Merge "Allow Bluetooth sys_nice and system_server setsched for Bluetooth HAL" am: 2e8b0004 am: 1cc029ea
am: 1d4bb3ac

Change-Id: I319a76a77cab5f4af2f8eb98aaaa2752564e04b0

am: 1cc029ea

Change-Id: I4dc969584352c3181c3a0e49c90dff8a89940ea8

am: 2e8b0004

Change-Id: I2e8648728c5e63037686981c154d16c3010ac095

am: a9d7b895

Change-Id: I040a1874e3a08510d9b7c9a107a149845dd1976c

am: 26564ce7

Change-Id: I8961e581bad56f118c112f6b1e6d2ba11a81ccf6

am: f033cfdc

Change-Id: I8d8c0e786bdbb7374fa4a77649507706176b28d9

am: 364644eb

Change-Id: I83410880ad404a5cabd5d7ec287f5d538110556e

Empty typeset is not an issue in neverallow rules. The reason is that
it's completly normal for scontext or tcontext of neverallow rules to
evaluate to an empty type set. For example, there are neverallow rules
whose purpose is to test that all types with particular powers are
associated with a particular attribute:
  neverallow {
    untrusted_app_all
    -untrusted_app
    -untrusted_app_25
  } domain:process fork;

Test: sepolicy-analyze neverallow -w -n \
          'neverallow {} {}:binder call;'
      produces empty output instead of "Warning!  Empty type set"
Bug: 37357742
Change-Id: Id61b4fe22fafaf0522d8769dd4e23dfde6cd9f45

Test: gts-tradefed run gts -m GtsMediaTestCases -t com.google.android.media.gts.MediaPlayerTest#testLLAMA_H264_BASELINE_240P_800_DOWNLOADED_V0_SYNC

bug:37548390
Change-Id: I9c2d446118d3a5f729730b75ec117954e383159b

This adds neverallow rules which enforce the prohibition on
communication between framework and vendor components over VendorBinder.
This prohibition is similar in spirit to the one for Binder
communications.

Most changes consist of adding neverallow rules, which do not affect
runtime behavior. The only change which does affect runtime behavior
is the change which takes away the right of servicemanager domain to
transfer Binder tokens to hwservicemanager and vndservicemanager. This
grant was there by accident (because it was overly broad) and is not
expected to be needed: servicemanager, hwservicemanager, and
vndservicemanager are not supposed to be communicating with each
other.

P. S. The new neverallow rules in app_neverallows.te are covered by
the new rules in domain.te. The rules were nevertheless added to
app_neverallows.te for consistency with other *Binder rules there.

Test: mmm system/sepolicy
Bug: 37663632
Change-Id: I7c2ae23924bf0f2fed3f1e3a8d4d603129286329

am: a8a03c84

Change-Id: I1157c928baa664d196ef0c81741ef6ffd24ba9b2

This is a follow-up to cbc0d2bb which
introduced the typos.

Test: mmm system/sepolicy -- comments only change
Bug: 37640821
Change-Id: Ibe0eda0b3ee9bbfb1e33ef98f2e81267ec580e59

am: 53b2c809

Change-Id: I0b2d4db7bbd33abde41229d6e40a4a2ef1f89085

am: 7a1074d2

Change-Id: I2dc21f2e4cb0fee5f072779728bb0a9394915d08

am: cda872a8

Change-Id: I364c5cc081f9c906e92844a9d456b78ae90a3895

am: a9be5320

Change-Id: Iee7069f192593f4b7588f8b6d272b1bef5fbd36c

am: 327d7cb9

Change-Id: Ie9399516244e38f0c5f57205fe9f0da35aec8ba7

iptables recently changed its behavior to strictly require xtables.lock.
dumpstate selinux policy must be updated to allow access.

Bug: 37648320
Test: dumpstate succeeds with no avc: denied ... xtables.lock messages
Change-Id: Ic7e243739f375a60fa14fe67fac910d31d978ffd

am: 3f6b7ff0

Change-Id: I0639248d7f1e2ed1012a563c9b0b4db1fb651bb4

Bluetooth needs the capability to set audio-related threads to be RT
scheduled.  Grant it sys_nice.

system_server needs to set priority for the Bluetooth HAL.  Allow it.

Bug 37518404
Test:  Play Bluetooth audio, confirm RT scheduling with systrace
Change-Id: Iaf7b85a11a51883744d72a50addfd320b6fbbc2f

am: f84989e5

Change-Id: I4391c7b44d495efadf39b8f14cfccfe2d966b419

am: e5f4d874

Change-Id: Ibd9708b1db37e54946c856b7c52c1e1a7eb7c58d

Bug: 37646565
Test: build marlin-userdebug
Change-Id: I3325d027fa7bdafb48f1f53ac052f2a68352c1dc

am: 4d71b96e

Change-Id: I363c0ce1fc27d560da94b857d54a5149467d56ba

This adds a neverallow rules which checks that SELinux app domains
which host arbitrary code are not allowed to access hwservicemanager
operations other than "find" operation for which there already are
strict neverallow rules in the policy.

Test: mmm system/sepolicy -- neverallow-only change
Bug: 34454312
Change-Id: I3b80c6ae2c254495704e0409e0c5c88f6ce3a6a7

Test: mmm system/sepolicy -- this is just a comment change
Bug: 37640821
Change-Id: I28c27b369268e75ab6b2d27bcb30b88acb2732e6

Test: mmm system/sepolicy -- this is just a comment change
Bug: 37640900
Change-Id: I7c96dde15f74822a19ecc1b28665913b54b3973b

am: 2a7f4fb0

Change-Id: Ia77557e2ef5aa124cb0d4a9e5f05300005a97bfd