am: 3aa7ca56

Change-Id: I964ce5b658d73b7ccfbc7b1d86ca11b1c7ad8459

This is a partial cherry pick of commit 6231b4d9
'Enforce per-app data protections for targetSdk 28+'.

Untrusted_app_27 remains unreachable, but it's existence
prevents future merge conflicts.

Bug: 63897054
Test: build/boot aosp_walleye-userdebug
Change-Id: I64b013874fe87b55f47e817a1279e76ecf86b7c0
Merged-In: I64b013874fe87b55f47e817a1279e76ecf86b7c0
(cherry picked from commit 6231b4d9)

am: 0d1e52a5

Change-Id: I82c95f1fa1494d6b380823c4fd4436081e62bea0

tagSocket() now results in netd performing these actions on behalf
of the calling process.

Remove direct access to:
/dev/xt_qtaguid
/proc/net/xt_qtaguid/ctrl

Bug: 68774956
Test: -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.AppSecurityTests
    -m CtsNativeNetTestCases
Test: stream youtube, browse chrome
Test: go/manual-ab-ota
Change-Id: I6a044f304c3ec4e7c6043aebeb1ae63c9c5a0beb

am: f22c062c

Change-Id: I1c1a4c68adb49113ef6b6ff95326de8cb2ce8e25

am: c8fe29ff

Change-Id: I70261798153c0151aa04f64064e58edb81e87805

am: a6d9d6b6

Change-Id: If482dd99535d544fa39e287ed5787aa156dcac56

Update for debugfs labeling changes.

Update for simpleperf behavior with stack traces (temp file).

Bug: 73175642
Test: m
Test: manual - run profiling, look for logs
Change-Id: Ie000a00ef56cc603f498d48d89001f566c03b661

A default value of persist.sys.sf.native_mode could be set by SoC
partners in some devices including some pixels.
So it should have vendor_init_settable accessibility.

Bug: 74266614
Test: succeeded building and tested with a pixel device with
PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE=true.

Change-Id: I5d7a029f82505983d21dc722541fb55761a8714d

This reverts commit 942500b9.

Bug: 75287236
Test: boot a device
Change-Id: If81a2d2a46979ffbd536bb95528c3b4ebe3483df

am: 8b11302e

Change-Id: Iaed05ea224d163f69047ef9ffd4053e2abe03e6f

am: 855c6c16

Change-Id: I0da863030a919dbd4f6f9591edc0f74d88357b02

Test: manually tested to prevent sepolicy violation
Change-Id: I9ebcc86464a9fc61a49d5c9be40f19f3523b6785

am: 4fb1a145

Change-Id: Idc53868180280f2710d75dacb42918f6e27599a7

am: 8cafb58a

Change-Id: Iedffb50a6cdbc0fd84169f15e0fddb19b476aeff

Bug: 73354384
Test: manual
Change-Id: Iaaeded69c287eae757aaf68dc18bc5a0c53b94e6

am: 9fcf22bb

Change-Id: Ic61e460916a6bd07c117367d240e8883f4ca1fa2

am: 4b625e4a

Change-Id: Iee12d5e7573c0681b4adba682085ceb3cc26e0ee

See also go/perfetto-io-tracing-security.

* Grant CAP_DAC_READ_SEARCH to traced_probes.
* Allow traced_probes to list selected labels.
* Change ext4 and f2fs events to be available on user builds.

Bug: 74584014
Change-Id: I891a0209be981d760a828a69e4831e238248ebad

This will test that system/sepolicy/{public/, private/} are identical to
prebuilts if PLATFORM_SEPOLICY_VERSION is not 10000.0.

Bug: 74622750
Test: build policy
Test: correctly catches divergence from prebuilts for frozen policies

Change-Id: I2fa14b672544a021c2d42ad5968dfbac21b72f6a

This allows init to write to it, which it does for atrace.

Bug: 72643420
Test: Boot two devices, observe no denials, test atrace.
Change-Id: I6810e5dcdfaff176bd944317e66d4fe612ccebed
(cherry picked from commit dce07413)

am: 242399a1

Change-Id: I62e7477947cb7e8f7210aaeb0740c969cadfa8d7

am: 9a76c280

Change-Id: I7a6b5de668d06fe709a0ae922623fcc76474de12

am: 2c36eb6d

Change-Id: If078058751c8a5f88a93012350a11159d8d6839b

am: 4bdefb59

Change-Id: I175b06b26a82859425a853d270d61dcf021b37dc

The netutils_wrapper is a process used by vendor code to update the
iptable rules on devices. When it update the rules for a specific chain.
The iptable module will reload the whole chain with the new rule. So
even the netutils_wrapper do not need to add any rules related to xt_bpf
module, it will still reloading the existing iptables rules about xt_bpf
module and need pass through the selinux check again when the rules are
reloading. So we have to grant it the permission to reuse the pinned
program in fs_bpf when it modifies the corresponding iptables chain so
the vendor module will not crash anymore.

Test: device boot and no more denials from netutils_wrapper
Bug: 72111305
Change-Id: I62bdfd922c8194c61b13e2855839aee3f1e349be

The kernel generates file creation audits when O_CREAT is passed even
if the file already exists - which it always does in the cgroup cases.

We add neverallow rules to prevent mistakenly allowing unnecessary
create access. We also suppress these denials, which just add noise to
the log, for the more common culprits.

Bug: 72643420
Bug: 74182216

Test: Ran build_policies.sh and checked failures were unrelated.
Test: Device still boots, denials gone.
Change-Id: I034b41ca70da1e73b81fe90090e656f4a3b542dc
(cherry picked from commit 92c149d0)

am: 2446a665

Change-Id: I54c7013a909ef4dd35a47c616f32679cdc77f31d

am: 9935362c

Change-Id: Id65a9b5932b3c076ffa8ec189efe5877b12663f4