am: 07195bb6

Change-Id: I76d6dbcba064919a21264f961ba5e331452fce5f

am: 81e03cb4

Change-Id: I8ea9c5c110e0be90bd05a83b3ca94a823e73e847

Fixes these denials:
avc:  denied  { read } for  pid=585 comm="charger" name="state"
dev="sysfs" ino=18844 scontext=u:r:charger:s0
tcontext=u:object_r:sysfs_power:s0 tclass=file permissive=1

avc:  denied  { open } for  pid=585 comm="charger"
path="/sys/power/state" dev="sysfs" ino=18844 scontext=u:r:charger:s0
tcontext=u:object_r:sysfs_power:s0 tclass=file permissive=1

Test: above denials not observed in charger mode.
Change-Id: I5660e63315fada7f24d6cfe2e0bd2b383b556670

am: 29fc85ee

Change-Id: I888a076a056c08491d1185478b04ffce64af7ff2

avc: denied { search } for name="com.sf.activity" dev="sda35"
ino=1444147 scontext=u:r:crash_dump:s0:c512,c768
tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir
avc: denied { search } for comm="crash_dump64"
name="com.android.bluetooth" dev="sda13" ino=1442292
scontext=u:r:crash_dump:s0 tcontext=u:object_r:bluetooth_data_file:s0
tclass=dir
avc: denied { search } for comm="crash_dump64" name="overlay" dev="dm-1"
ino=938 scontext=u:r:crash_dump:s0
tcontext=u:object_r:vendor_overlay_file:s0 tclass=dir permissive=0

Bug: 68705274
Bug: 68319037
Test: build
Change-Id: I44075ac6bf6447d863373c97ba10eadf59d2d22f

There's a selinux denial for update_engine after go/aog/530462; the
denial is likely due to the setgid bit of the
update_engine_log_data_file.
Message:
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:4): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:5): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:4): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:5): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0

Bug: 69197466
Test: denial message gone on sailfish.
Change-Id: I0fdc285e4a4faa8dc37b4907484b3c79d4cc49cf

Change-Id: Icec8dfff5cff17cf1b557882db62b148a7218b98

am: 7c662776

Change-Id: I20f956cd6cfbd198dc8e72fb7d3bfeadeb2f09d5

am: 721b305e

Change-Id: I566f14f9938b9cbc0cfa0de4f3cae5e68abb0324

This restriction causes issues with dynamite.

Since untrusted_v2_app was about enforcing this constraint put installed
v2 applications back into the normal untrusted_app domain.

Bug: 64806320
Test: Manual test with app using dynamite module

(cherrypicked from commit fe836817)

Change-Id: I3abf3ade64aaf689039a515de642759dd39ae6f7

This reverts commit a61b99bb.

Reason for revert: breaks aosp_walleye-userdebug

Change-Id: I3246b8cac862b53fc76609df60b90149fbc8098d

am: 4bf3b5e9

Change-Id: I3b40cbef5fe2920917fa60f34ef29e6d4d8d3a01

am: f5e53e0c

Change-Id: I6145175790865e685e522514d72e6ae9da72a8f8

am: c33b4355

Change-Id: If95fcf51c8e582a75e2ad68ab64e84bdf09a13ad

am: a228505a

Change-Id: I8707e63a45a5a3941d2360d233cf1d5b8f2e5683

Bug: 65643247
Test: walleye-userdebug builds
Change-Id: I12d8239ca85bb68eab76a2d0001a722fea3045c5

These denials should not be allowed. Adding a bug number to the
denial properly attributes them to a bug.

Bug: 69197466
avc: denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability

Bug: 62140539
avc: denied { open }
path="/data/system_de/0/spblob/17a358cf8dff62ea.weaver"
scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0
tclass=file
avc: denied { unlink } for name="17a358cf8dff62ea.weaver"
scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0
tclass=file

Bug: 69175449
avc: denied { read } for name="pipe-max-size" dev="proc"
scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file

Test: build
Change-Id: I62dc26a9076ab90ea4d4ce1f22e9b195f33ade16

HALs are supposed to only access /data/vendor/*

Test: Camera CTS/ITS on walleye
Bug: 36601397
Change-Id: I8f586938127b5a9acaace4d5b8c3fc42ab13e0cf
(cherry picked from commit d7241d62)

am: 07ff6107

Change-Id: Ibed551e4ee539326d87fcd38ed5a0641f49a238f

am: 185941aa

Change-Id: Ib52fb4ba1d269f7bb10bac5c9ab6caef1b59e3cd

PRODUCT_FULL_TREBLE is being broken up into smaller,
more manageable components.

Bug: 62019611
Test: manual
Change-Id: I9b65f120851d9ea134a0059a417f0282777717fc

am: aa93dad6

Change-Id: I341b2a69e99c01242cbed24adfc5f51dd7ef78b5

Since all qtaguid related userspace implementation are moved into netd
and will use netd to choose which module to run at run time. Netd module
should be the only process can directly read/write to the ctrl file of
qtaguid located at /proc/net/xt_qtaguid/ctrl. This sepolicy change grant
netd the privilege to access qtaguid proc files. It also grant netd the
permission to control trigger to turn on and off qtaguid module by write
parameters to files under sys_fs. The file and directory related is
properly labled.

Bug: 68774956
Bug: 30950746
Test: qtaguid function still working after the native function is
redirected.

Change-Id: Ia6db6f16ecbf8c58f631c79c9b4893ecf2cc607b

Add label update_engine_log_data_file for log files created by
update engine in directory /data/misc/update_engine_log.

Bug: 65568605
Test: manual
Change-Id: I379db82a0ea540e41cb3b8e03f93d9ce64fac7c9

* changes:
  init: label /proc dependencies and remove access to proc
  init: refactor access to proc_* labels.

am: 182dbeb6

Change-Id: I451582dd6b1a0f6b565132b87b37fbdacc7ea32a

avc: denied { getattr } for comm="sAsyncHandlerTh"
path="/data/cache/recovery" dev="sda13" ino=7086082
scontext=u:r:mediaprovider:s0:c512,c768
tcontext=u:object_r:cache_recovery_file:s0 tclass=dir
avc: denied { getattr } for path="/data/cache/backup"
scontext=u:r:mediaprovider:s0:c512,c768
tcontext=u:object_r:cache_private_backup_file:s0 tclass=dir

Bug: 63038506
Bug: 35197529
Test: build police
Change-Id: I51624c255e622bf712d41ca1bbf190ec3e4fefae
(cherry picked from commit fcf1b2083935bd298a2ece8d6d0c18712865a04b)

am: 63f46773

Change-Id: I3ff43e1f579654b41ad7132efda8f486e1091f5c

Vendor apps may only use servicemanager provided services
marked as app_api_service. surfaceflinger_service should be
available to vendor apps, so add this attribute and clean up
duplicate grants.

Addresses:
avc:  denied  { find } scontext=u:r:qtelephony:s0
tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
avc:  denied  { find } scontext=u:r:ssr_detector:s0
tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
avc:  denied  { find } scontext=u:r:qcneservice:s0
tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager

Bug: 69064190
Test: build
Change-Id: I00fcf43b0a8bde232709aac1040a5d7f4792fa0f

am: b43a1c84

Change-Id: I693dbe61b33633a31fda4e75b3abba69820ac2d4