am: 7bd0bde4

Change-Id: I6aa0562fdc8e0fb482c8c81fbb256f57dbe59387

am: 5984301a

Change-Id: I7e6c4733471f5954a16f991adddda3657844b47d

am: e3cec841

Change-Id: Iefd431374378a736aa8e3a2f37b25cf026b3998f

am: 248b6dc6

Change-Id: Ie2990b86b85fbe29565ca7957fbce6b6121abec1

Copy init's dontaudit for sysfs:dir write; to calm the below denials:

avc:  denied  { write } for  pid=542 comm="init" name="1da4000.ufshc" dev="sysfs" ino=21752 scontext=u:r:vendor_init:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=1
avc: denied { write } for pid=542 comm="init" name="1da4000.ufshc" dev="sysfs" ino=21752 scontext=u:r:vendor_init:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=1

Bug: 62875318
Test: use pixel + factory reset + vendor_init
Change-Id: I686b51c4f340b3565ea24f00516ebde846be7a89

This reverts commit d1cf3a40.

Reason for revert: It breaks CTS b/69309298 and other platform tests which read pm.dexopt properties.

Change-Id: I5c7cde041113e9c19bb23218edd99f699fcf4a06

am: aff4f750

Change-Id: I2c6b101769806b987114e6787ecc158329490791

am: aca97bcb

Change-Id: I5bb923eecb8fb757d31a8b612f85a49d69cefdab

am: a7c29d41

Change-Id: Ia29bb093294461bdea9b81bff3d208e16c49a36c

am: 07195bb6

Change-Id: I76d6dbcba064919a21264f961ba5e331452fce5f

am: ef4f4e9f

Change-Id: I6e267e3695d5625ba8fdec0cd5efdbb26b83a9b2

am: 81e03cb4

Change-Id: I8ea9c5c110e0be90bd05a83b3ca94a823e73e847

Bug: 65643247
Test: aosp_walleye-userdebug builds
Test: aosp_sailfish-userdebug builds
Change-Id: Iaebd368b84259783fbdc4778988bdb7ba0df300b

am: 5488d400

Change-Id: Iefdf4d16645dabba5c4b0e98155faaa3380eac4b

Fixes these denials:
avc:  denied  { read } for  pid=585 comm="charger" name="state"
dev="sysfs" ino=18844 scontext=u:r:charger:s0
tcontext=u:object_r:sysfs_power:s0 tclass=file permissive=1

avc:  denied  { open } for  pid=585 comm="charger"
path="/sys/power/state" dev="sysfs" ino=18844 scontext=u:r:charger:s0
tcontext=u:object_r:sysfs_power:s0 tclass=file permissive=1

Test: above denials not observed in charger mode.
Change-Id: I5660e63315fada7f24d6cfe2e0bd2b383b556670

am: 29fc85ee

Change-Id: I888a076a056c08491d1185478b04ffce64af7ff2

Change-Id: I8b2636b9b6a1f2e664abc90bd453dbbf2a9f7a05

avc: denied { search } for name="com.sf.activity" dev="sda35"
ino=1444147 scontext=u:r:crash_dump:s0:c512,c768
tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir
avc: denied { search } for comm="crash_dump64"
name="com.android.bluetooth" dev="sda13" ino=1442292
scontext=u:r:crash_dump:s0 tcontext=u:object_r:bluetooth_data_file:s0
tclass=dir
avc: denied { search } for comm="crash_dump64" name="overlay" dev="dm-1"
ino=938 scontext=u:r:crash_dump:s0
tcontext=u:object_r:vendor_overlay_file:s0 tclass=dir permissive=0

Bug: 68705274
Bug: 68319037
Test: build
Change-Id: I44075ac6bf6447d863373c97ba10eadf59d2d22f

There's a selinux denial for update_engine after go/aog/530462; the
denial is likely due to the setgid bit of the
update_engine_log_data_file.
Message:
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:4): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:5): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:4): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0
11-11 02:07:54.843   870   870 I auditd  : type=1400 audit(0.0:5): avc:
denied { fsetid } for comm="update_engine" capability=4
scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0
tclass=capability permissive=0

Bug: 69197466
Test: denial message gone on sailfish.
Change-Id: I0fdc285e4a4faa8dc37b4907484b3c79d4cc49cf

Change-Id: Icec8dfff5cff17cf1b557882db62b148a7218b98

am: ba87a9aa

Change-Id: I43873dab8be67bcf91eff7521f46f6bc5359793a

am: 7c662776

Change-Id: I20f956cd6cfbd198dc8e72fb7d3bfeadeb2f09d5

am: bdfb64cf

Change-Id: Ie064e4c1cc517aabc5a95147ca36d6edf6e6a494

am: 721b305e

Change-Id: I566f14f9938b9cbc0cfa0de4f3cae5e68abb0324

This restriction causes issues with dynamite.

Since untrusted_v2_app was about enforcing this constraint put installed
v2 applications back into the normal untrusted_app domain.

Bug: 64806320
Test: Manual test with app using dynamite module

(cherrypicked from commit fe836817)

Change-Id: I3abf3ade64aaf689039a515de642759dd39ae6f7

This reverts commit a61b99bb.

Reason for revert: breaks aosp_walleye-userdebug

Change-Id: I3246b8cac862b53fc76609df60b90149fbc8098d

am: 98827003

Change-Id: I6b117f659a1a2b7d890b8f771e6951b39f5100d2

am: 50524539

Change-Id: I62855d053041c07261ec641b7057e2fdffadd1c9

am: 4bf3b5e9

Change-Id: I3b40cbef5fe2920917fa60f34ef29e6d4d8d3a01

am: f5e53e0c

Change-Id: I6145175790865e685e522514d72e6ae9da72a8f8

am: a44f5b6d

Change-Id: I992a0c77c80725621449644d62a372c6b951ead7

am: c33b4355

Change-Id: If95fcf51c8e582a75e2ad68ab64e84bdf09a13ad