Change-Id: I6f07a36af3ff3cf5ba13322e1910b4455d2adbb7

am: af56999e

* commit 'af56999e':
  Migrate to upstream policy version 30

am: 3dd51b99

* commit '3dd51b99':
  shell.te: Restore /proc/net access

am: 862e4ab1

* commit '862e4ab1':
  Migrate to upstream policy version 30

am: ce890bf8

* commit 'ce890bf8':
  shell.te: Restore /proc/net access

am: 9a3d490e

* commit '9a3d490e':
  Migrate to upstream policy version 30

am: 99c78bf2

* commit '99c78bf2':
  shell.te: Restore /proc/net access

Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow
priv_sock_perms to disallow access to MAC address and ESSID.

Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3

The removal of domain_deprecated from the shell user in
https://android-review.googlesource.com/184260 removed /proc/net access.
Restore it.

Bug: 26075092
Change-Id: Iac21a1ec4b9e769c068bfdcdeeef8a7dbc93c593

Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker am: 44826cb5 am: 7fe25900
am: 713ad50b

* commit '713ad50b':
  Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker

am: 1d3cebc7

* commit '1d3cebc7':
  adbd: allow ddms screen capture to work again

Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker am: 44826cb5
am: 7fe25900

* commit '7fe25900':
  Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker

am: 44826cb5

* commit '44826cb5':
  Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker

Add initial support for labeling files on /sys/kernel/debug.
The kernel support was added in https://android-review.googlesource.com/122130
but the userspace portion of the change was never completed until now.

Start labeling the file /sys/kernel/debug/tracing/trace_marker . This
is the trace_marker file, which is written to by almost all processes
in Android. Allow global write access to this file.

This change should be submitted at the same time as the system/core
commit with the same Change-Id as this patch.

Change-Id: Id1d6a9ad6d0759d6de839458890e8cb24685db6d

am: 8e543646

* commit '8e543646':
  adbd: allow ddms screen capture to work again

am: 5e8402df

* commit '5e8402df':
  adbd: allow ddms screen capture to work again

am: 80c34f6a

* commit '80c34f6a':
  adbd: allow "adb pull /sdcard/"

The removal of domain_deprecated broke ddms screen capturing
functionality.

Steps to reproduce:

1) Run "ddms"
2) Select your device
3) Go to the Device > Screen Capture menu
4) Attempt to take a screenshot

Addresses the following denials:

  avc: denied { read } for pid=2728 comm="screencap" name="ion" dev="tmpfs" ino=7255 scontext=u:r:adbd:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
  avc: denied { open } for pid=2728 comm="screencap" name="ion" dev="tmpfs" ino=7255 scontext=u:r:adbd:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
  avc: denied { ioctl } for pid=2728 comm="screencap" path="/dev/ion" dev="tmpfs" ino=7255 ioctlcmd=4905 scontext=u:r:adbd:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1
  avc: denied { read } for pid=5261 comm="screencap" name="egl" dev="dm-1" ino=210 scontext=u:r:adbd:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0
  avc: denied { read } for pid=5261 comm="screencap" name="egl" dev="dm-1" ino=210 scontext=u:r:adbd:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0

Bug: 26023462
Change-Id: Ie77c65900de56756d5c9b99dcda1e20664151ed2

am: e9d43070

* commit 'e9d43070':
  adbd: allow "adb pull /sdcard/"

am: b899f4fc

* commit 'b899f4fc':
  adbd: allow "adb pull /sdcard/"

The removal of domain_deprecated broke the ability for adbd to
pull files from /sdcard. Re-allow it.

Addresses the following denials:

  avc: denied { search } for pid=2753 comm=73657276696365203530 name="/" dev="tmpfs" ino=6242 scontext=u:r:adbd:s0 tcontext=u:object_r:tmpfs:s0 tclass=dir permissive=0
  avc: denied { getattr } for pid=2755 comm=73657276696365203431 path="/sdcard" dev="rootfs" ino=5472 scontext=u:r:adbd:s0 tcontext=u:object_r:rootfs:s0 tclass=lnk_file permissive=0

Change-Id: I70257933f554abd008932c7f122dd0151f464b05

am: ef4aa06e

* commit 'ef4aa06e':
  Increase communication surface between dumpstate and Shell:

am: 8cf8a9d0

* commit '8cf8a9d0':
  Increase communication surface between dumpstate and Shell:

am: 83fd8a54

* commit '83fd8a54':
  Increase communication surface between dumpstate and Shell:

- Add a new 'dumpstate' context for system properties. This context
  will be used to share state between dumpstate and Shell. For example,
  as dumpstate progresses, it will update a system property, which Shell
  will use to display the progress in the UI as a system
  notification. The user could also rename the bugreport file, in which
  case Shell would use another system property to communicate such
  change to dumpstate.
- Allow Shell to call 'ctl.bugreport stop' so the same system
  notification can be used to stop dumpstate.

BUG: 25794470

Change-Id: I74b80bda07292a91358f2eea9eb8444caabc5895

am: 38c26b16

* commit '38c26b16':
  rild: Remove toolbox_exec perms

am: 0676757d

* commit '0676757d':
  rild: Remove toolbox_exec perms

am: f6a0b144

* commit 'f6a0b144':
  rild: Remove toolbox_exec perms

am: 2d749d4b

* commit '2d749d4b':
  shell.te: Allow read access to system_file

am: 1484b0c3

* commit '1484b0c3':
  Further restrict access to tun_device

am: 298a38ed

* commit '298a38ed':
  shell.te: Allow read access to system_file

am: 29b9532a

* commit '29b9532a':
  shell.te: Allow read access to system_file

Certain tests depend on the ability to examine directories
in /system. Allow it to the shell user.

Addresses the following denials:

  avc: denied { read } for name="egl" dev="dm-1" ino=104 scontext=u:r:shell:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0

Bug: 26020967
Bug: 26023420
Change-Id: I509d921e159e99164c85fae9e8b2982a47573d14

Confirmed via audit logs that it is not required.

Change-Id: I01d4b7ec15d4c852a9f28daf0b40ab4bce930125

am: cd47828c

* commit 'cd47828c':
  Further restrict access to tun_device

am: 98c3f997

* commit '98c3f997':
  Further restrict access to tun_device

Remove bluetooth's access to tun_device. Auditallow rule demonstrates
that it's not used.

Strengthen the neverallow on opening tun_device to include all Apps.

Bug: 24744295
Change-Id: Iba85ba016b1e24c6c12d5b33e46fe8232908aac1