2c525a26b5da8a3536df5ccfa72b9e79a8

am: a30b6a5c

Change-Id: I3f7ace8c849689d66558c38c149453564920d013

am: 4deeab5c

Change-Id: I74319e51a152ba35fdf076a4dffdeeb0dc69763b

am: cdaf97bf

Change-Id: Ibcb3d728c233530f7354b409bf3849a021532b5d

am: 91306800

Change-Id: Ia7bc742ded9f4d2aa196e058e31935faf9c98759

am: 123cf237

Change-Id: I77c8793363ad2e3736ca587070b1cbd119168f53

am: 6be79378

Change-Id: I0dbb98546bce65aed0a07fa75a204d304ce3af59

Test: SANITIZE_HOST=true m treble_sepolicy_tests
Change-Id: I9190dc06715bbbac8a267a143801f99f911decf3

am: fa85fac7

Change-Id: I43092ff1907c28239565b813c84be43cdc8aae5e

am: adf68570

Change-Id: Ida2b4c0d8f400c753566861bd48bcf5459fc40b7

am: b22278e4

Change-Id: Id1c46283531412a75ffe46f1beb26d5cdc732b8f

am: b10d590f

Change-Id: I348f842c39e9a04d96eafcb56ab1caeadb3c0381

am: 7db2eda2

Change-Id: I6398f6304884c7067df71f2130b70e674e976092

am: 15f9d052

Change-Id: I63deaebd7e90dafb1c6afa00b9b9474344a4cc6e

am: ba4d04e0

Change-Id: Iea1a6d7fc4220566b912d19122b820d918b333d8

am: e2e557b2

Change-Id: Iec1b60541c99d7c37fe15e44f6b94e542e4c0f69

am: fa459fc9

Change-Id: I87720d8b06b64a71e36f17a0f1a8ee067737d022

am: 9e0ca36c

Change-Id: I695689149665bd71be9b1a986c52d5c3035ec337

am: 60e53837

Change-Id: Ic262062da2065dddbabaff26f38d779f4e63b95d