This is a necessary for enforcing these tests in CTS.

Bug: 37008075
Test: build
Change-Id: I36b4ce71c26a0ba01cd0289fe363f0a9f7db1214

This reverts commit 0b4edc4e.

Bug: 66912095
Test: build

This is a necessary for enforcing these tests in CTS.

Bug: 37008075
Test: build
Change-Id: If6c045270d2a4e17f20bf59cc86ac074479346b3

It's already included in srcs for treble_sepolicy_tests.

Bug: 65263013
Test: build
Change-Id: I208ec6a864127a059fb389417a9c6b259d7474cb

Fixes: 65263013
Test: build
Change-Id: I0ec412481c5990927fcbee7c4303bee2da876210

Selinux: Give runas permission to read system_data_file links am: 4481b885 am: 16efc04d am: e9354cda
am: a28ad688

Change-Id: Ib55ee766b488ce1b73f7fc6b04111ace0c5000ba

am: e9354cda

Change-Id: I330100bace90ebf5c4859c6577bf43ede1185b59

am: 16efc04d

Change-Id: I9615973f5b9eef7810c3cfb5469bd3ce8797c939

am: 4481b885

Change-Id: I3763d7f5ce22ff43e2adb8f7125e789f2c061e9e

Run-as is running a command under an app's uid and in its data
directory. That data directory may be accessed through a symlink
from /data/user. So give runas rights to read such a symlink.

Bug: 66292688
Test: manual
Test: CTS JVMTI tests
Change-Id: I0e0a40d11bc00d3ec1eee561b6223732a0d2eeb6

proc files needed by fwk that were labeled:
/proc/filesystems -> proc_filesystems
/proc/mounts -> proc_mounts
/proc/swaps -> proc_mounts

Removed access to proc label from these domains:
e2fs, fsck, fsck_untrusted, sdcardd

e2fs: added access to proc_filesystems, proc_mounts, proc_swaps
fsck: added access to proc_mounts, proc_swaps
fsck_untrusted: added access to proc_mounts
sdcardd: added access to proc_filesystems
vold: added access to proc_filesystems, proc_mounts

Bug: 66199084
Test: device boots without selinux denials to new labels or proc label.
Change-Id: If0f19e22074419dab0b3a0c6f3a300ea8cb94523

Bug: b/64090883
Bug: b/33073713
Test: Manual
Change-Id: I7aa23c31b1fccae56c1a0e0bd4cfe370aeb911dd

am: 59005d37

Change-Id: I04cb9566dd20d968ea16a79ae7241009068822c9

am: dfea667d

Change-Id: Ic835bf45ab8a2334bdeec6540678d73dddfffa6d

am: dfdb9628

Change-Id: I2abe6f86bbb099e044fa49074fa28260c3e5f8ba

am: 3b24ce50

Change-Id: Ibfe45f0105811e120f4e83a52f3ba8e4d6b2fb10

Bug revert AOSP cherry-picks to enable big diff. am: 46f41134 am: bbd7ddaf am: 1373b2fe  -s ours
am: feef1427

Change-Id: I168f6e61a31b047a3f7a858edbcdbaefef30ff24

am: 1373b2fe  -s ours

Change-Id: I5f6baddfe13696b4cb088f5ede32032d86705727

am: bbd7ddaf

Change-Id: I60b634911abc7598141cbe4a3cd913b6ba832b5c

am: 46f41134

Change-Id: Idfb71caeb839cce156bfa181fa53339e2e791e4b

Labeled:
/proc/asound/cards -> proc_asound_cards
/proc/loadavg -> proc_loadavg
/proc/pagetypeinfo -> proc_pagetypeinfo
/proc/version -> proc_version
/proc/vmallocinfo -> proc_vmallocinfo

system_server: added access to all new types  and removed access to proc label.
init: added access to proc_version.
dumpstate: added access to proc_pagetypeinfo, proc_version,
proc_vmallocinfo.
hal_audio: added access to proc_asound_cards.
all_untrusted_apps: extended neverallow rule to include new labels.

Bug: 65980789
Test: device boots without selinux denials to the newly introduced
labels.
Test: "adb shell dumpstate" throws no violations to new labels.
Change-Id: Ic60facd3d4776e38d5e3ba003d06ada4e52c7dca

The following commits were cherry-picked from internal master to AOSP,
but to avoid merge-conflicts we'll do a large diff instead of individual
cherry-picks:
521742e9
9aefc916
3686efca
de51e7de
fff3fe2f

Bug: 37916906
Test: angler builds and boots.
Merged-In: Ie010cc12ae866dbb97c387471f433158d3b699f3
Change-Id: I5126ebe88b9c76a74690ecf95851d389cfc22d1f

Merge "Remove bootanim access to sysfs and cgroup label." am: 76d77fd5 am: 3b8163bf am: 164cb1af
am: dfc6f1bb

Change-Id: I80024cf1886a36d4f73bf285cb77ae68c0455ede

am: 164cb1af

Change-Id: I500845c5846a144942f1d331447f395f52d30aa0

am: 3b8163bf

Change-Id: I7399449691e69bdb9ce5d5fd16aa6cb45fd7da9e

am: 76d77fd5

Change-Id: I87ce89ce4642116264624288bf367a9ec3087034

am: c0e7f41f

Change-Id: I9dc5d4dfe7f8a4baf39a8d7a602137965531f968

am: cf79ab6c

Change-Id: I7248edaa6637001c059fb3b7627c5f8d6d6d739d

am: 29f2e953

Change-Id: Icdce6dc5026da58beee8f218008d09dd39878f39

am: b842836f

Change-Id: If6c0db7fb4838140347a68c39dec9f10b4c298d7

Bug: 65643247
Test: device boots without denials from bootanim to sysfs and cgroup.
Change-Id: Icf8c45906cb83e1b0a60737d67ae584b9d1b34aa

In order to bring AOSP development back in-line with master development,
some CLs were cherry-picked individually from internal master to AOSP,
which were then merged back into internal master (MERGED-IN was missing).
Due to merge-conflict pain, these are being reverted in favor of one
big diff.  This CL reverts the changes that were auto-merged in as a result,
and can be used as the target of MERGED-IN when reverting the individual
cherry-picks in AOSP.

This reverts commit a08fe91e, reversing
changes made to 11481d1d.

This reverts commit 7ec5ecfb, reversing
changes made to 6fecbbb2.

Bug: 37916906
Test: Builds 'n' boots.

Bug: 65643247
Test: device boots without denials from rild to proc.
Change-Id: I142a228347ef07266cb612e99c90fb5ec187988a