Devices that store their BT MAC address in /data/misc/bluedroid/ need
to find another place for that file.

Bug: 36602160
Test: Restart Bluetooth, check for selinux denials/files in /data/misc
Change-Id: Ib8d610f201a8c35f95b464c24857c6639205bc66

am: cc5da52f

Change-Id: Ie05d021efd289bf14f86ac070fce74c81ac7bd57

am: 36c8f160

Change-Id: I4c39b013d9d8f296171dde6d0b0b3400074f3825

am: 134c7182

Change-Id: I23e7aa2a87f34a4adc5fd5eac85710db6238d9db

am: d7a2f60d

Change-Id: Ifc66292d55f1daea28069cbf63cd70bf96fee74d

This reverts commit 5c09d123.

Broke the build

Bug: 35870313
Test: source build/envsetup.sh && lunch marlin-userdebug && m -j40
Change-Id: I71c968be6e89462fd286be5663933552d478f8bf

am: 3100873f

Change-Id: Icc445d11ccc9606717d07317446c43a2ef731447

am: c673770a

Change-Id: Icb5276a3b73419b4b0e3a9fea1af157d0e1ef882

Full treble targets cannot have sockets between framework and vendor
processes. In theory, this should not affect aosp_arm64_ab where only
framework binaries are built. However, /system/sepolicy has rild.te
which is now vendor binary and this causes neverallow conflict when
building aosp_arm64_ab.

So, we just temporarily annotate the rild with
socket_between_core_and_vendor_violators so that the neverallow conflict
can be avoided.

Test: choosecombo 1 aosp_arm64_ab userdebug; m -j 80 The build should
not break.

Change-Id: I260757cde96857cc3f539d5f82ca69c50653f8c7

am: 897473dc

Change-Id: Ic481a4198f03ee242d04cfa11d885353b24cde4c

am: a6dc0dc2

Change-Id: I0ac39078f058e970822deda9a3161c05b0dceaeb

am: d80511d3

Change-Id: I329798f6f7885aa68323367a43da6c0a3daa3fb5

am: 3ad5c9e7

Change-Id: I41a829460d932c30e564060fceb9169a7443014f

am: b78fd545

Change-Id: I227c5aee3e635922f39192bc9ce5a1ca5db46451

am: a581c048

Change-Id: Ic71ef550af5cb26ca7d4db01fa78bd6c74b98ca5

am: eaa5e298

Change-Id: I232deac94123b1e07a20789cc247aa95bb9b3327

am: 75760e9d

Change-Id: I02cfb5b418c2edaeaa02831113205e0a73f92342

am: 32815389

Change-Id: Id6cc5e3c1dc6b098f893b566dcbf09fc29973162

am: 7eb3dd3b

Change-Id: Iafaa3fd315533c4cb49847d927d2c7cbae71bb51

* changes:
  Add IpSecService SEPolicy
  Update Common NetD SEPolicy to allow Netlink XFRM

Test: denials go away
Change-Id: I103cf3ad8d86b461bcba8edce02f6202fd2bcbe8

am: 719edb06

Change-Id: I162eaf1a4d61cbef00f531d779ee5a8282369b66

am: 7dcab748

Change-Id: I0a9e49071e191903eeba44f145dd2b1c947662d4

am: 2515e1b1

Change-Id: I02b27169a707d5e4c2de8ef0183b1b782e90cf86

am: 07921191

Change-Id: I018a6d9bf84d75831a9d295a4c92184041134f33

am: 5a6ab596

Change-Id: I48a064db0e9a579b0b1217c41c98ada3ff25ad93

am: b81943b6

Change-Id: Ib1ac3f1b833b389710028d79a1e9ba6e13062efb

am: 394539c5

Change-Id: Ibaa6911b4656ceb41167eab09eddfb3ca8c783f2

am: 136caa1b

Change-Id: I35ffe4d2cd233582c9dc73f1c20602c1a1c953eb

am: 1e149967

Change-Id: Ie6fe25279ff73d4b200463bd07116a40a2272382

am: c9cf7361

Change-Id: Ib2588c6117fdaf79665f61d4c872c60fb6579613

am: 939d16b5

Change-Id: I1c351ee36100730bf98a3fe820d1f51f7b672ba5

am: 54a42001

Change-Id: I8281fcee3729b0a48131a860381db2a2be5f8c84

* changes:
  mac_permissions: explicitly label all mac_permissions files
  sepolicy: explicitly label all sepolicy files
  seapp_context: explicitly label all seapp context files
  file_context: explicitly label all file context files
  service_contexts: label service_contexts explicitly
  prop_context: correctly label all property_context files

This tightens neverallows for looking up Binder servicemanager
services from vendor components. In particular, vendor components,
other than apps, are not permitted to look up any Binder services.
Vendor apps are permitted to look up only stable public API services
which is exactly what non-vendor apps are permitted to use as well.
If we permitted vendor apps to use non-stable/hidden Binder services,
they might break when core components get updated without updating
vendor components.

Test: mmm system/sepolicy
Bug: 35870313
Change-Id: I949d62b3528cadb4bfe6f5985c25d1f497df0d5a

am: 0aa47bbf

Change-Id: Ib7a276a08b416c772eaf8fbc5d64f16cd08006da