* changes:
  Merge changes from topic 'fix-neverallow-violation' into oc-dev am: 3692b318 am: 97a4c1c9
  radio: disalllow radio and rild socket for treble devices am: d3381cd9 am: 516d8555

am: 760674da

Change-Id: Ibf3d635255104966af4d0b3004cee8babeffc4f9

am: 97a4c1c9

Change-Id: I7397ec9386f7f2afdbd44186e2e81ecac1ac48b1

am: 516d8555

Change-Id: I30aae50a7e5f9d5c354fa9b459451b0f111d94de

am: 8aa283fe

Change-Id: I7593dd0f7f2888fb5b2aa5a20b258d3a370146fe

am: 3692b318

Change-Id: Ide1a5455e2b279ac1532bbdb88e852dba3ee2b28

am: 3692b318

Change-Id: I8affb6f117f842ebdf083ec24083e190dde0082a

am: d3381cd9

Change-Id: I33215b5c9d894823f3928742a8712ef42d803156

am: d3381cd9

Change-Id: Iaabe00cb6e919b4e35896c0d9ef1770aee3b2363

* changes:
  build: run neverallow checks on platform sepolicy
  radio: disalllow radio and rild socket for treble devices

am: 24d0cad3

Change-Id: Ieffac9d2e5ff8500534cf9935eff9918989c2fb4

am: 04306859

Change-Id: I3eb542cced980ce94425110d8dc8e58aeb122607

am: 2122f1fe

Change-Id: I05f0b28b9e6622477fe2fa4b041ea03c5744f82c

Merge "Add debug selinux permission to write saved_cmdlines_size. am: e9381d5e am: d651e0b7" into oc-dr1-dev-plus-aosp

am: e180a613

Change-Id: Iaa5b2f434ebf712884d5823caf87e93de317e14e

am: d651e0b7

Change-Id: I99c911d119c300e7035a111a24b0d900f435fca8

am: e9381d5e

Change-Id: I784011fc804dd43f431be62804761b100846dfbf

am: e9381d5e

Change-Id: Ic2192d5128543f28d2f91c4aedabab08b01669e5

Now that we're expected to use this when taking traces, we need to add
this permission so that Traceur can also access this file.

Test: Used Traceur and saw the traces appear in the bugreports
directory, as expected.
Bug: 62493544

Change-Id: Ib4304176abbb51e2e3b45c566ff14574e1cfaa82
Merged-In: I464b0df30fabfc5f1c7cd7430e53e8d04bfacb53
(this merged-in is not the same change; it's a conflicting change in
master)

This will prevent us from breaking our own neverallow rules
in the platform sepolicy regardless of vendor policy adding
exceptions to the neverallow rules using "*_violators" attributes

Bug: 62616897
Bug: 62343727

Test: Build policy for sailfish
Test: Build policy with radio to rild socket rule enabled for all
      and ensure the build fails

Change-Id: Ic66ec3e10c76a7c9a17669e0d3deb3a1c7b00809
Signed-off-by: Sandeep Patil <sspatil@google.com>

This violates the socket comms ban between coredomain (radio) and
non coredomain (rild) in the platform policy.

Bug: 62616897
Bug: 62343727

Test: Build and boot sailfish

Change-Id: I48303bbd8b6eb62c120a551d0f584b9733fc2d43
Signed-off-by: Sandeep Patil <sspatil@google.com>

am: 14a3cb28

Change-Id: Ib3b7dc9a8a702a32330ccb31f22cf746df8764fb

am: 5ee87b00

Change-Id: Id2dc995f88a60fe865387453234e3630a9975381

am: abb1ba65

Change-Id: I7765bfd350deb50847e83a1d3b5d7399206b4b9d

In libprocessgroup, we want to only send signals once to processes,
particularly for SIGTERM.  We must send the signal both to all
processes within a POSIX process group and a cgroup.  To ensure that
we do not duplicate the signals being sent, we check the processes in
the cgroup to see if they're in the POSIX process groups that we're
killing.  If they are, we skip sending a second signal.  This requires
getpgid permissions, hence this SELinux change.

avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:untrusted_app_25:s0:c512,c768 tclass=process permissive=1
avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:untrusted_app_25:s0:c512,c768 tclass=process permissive=1
avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:system_app:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:system_app:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:zygote:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:zygote:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:system_server:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:system_server:s0 tclass=process permissive=1

Bug: 37853905
Bug: 62418791
Test: Boot, kill zygote, reboot
Change-Id: Ib6c265dbaac8833c47145ae28fb6594ca8545570

am: 5c383688

Change-Id: Iaf28a1b178427e5b2bd13f45485cc3504464f6fc

am: 77fe1de7

Change-Id: I71b4bca350a9a29dd45dfafe8c3d1938cb54a46f

am: b236eb6c

Change-Id: I87eb8bad11fc9c011289b8d97219835a08d18cd1

am: b236eb6c

Change-Id: I60a92781a5b923889e627d73e8922aca2607b67b

[    7.674739] selinux: selinux_android_file_context: Error getting
file context handle (No such file or directory)

Bug: 62564629
Test: build and flash marlin. Successfully switch between regular
    and recovery modes

Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35

am: aee782ca

Change-Id: I9210f221529abc0195dc39d198b042d02ca223ab

am: 82658116

Change-Id: I653ab6e4d8ff7a859ac489d4b05fdddb0668ae4e

am: 7a68c5ae

Change-Id: Ic9f658984340b255114bb0f8d505fa6774f1cb04

am: 7a68c5ae

Change-Id: Ide9c5ccdc2002972f311c9829c573b98f12fea44

am: f965a0a1

Change-Id: I444ffb0b0e03fc718acbf6a82bac1501fa725c5f

This is used to persist RFC 7217 stable secrets across device reboots.

First submit caused a merge conflict. This revision replaces netd_prop
with a more unique name netd_stable_secret_prop.

Test: as follows
    - Manually tested that stable_secret is generated on first use and
      persists until reset of user data partition (factory reset).
    - Tested that "adb shell getprop" was denied access to
      persist.netd.stable_secret after running "adb unroot".
Bug: 17613910

Change-Id: I0a609c724799a15b1926e62534c16810d34f2275

This change is primarily to fix CTS which checks file ordering of
file_contexts. Having two separate means of loading file_contexts
has resulted in ordering variations.

Previously the binary file_contexts was preferred since it
loaded faster. However with the move to libpcre2, there is no
difference in loading time between text and binary file_contexts.
This leaves us with build system complexity with no benefit.
Thus removing this unnecessary difference between devices.

Bug: 38502071
Test: build and boot non-Treble Bullhead, run CTS tests below
Test: build and boot Treble Marlin, run CTS tests below
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testAospFileContexts
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testValidFileContexts
Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1

This change is primarily to fix CTS which checks file ordering of
file_contexts. Having two separate means of loading file_contexts
has resulted in ordering variations.

Previously the binary file_contexts was preferred since it
loaded faster. However with the move to libpcre2, there is no
difference in loading time between text and binary file_contexts.
This leaves us with build system complexity with no benefit.
Thus removing this unnecessary difference between devices.

Bug: 38502071
Test: build and boot non-Treble Bullhead, run CTS tests below
Test: build and boot Treble Marlin, run CTS tests below
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testAospFileContexts
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testValidFileContexts
Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1

am: 6aa9869a

Change-Id: I5ee6145cfa3c6701450f2984eacdde41ccd505ec