am: a21b8b0e

Change-Id: I959ce59a098036326ebfc3244972519fd129f364

am: 29f273ce

Change-Id: I0dc5693bddd9574eb36ee4a711652b4130afdd8e

am: f89f35ec

Change-Id: I34301b22c7ee6e041326f37ffd398245672fe926

am: c3a9e7df

Change-Id: Ifcb4f63b7111252ee3a0deb58e6471b06df58587

am: 2afd3383

Change-Id: I8447d7aeefdfd314244c16c223b23219fd95bbc4

am: bab5872c

Change-Id: I0341e66bd3a8fcbddf9daf7da84187430b5747d6

am: 2ec492f1

Change-Id: I996307180bc21742c5039ab53a6d9764925916ad

am: 9337a4dd

Change-Id: Ib3273650207e0b64cdca1d6e0e3bbdf48d292a6b

Test: Test: make cts && \
      cts-tradefed run singleCommand cts --skip-device-info \
      --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
      --module CtsSecurityHostTestCases \
      -t android.security.cts.SELinuxHostTest#testNoExemptionsForBinderInVendorBan
      Fails as expected.
Bug: 36002573

Change-Id: I298c526789b25734d5f18666c64497e5d1e181d0

So we can limit vndservicemanager access to
just vndservice_contexts.

Bug: 36052864
Test: servicemanager,vndservicemanager work
Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188

am: 81e1c12f

Change-Id: I08fa8d70c193dfc2c8c79f41b546bbb564b3822f

am: 0c31c85a

Change-Id: I2e6c151eb6b3413054f52d0dea5ab93c91065319

am: 7e9f5352

Change-Id: Ib23d7b2edadfbc7d188d21d5142f28e7c19b45ac

am: a1c06508

Change-Id: I7e586b6bf9c22ab0380f9982889f0c8c86115df1

Bug: 36855921
Test: compile, wifi works with toggling
Change-Id: Ib0819a2d552472e482e192a69530441cfc2c0fd7

am: 888bc0bb

Change-Id: Ic14649c9ecba4879547300030717e2176ce8ca53

am: ed82acb9

Change-Id: I2c7dc59f0ea468fba1e34d38a55cc2e8e6cc3289

am: 3c0561b1

Change-Id: I05d63291a5e7af356e158483255ce1c5b73a1539

am: a299bc80

Change-Id: I94b99a1ace48fafeb47280d1d6764cac70fb9464

am: f9b6368a

Change-Id: I94973e72c33c15d0c856df05ec3a12f2490f170d

am: 814edf8c

Change-Id: I9a8cd19a081ab7731f8caf098e406d0af9ce9c48

Vendor and system components are only allowed to share files by
passing open FDs over HIDL. Ban all directory access and all file
accesses other than what can be applied to an open FD such as
ioctl/stat/read/write/append.

This commit asserts that core components marked with attribute
coredomain may only access core data types marked with attribute
core_data_file_type.

A temporary exemption is granted to domains that currently rely on
access.

(cherry picked from commit cd97e710)

Bug: 34980020
Test: build Marlin policy
Change-Id: I2f0442f2628fbac1f2f7aa5ddf2a13e16b2546cc

am: 99575587

Change-Id: Ifc2a968afc41bebeea83b2a8291661e8ea367219

am: 45f699c7

Change-Id: Ib868a803f480a3c756102e59d49275b6eb4e6372

am: 035a0424

Change-Id: I154a39ee1247c057fc7e9bc587da3e04a565f912

am: 386f9460

Change-Id: Ieba3686f331cfa1c3a0907bf15db188a19d3f140

Add selinux policies for init script and shell script to unzip a tar
containing ASAN libraries on boot.

Bug: 36458146
Test: m && m SANITIZE_TARGET=address
Test: manual (build steps for tar missing)
Change-Id: I5c3cb233aae93ee9985431090af902b0e3c1b0a7