am: 20fa3aef

Change-Id: I3f031cdd2d9f44b1154156383b13e1681aeefc2c

am: fad50381

Change-Id: Id123c5b3b1a4a276137d128c2ab0f6ca693e9867

am: 35fd3212

Change-Id: I2f2fa16dc59bcd3f13ed9525a6f68bc87d26ab3b

am: 910e60c7

Change-Id: I10b076757792b33b75dc3a818495037c6ada0b49

Remove neverallow exemption allowing other processes to run in
the bluetooth app's selinux domain.

The bluetooth domain is intended to host the zygote spawned
bluetooth app. It is not intended to host other bluetooth related
processes. Please define new domains for these processes.

Test: build Marlin
Change-Id: I1fd3dd0fe85f73457d77b63a65b4307821cbd41c

am: 162319d0

Change-Id: Ifc803d7d645be1ec7bd1d34f05e821a522f797e2

am: 072f3865

Change-Id: Id583a952f22f4f70d9d9c27572ce0da692ec2688

am: 5684f61f

Change-Id: Ib0a65258afbe3828cd9d5e9921fc42893c729a5e

Allow the shell user to run tzdatacheck, which is required
to enable a new host side test.

This change also adds some additional checks to
tzdatacheck.te to ensure that OEMs opening up permissions
further don't accidentally create a security hole.

Bug: 31008728
Test: Ran CTS
Change-Id: I6ebfb467526b6b2ea08f891420eea24c81ed1e36

am: f8a18d47

Change-Id: Iba5fd78ab1d578878cde958b489c57959ac6a290

am: 4f1763ef

Change-Id: I33c0dcab70613c0f0a669d0443332f204b92d55b

am: 456fa279

Change-Id: I440a08708ee39cd1c9f69432ca63e3b256e4f189

am: 67f40ec5

Change-Id: I9e364dd0493d8262739d255b4652a27bc313ede4

Bug: 37504387
Test: aaudio example write_sine, needs MMAP support
Change-Id: I7fbd87ad4803e8edbde4ba79220cb5c0bd6e85a0
Signed-off-by: Phil Burk <philburk@google.com>

Bug: 37485771
Test: sideloaded OTA through recovery on sailfish

Change-Id: I98bb4e0e919db585131391f57545f1a9a0096701
Signed-off-by: Sandeep Patil <sspatil@google.com>

am: 5f22a4dd

Change-Id: I2e6160a22c850ddbf3fef6d1e3e6a82dcf18db89

am: 0b999249

Change-Id: I8ddae2a19e54d8dc896ea9efc1355019599ca4cb

The PackageManager now passes previous code paths to dex2oat as shared
libraries. dex2oat needs extra permissions in order to access and open
the oat files of these libraries (if they were compiled).

Part of a multi-project change.

Bug: 34169257
Test: cts-tradefed run singleCommand cts -d --module
CtsAppSecurityHostTestCases -t android.appsecurity.cts.SplitTests

(cherry-picked from commit 1103f963)

Change-Id: I3cf810ef5f4f4462f6082dc30d3a7b144dcce0d9

hal_client_domain no longer allows read dir permission, in order
to load .so from /system/lib, we have to add this permission ourselves.

bug: 37476803
Change-Id: I1711d158c2f4580f50ac244da10c489df003cc18

am: 24409c36

Change-Id: I213a2aaca2c4fe4e7b1eac0971b99517dab2bb6f

am: 70269b78

Change-Id: I9fb2b4fc6b5664ac90e922a1253445cc51b16462

am: 47061e59

Change-Id: I924bfbc908321e321ca464adf8017bd3e212450f

Permit mediaextractor its own file source for apk and ringtone files.

Previously we fall back to the mediaserver file source.
This does not affect behavior as the fallback works fine; however,
the log messages may cause confusion.

    [73402.683908] type=1400 audit(1491338955.878:121): avc: denied { read }
    for pid=18381 comm="generic"
    path="/data/system_de/0/ringtones/alarm_alert_cache" dev="sda35"
    ino=2490374 scontext=u:r:mediaextractor:s0
    tcontext=u:object_r:ringtone_file:s0 tclass=file permissive=0
    [73402.683932] type=1400 audit(1491338955.884:122): avc: denied { read }
    for pid=18383 comm="generic"
    path="/data/system_de/0/ringtones/ringtone_cache" dev="sda35"
    ino=2490376 scontext=u:r:mediaextractor:s0
    tcontext=u:object_r:ringtone_file:s0 tclass=file permissive=0

Test: Ringtone and CTS
Bug: 37500781

Change-Id: Ie6d8e6d2b7301d00957733f173aeebbe9d0d1998

am: 6c80fcba

Change-Id: Id265afd1eab295e5a3bd33b05e820e6eaa8fc6ff

Bug: 37476041
Test: make, pair and connect to HID device
Change-Id: Ic7e81382994769e3f3a91255dcf3624edeaf6bfd
(cherry picked from commit a61f7f60)

am: a8af61f0

Change-Id: I9c49e79fd976c9c4bf37d79102d22d1e4c350a40

am: ae709241

Change-Id: Ia52cb0d049a82b2ce682243ff1fbe90ebd0a4614

am: a61f7f60

Change-Id: I5a0ff1b9233deb5ab7a6f4eb63498bbbefc169b3

am: ec470829

Change-Id: Ic6f08b67da93f015e9561c52311e0b1c3b610446

Bug: 37476041
Test: make, pair and connect to HID device
Change-Id: Ic7e81382994769e3f3a91255dcf3624edeaf6bfd