Change-Id: I2593e100bdad420d0d988fbaeb8d2ec259b8df1d

Change-Id: I16706423534069f69bd0305ac500a9cd74db55a6

These APIs expose sensitive information via timing side channels. This
leaves access via the adb shell intact along with the current uses by
dumpstate, init and system_server.

The /proc/interrupts and /proc/stat files were covered in this paper:

https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/

The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are
also relevant.

Access to /proc has been greatly restricted since then, with untrusted
apps no longer having direct access to these, but stricter restrictions
beyond that would be quite useful.

Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd

am: 2b33112a

Change-Id: I08987ae7229ebbbbcf980be4aaef2eb8fb7e24da

boolean and setenforce macros are not used in base policy
and cannot be used in any policy, since they violate
neverallow rules.

Remove these from the policy.

Change-Id: Icc0780eaf06e95af36306031e1f615b05cb79869
Signed-off-by: William Roberts <william.c.roberts@intel.com>

am: 19b6485f

Change-Id: I0574ab7e70a8b3d906a5b11368239d58d1d64e70

With v4.8+ kernels, CAP_WAKE_ALARM is needed to set
alarmtimers via timerfd (this change is likely to be
backported to stable as well).

However, with selinux enabled, we also need to allow
the capability on the system_server so this enables it.

Change-Id: I7cd64d587906f3fbc8a129d48a4db07373c74c7e
Signed-off-by: John Stultz <john.stultz@linaro.org>

am: aa2aa219

Change-Id: I5e1634a8c0cee6cb759e0acea086b68dbd21fb7e

Applications should not access /dev/input/* for events, but
rather use events handled via the activity mechanism.

Change-Id: I0182b6be1b7c69d96e4366ba59f14cee67be4beb
Signed-off-by: William Roberts <william.c.roberts@intel.com>

Bug: http://b/30317429
Change-Id: I5c499c48d5e321ebdf588a162d29e949935ad8ee
Test: adb shell dmesg | grep ueventd

am: 362d6ff1

Change-Id: Ibe19ac1955bad48b5fa1db7ffada46aa78781781

Change-Id: I87b6797cd2bc9efafe2590e1f69d5787de99af07

Change-Id: Ia938d73b1a49b9ba4acf906df37095d21edee22e

Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff
Bug: 19160983

am: 23d703ee

Change-Id: I98383d496812ced491a892c1ffb29527d77c63a9

Bug: 30156807
Change-Id: Ie9faf72d35579fa69b4397bdffc8d674f040736c

Change-Id: Ic549f8c8060a17981302f2af75debf34595475bb

* changes:
  adbd: allow reading apk_data_file
  adbd: allow reading rootfs dir

avc: denied { search } for comm=73657276696365203139 name="app" dev="sda35" ino=770049 scontext=u:r:adbd:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir permissive=0

Bug: 30000600
Change-Id: I86958ebcca815ee1779f85fb425592493f40101a

Bug: 30213958
Change-Id: I0449575a5ec6cc4997bc36a13676474505a4190f

am: afad0c35

Change-Id: Id4a4937cc3b7c2ddd6d363144e6fafc90be60498

am: ee69a2e7

Change-Id: If61f5720180243ec1b5aa9e16d66c95c37f49b88

am: 83348b0b

Change-Id: Ia19aeffe64e733deb695206dcbd8cb824c9db222

untrusted_app lost all of the domain_deprecated permissions in N,
including the ability to read asec_apk_file dirs.  This is used for
forward locked apps.

Addresses the following denials:
avc: denied { search } for name="asec" dev="tmpfs" ino=9298 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:asec_apk_file:s0 tclass=dir permissive=0
avc: denied { getattr } for path="/mnt/asec" dev="tmpfs" ino=9298 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:asec_apk_file:s0 tclass=dir permissive=0

(cherry-pick of internal commit: addd3c9f)

Bug: 30082229
Change-Id: I87758f1daee19197d9299bca261f0324e01af5e0

am: 87f2ca2d

Change-Id: Ia0ebfddad770c09ded5fecd2273f78d560507e9f

am: ad03e7db

Change-Id: I1fa0ced9c61bacc1b577ccee9c5a47459066d45f

Change-Id: I874557582d244956a5a7a4305c00ac2f0c190a88

Bug: 28936216
Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5

Since there is "write /proc/sys/vm/overcommit_memory 1" line in init.rc

Change-Id: I5899d2802e7fa56b438a06d4cadb4eb6827bfe16
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>

Strip whitespace and comments from service_context files
to reduce size. On an aosp_x86_64 build it saves 36 bytes.

However, on builds with more synclines and comments, further
space savings can be realized.

Change-Id: I3cb4effad1d1b404bf53605a3793e3070cb95651
Signed-off-by: William Roberts <william.c.roberts@intel.com>

Strip whitespace and comments from property_context files
to reduce size. On an aosp_x86_64 build it saves 851 bytes.

However, on builds with more synclines and comments, further
space savings can be realized.

Change-Id: I43caf1deaab53d4753c835918898c8982f477ef0
Signed-off-by: William Roberts <william.c.roberts@intel.com>