am: b3bdba4d

Change-Id: I4d3a71a1ffd2004e3ac85d89686d24e00c112d6e

am: 78c58c79

Change-Id: I93ab700661ddad141f2ff9973187bb5b72ffad78

am: 5c383688

Change-Id: Iaf28a1b178427e5b2bd13f45485cc3504464f6fc

am: 77fe1de7

Change-Id: I71b4bca350a9a29dd45dfafe8c3d1938cb54a46f

am: b236eb6c

Change-Id: I87eb8bad11fc9c011289b8d97219835a08d18cd1

am: b236eb6c

Change-Id: I60a92781a5b923889e627d73e8922aca2607b67b

[    7.674739] selinux: selinux_android_file_context: Error getting
file context handle (No such file or directory)

Bug: 62564629
Test: build and flash marlin. Successfully switch between regular
    and recovery modes

Change-Id: I0f871f8842d95322c844fb7b13ad1b4b42578e35

commit: 5c6a227e added the oc-dev
sepolicy prebuilts (api 26.0), but did not include the corresponding
base mapping file, which is to be maintained along with current
platform development in order to ensure backwards compatibility.

Bug: 37896931
Test: none, this just copies the old mapping file to prebuilts.
Change-Id: Ia5c36ddab036352845878178fa9c6a9d649d238f

Allow lmkd to access /dev/memcg once again.

Test: lmkd can access memcg
bug 36588803

Change-Id: Ia57dbbc3987d8858c932103c4e546cbb88893207

am: ef0ab603

Change-Id: I0c55b9a8301f6b0264ccf578258422995a0c8b84

am: 508921c4

Change-Id: I86ff1c1cd66a6d3e7955436923f25e47c1098a01

am: aee782ca

Change-Id: I9210f221529abc0195dc39d198b042d02ca223ab

am: 82658116

Change-Id: I653ab6e4d8ff7a859ac489d4b05fdddb0668ae4e

am: 7a68c5ae

Change-Id: Ic9f658984340b255114bb0f8d505fa6774f1cb04

am: 7a68c5ae

Change-Id: Ide9c5ccdc2002972f311c9829c573b98f12fea44

am: 2703f3ee

Change-Id: I2130641f315522740c150f4a22f8a4fe20a9a085

am: f965a0a1

Change-Id: I444ffb0b0e03fc718acbf6a82bac1501fa725c5f

A previous commit (a83e0cc) already labels these with genfs_context,
which has better performance.

Bug: 62413700
Test: Built, flashed, and booted.  Verified that the files have
the correct context.

Change-Id: I464b0df30fabfc5f1c7cd7430e53e8d04bfacb53

This change is primarily to fix CTS which checks file ordering of
file_contexts. Having two separate means of loading file_contexts
has resulted in ordering variations.

Previously the binary file_contexts was preferred since it
loaded faster. However with the move to libpcre2, there is no
difference in loading time between text and binary file_contexts.
This leaves us with build system complexity with no benefit.
Thus removing this unnecessary difference between devices.

Bug: 38502071
Test: build and boot non-Treble Bullhead, run CTS tests below
Test: build and boot Treble Marlin, run CTS tests below
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testAospFileContexts
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testValidFileContexts
Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1

This change is primarily to fix CTS which checks file ordering of
file_contexts. Having two separate means of loading file_contexts
has resulted in ordering variations.

Previously the binary file_contexts was preferred since it
loaded faster. However with the move to libpcre2, there is no
difference in loading time between text and binary file_contexts.
This leaves us with build system complexity with no benefit.
Thus removing this unnecessary difference between devices.

Bug: 38502071
Test: build and boot non-Treble Bullhead, run CTS tests below
Test: build and boot Treble Marlin, run CTS tests below
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testAospFileContexts
Test: cts-tradefed run singleCommand cts --skip-device-info \
    --skip-preconditions --skip-connectivity-check --abi arm64-v8a \
    --module CtsSecurityHostTestCases \
    -t android.security.cts.SELinuxHostTest#testValidFileContexts
Change-Id: I088b3aeafaaab320f6658feb058a1fb89cbb65e1

am: d782dffa

Change-Id: Ia96da46def754c3a8fcc909d3e3823db2ce77c3b

am: 6aa9869a

Change-Id: I5ee6145cfa3c6701450f2984eacdde41ccd505ec

These permissions are granted to domain. Remove audit statements
for them in domain deprecated.

avc: granted { search } for pid=905 comm="update_engine" name="/"
dev="cgroup" ino=1 scontext=u:r:update_engine:s0
tcontext=u:object_r:cgroup:s0 tclass=dir duplicate messages suppressed
avc: granted { open } for pid=905 comm="update_engine"
path="/dev/cpuset/foreground/tasks" dev="cgroup" ino=25
scontext=u:r:update_engine:s0 tcontext=u:object_r:cgroup:s0 tclass=file

Test: build and boot Marlin
Change-Id: Ib2a61e5f5476ff761d0e5ecde57ba7a1777a73e9

am: 47609809

Change-Id: I4a294fc077f665ac3b43f0b7421d7eb30c9a8bb9

am: 96c619c8

Change-Id: Ib2d0ad551b0a8c4e3bf8529dd89fb8f563e5b651

This reverts commit 50889ce0.

Bug: 62427402
Test: Build and boot.
Change-Id: I32eae7997c901981d3228b61f33322a7c2c84301

Revert "SELinux policy for secure persistent netd storage" am: 06486796 am: edcfb2e1 am: 0f52004b
am: 722583fb

Change-Id: I5b13461ca05c04a2082689b7301f3d1b850d0933

am: 0f52004b

Change-Id: I5df1b7411cc87c6b983d80d716d9ec05f1ba9339

am: edcfb2e1

Change-Id: I86565448fa4d5ccd412772825decb5dc62cd6343

am: 06486796

Change-Id: Ia575329a0d4e83ff0d3a70b30ad3ef7e026c42f1

This broke the build on master. See b/17613910#comment17
for details.

This reverts commit ef1fd98b.

Change-Id: I11f7d463061a9b6340c11827135586266e26f016

am: d6da377a

Change-Id: Id608af3667c5ba9e60dd4630f9b718bc84ff96d0

am: 36efd0c4

Change-Id: I31b2eda5c305723b1f35ce2ba284e6593ac891b6

am: 9381cb3d

Change-Id: I3ae9005ee76b51105ec215cefc5a81c25405c482