am: 84674b7e

Change-Id: I17c3df373607889b0ce1fa9cbda16346298e3ca9

am: 705a3d0b

Change-Id: I3b934fc0fb674051c8227b2a6f405e454ff9fa42

am: ec9209be

Change-Id: I4162ad407b058de775089b003f6a9227db379154

am: 7c3dbfeb

Change-Id: I5480d47059b876ceffdf029ea14f6480516b43ef

am: 0f7e68bf

Change-Id: I9120edc34036ab7f347d0ae27d99dc62aebab5c5

am: cfcffa9a

Change-Id: I5979d4ea8a54944a7762cee2db04a078d0bd66bd

am: 6d2e29c1

Change-Id: I130f42e045695b3c08d25f4ba287a35c4687d8c1

am: ea26683e  -s ours

Change-Id: Id2a557022bfee400839784f2ae8623cea53fced9

am: 37792cec

Change-Id: I469f6de852f10515148ef824c85ff2febf31322e

am: 82071b68

Change-Id: Ia3bd034033f82aaed63b173e5205e7449e2743ef

* changes:
  sepolicy: relabel /vendor
  Sepolicy: Add ASAN-Extract

am: 73747426

Change-Id: I6520c8c1c89ce0ce6c6165822e63c672290c9ad0

am: ca7c99ed

Change-Id: I01ebaeb50ce10a1114ffc9a30999640bc86ff368

am: 516c9abf

Change-Id: I59f1abcdb1f7184fc795c2164a5799e7ff7f4772

am: 63a93156

Change-Id: I26a67ce475de966ec979cf4dfddd8b3210802552

* changes:
  Add IpSecService SEPolicy
  Update Common NetD SEPolicy to allow Netlink XFRM

The CL splits /vendor labeling from /system. Which was allowing all
processes read, execute access to /vendor.

Following directories will remain world readable
 /vendor/etc
 /vendor/lib(64)/hw/

Following are currently world readable but their scope
will be minimized to platform processes that require access
 /vendor/app
 /vendor/framework/
 /vendor/overlay

Files labelled with 'same_process_hal_file' are allowed to be
read + executed from by the world. This is for Same process HALs and
their dependencies.

Bug: 36527360
Bug: 36832490
Bug: 36681210
Bug: 36680116
Bug: 36690845
Bug: 36697328
Bug: 36696623
Bug: 36806861
Bug: 36656392
Bug: 36696623
Bug: 36792803

All of the tests were done on sailfish, angler, bullhead, dragon
Test: Boot and connect to wifi
Test: Run chrome and load websites, play video in youtube, load maps w/
      current location, take pictures and record video in camera,
      playback recorded video.
Test: Connect to BT headset and ensure BT audio playback works.
Test: OTA sideload using recovery
Test: CTS SELinuxHostTest pass

Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029
Signed-off-by: Sandeep Patil <sspatil@google.com>

Add selinux policies for init script and shell script to unzip a tar
containing ASAN libraries on boot.

Bug: 36458146
Test: m && m SANITIZE_TARGET=address
Test: manual (build steps for tar missing)
Change-Id: I5c3cb233aae93ee9985431090af902b0e3c1b0a7
(cherry picked from commit 0b743050)
Merged-In: I5c3cb233aae93ee9985431090af902b0e3c1b0a7

am: 67b66f99

Change-Id: I0bc8e8e3c29a312a7ac9d07154aaab0dc1965809

am: 6821bb40

Change-Id: I90f1ae5f671cbf7bcdcab728dd0bfac673f95050

Test: adbd_test (with and without adb root)
  Note: one test fails without root with and without this change
        because of an unrelated shell selinux denial.
Test: adb screencap, pull, and verify
Test: Android Studio screenshot
Bug: 36643190
Change-Id: Ib534240bc9bb3a1f32b8865ca66db988902a0f4a

am: a2bc090b

Change-Id: I4e765f5c2adb3cc40253fde80f89bd40f02c53e4

am: 6f108fd8

Change-Id: I98a793c05260b9f469902c17375693ef7c68b238

am: 2b7497cb

Change-Id: I816467bfef3499d80b8561e8c02e4dd06d1e1f02

am: c0e6cb58

Change-Id: If2cc73c4f4b14fb46273b97aae151e735ccddaa0

Remove system_file:file { lock ioctl } from domain_deprecated. The only
domains triggering this were dex2oat and netd, which are fixed in this
change.

Addresses the following logspam similar to:

  avc: granted { lock } for comm="iptables"
  path="/system/etc/xtables.lock" dev="sda22" ino=3745
  scontext=u:r:netd:s0 tcontext=u:object_r:system_file:s0 tclass=file

  avc: granted { lock } for comm="dex2oat"
  path="/system/framework/arm/boot-okhttp.art" dev="dm-0" ino=1295
  scontext=u:r:dex2oat:s0 tcontext=u:object_r:system_file:s0 tclass=file

Test: device boots and no obvious problems.
Bug: 28760354
Bug: 36879751
Change-Id: Iac851c0e49a52ce4000fdfe16e68c17ff819693f

am: a8d690f8

Change-Id: I2c6b178f6f05f67f32fb1f47845ea5993ea3d638

am: ccbea503

Change-Id: I55fab2ec9b63c5d9393bd18d9c340030ee9f1cc5

This is used for wificond to check if it is allowed to dump logs.

Bug: 31336376
Test: compile, manual test
Change-Id: I8a1b681255398f9a1f2cf79fd0891e58283aa747

am: 56f8a1a7

Change-Id: I71034e92a0d9f982756611675b60eeacca5cd8ff

am: abaf415c

Change-Id: I89396424e62a09f8e111212b920fc0897b6a517e

am: 8e7b0763

Change-Id: I90e02a9387f4efa001454be7c4351e10c92ae7f9