am: dddf44d1

Change-Id: Id065ce7709a333435675ed2fb4948a9016cccfaa

am: a733bed5

Change-Id: I931316818a4fb6889ab1c46ee90d27025cd1496d

am: 905c8133

Change-Id: I4a14309f90c98802b3db03e2a2fabe48fde7c5b0

am: a24fae4f

Change-Id: Ic5420da36c5653021010dcfceeaf3c915bb6ec2d

am: e33de6a8

Change-Id: Icae7ddef1df97f469317438f63dd3613a87f5545

am: 90b3b948

Change-Id: Iee71ed7dd1edaa4507203708d4566e342b03e76c

am: c6bcdbdf

Change-Id: Ic7045b9dbb99cda3edb30f47ed9ecdbf542da92e

am: 320e821e

Change-Id: I0bbb2bcc523e079650753f577f68b983b7086a39

am: 62f0b8ea

Change-Id: I5c0d607d92f7ba76e113f4c5aaf746e48ddd2718

Bug: 31363362
Test: Bullhead and Sailfish both build and boot w/out new denials.
Change-Id: If6a451ddaab8c9b78a618c49b116a7ed766d0710

am: c4ee4ca6

Change-Id: Ic57956bc6f897ea24584702a32bab52432e2d010

am: 5529f036

Change-Id: Ib9812cb072ad33e974dfb625fdaf421be01fea42

am: 5b8d87b2

Change-Id: I7e28e34027887dde44d2c160891117596133700d

Add a compile time assertion that only authorized SELinux domains are
allowed to touch the metadata_block_device. This domain may be wiped at
will, and we want to ensure that we're not inadvertently destroying
other people's data.

Test: policy compiles.
Change-Id: I9854b527c3d83e17f717d6cc8a1c6b50e0e373b6

am: 27eb6492

Change-Id: Ifbea25c85e2eae67f0da3a9dfd19a1e6bb873c80

am: cea7171f

Change-Id: I54073aa11166a38b6d280e894ebbd459954ddedf

am: 7a2107c1

Change-Id: I8ce6d21c0df0002fd0f0f62da3aafd9652a39f24

am: 393b96e3

Change-Id: Ib556294ff0b0a64db1088c5e790a3eec6dd4f58a

am: 377e50d7

Change-Id: I405de2d676bf01053bf1e36049edd348675d183a

am: 0046853f

Change-Id: Ib21c9b4dad410270ef280786a7eca0db21069e88

am: 1b0ec79f

Change-Id: Ib4d85189639a4ef7228f9b8dd639b6a2eb59ea39

am: 18f61a0f

Change-Id: I05a0657ab76f1143f0fd808de7948bfc2e7b21f8

am: bb9a3888

Change-Id: I6f9175baa166d7f8b887b12fbc6266e602f24173

system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a
number of new properties of the form:

  [ro.boottime.init]: [5294587604]
  [ro.boottime.InputEventFind]: [10278767840]
  [ro.boottime.adbd]: [8359267180]
  ...

These properties were assigned the default_prop SELinux label because a
better label did not exist. Properties labeled with the default_prop
label are readable to any SELinux domain, which is overly broad.

  bullhead:/ $ getprop -Z ro.boottime.adbd
  u:object_r:default_prop:s0

Instead, create a new label for the ro.boottime.* properties so we can
apply more fine grain read access control to these properties.

  bullhead:/ $ getprop -Z ro.boottime.adbd
  u:object_r:boottime_prop:s0

New SELinux property labels have minimal permissions by default. As a
result, after this change, ro.boottime.* properties will only be
readable to system_server, bootstat, init (because it manages the property
space), and "adb root" (because no SELinux permissions are enforced there).

Additional read access can be granted as-needed.

This is part of a larger effort to implement fine-grain access control
on the properties managed by init.

Test: Device boots and no SELinux denials on boot.
Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d

Address denial type=1400 audit(0.0:42): avc: denied { call } for
scontext=u:r:untrusted_app:s0:c512,c768
tcontext=u:r:ephemeral_app:s0:c207,c258,c512,c768 tclass=binder

Test: Above denial no longer happens
Change-Id: I351269ee4671cfd51c981d3db5d0f3944d14e702

am: 5bfa8509

Change-Id: Idb6a5e42bff4bab0781db7bad1a497e9b2c169e5

am: f13dcbb4

Change-Id: Ife8946bdd99b4121b6ad80a21c345d9ee0af1777

am: d57dd813

Change-Id: I5e911f7d301ba8421184b80f485e043178f225fb

am: 2d5426ae

Change-Id: Iae51b513b88597b8837c869e93c67a58f52db2b1

am: 37f17c5b

Change-Id: I9f2147b904b48cfc6f6f898056e8ae3acd6d7aea

am: 16c889c5

Change-Id: Icfa43cb11246de34f6f8f3c96726bec67680c5ff

Bug: 32123421
Bug: 32905206

Test: compiles, nfc works
Change-Id: Ibf72ef70255573e4df0863ea640354b3c37eb47d

core_property_type is an attribute which was given to all existing
properties known to core SELinux policy. Any property with this label is
readable to all SELinux domains, which is overly broad. The long term
goal is to remove the core_property_type attribute entirely.

Add a neverallow rule prohibiting the introduction of new properties
with the core_property_type attribute. Device specific properties, or
new properties in core SELinux policy, should not have this attribute.

Test: policy compiles
Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2

am: 5f50fd90

Change-Id: I643d05381fd866f43717dc37b55ad5beb589a2bc