am: 750d797b

Change-Id: I1e9de6697e2755da0b9f0ff11a799ad976ccd8a0

am: 7e380216

Change-Id: I7cbf52fd8cee1f5e40fa06f114abf294cb9c61f5

am: 28a896bf

Change-Id: I03d4d3dddf505125b09750f2b79b426edf06c158

am: a67411c9

Change-Id: If2ab59c09b2ccf444281fdf9003e36119eb7295f

Bluetooth is sometimes started from init.

Addresses the following compiler error:

  libsepol.report_failure: neverallow on line 489 of
  system/sepolicy/domain.te (or line 9149 of policy.conf) violated by
  allow init bluetooth:process { transition };
  libsepol.check_assertions: 1 neverallow failures occurred
  Error while expanding policy

Change-Id: I2bc1e15217892e1ba2a62c9683af0f3c0aa16b86

am: c55cf17a

Change-Id: I391b6da84ad3b390511a73f7b874e2de2c4399c1

am: eedacf83

Change-Id: I70ec1b35449727df62817f482c8199e5a58716aa

Bug: 28746284
Change-Id: Ib5e294402c549d8ed6764722220484c5655951a9

Apparently some manufacturers sign APKs with the platform key
which use renderscript. Renderscript works by compiling the
.so file, and placing it in the app's home directory, where the
app loads the content.

Drop platform_app from the neverallow restriction to allow partners
to add rules allowing /data execute for this class of apps.

We should revisit this in the future after we have a better
solution for apps which use renderscript.

Bug: 29857189
Change-Id: I058a802ad5eb2a67e657b6d759a3ef4e21cbb8cc

Previously appdomains allowed to execute off of /data
where whitelisted. This had the unfortunate side effect of
disallowing the creation of device specific app domains
with fewer permissions than untrusted_app. Instead grant
all apps a neverallow exemption and blacklist specific app
domains that should still abide by the restriction.

This allows devices to add new app domains that need
/data execute permission without conflicting with this rule.

Bug: 26906711

(cherry picked from commit c5266df9)

Change-Id: I4adb58e8c8b35122d6295db58cedaa355cdd3924

Ports check_seapp to pcre2.

Change-Id: If3faac5b911765a66eab074f7da2511624c3fc97

am: a7d5e610

Change-Id: I482b66f4a53034a16f7a943d105f73b7b07c07b0

am: a15ea578  -s ours

Change-Id: I8acaaf29d6cd06291c45f3a1fb2e246718543922

Ports check_seapp to pcre2.

Merged-In: Ib9977326cfbb19ce143b04504f41afb884f2ec17
Bug: 24091652
Change-Id: Ib9977326cfbb19ce143b04504f41afb884f2ec17

am: a54911b6

Change-Id: I694d22230efe31c8b05374311cbe479b06c062fb

am: c3774720

Change-Id: I7ffbc6c1d4213fe68c52ded884bd9db9f6b37fb1

Specifically we need init to relabel (/dev/device-mapper, /dev/block/dm-?)
and other files in /dev/block/* from tmpfs to dm_device and block_device
respectively.

BUG=27805372

Change-Id: I16af6e803f8e4150481137aba24d5406872f9c62

am: 9cb9c4bd

Change-Id: I1b8dc30e19617d9081219d38e417c4157dd88be1

am: 89a8ed4e

Change-Id: I3733a74a23b3ece3a38fa2d7a2b3ea996f95c87f

am: b70abb6e

Change-Id: I1b1fed22276faec32759d9b705fce60caa093d20

am: c0937b6e

Change-Id: I06890bb6755d084f37bf6fb6564e4e1abeac8c06

Bug: http://b/30699558
Change-Id: Id9b213967ab290f45d1b8a5ab6712845ac9a0b69
Merged-In: Id9b213967ab290f45d1b8a5ab6712845ac9a0b69

am: c2e2b4e0

Change-Id: I6a20e6985ae53875765710207c553ebbea4347e3

Change-Id: I21dbd14d4e1bd89619e6fff91a85ed3fba02c324

The recovery flow for A/B devices allows to sideload an OTA downloaded
to a desktop and apply from recovery. This patch allows the "recovery"
context to perform all the operations required to apply an update as
update_engine would do in the background. These rules are now extracted
into a new attributte called update_engine_common shared between
recovery and update_engine.

Bug: 27178350
Change-Id: I97b301cb2c039fb002e8ebfb23c3599463ced03a

am: 8ba28103

Change-Id: I0f6d2305b824a9793faaab75e92715172fc30880

Change-Id: I2593e100bdad420d0d988fbaeb8d2ec259b8df1d

Change-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f

am: 5e6aa65f

Change-Id: I0e9dbefe4f393b13662bf9a520c878de5f221397

Change-Id: I16706423534069f69bd0305ac500a9cd74db55a6

am: 98ff70cc

Change-Id: Ia8d1ee546acddb9b19827e6db9d6ce1d8d25411d

These APIs expose sensitive information via timing side channels. This
leaves access via the adb shell intact along with the current uses by
dumpstate, init and system_server.

The /proc/interrupts and /proc/stat files were covered in this paper:

https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/

The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are
also relevant.

Access to /proc has been greatly restricted since then, with untrusted
apps no longer having direct access to these, but stricter restrictions
beyond that would be quite useful.

Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd

am: 2b33112a

Change-Id: I08987ae7229ebbbbcf980be4aaef2eb8fb7e24da

boolean and setenforce macros are not used in base policy
and cannot be used in any policy, since they violate
neverallow rules.

Remove these from the policy.

Change-Id: Icc0780eaf06e95af36306031e1f615b05cb79869
Signed-off-by: William Roberts <william.c.roberts@intel.com>

am: e4025649

Change-Id: Ief8c1bb3927c2dca50459db8e71b330e0a58608e

am: 19b6485f

Change-Id: I0574ab7e70a8b3d906a5b11368239d58d1d64e70