am: aa15c0af

Change-Id: I2472fae6dec8202842dc35d36eb03248256dcd45

am: 1c8e8e0e

Change-Id: I45c6a937eea4a110c0137d1e1573fe50fd71f4cd

Merge "Let fallback crash dumping write to dumpstate pipes." am: 4a608d31 am: 0bcb92a5 am: b1cf5ae4
am: cebd95b6

Change-Id: I9fb4ddebd9e9cecc08f2dab47b3e90018cd12b6d

am: b1cf5ae4

Change-Id: If2351db2a2f76837f7081fc052b03dfbae877cf4

am: 0bcb92a5

Change-Id: I86ba3626798b4f1afc49c767ad756c8a3b1f9e75

am: 4a608d31

Change-Id: I1ac7b6ddaa3f6c7ee88426cf5ec6e6dec7bc8767

Fix the following denial:
    avc: denied { append } for pid=1093 comm="mediaextractor" path="pipe:[68438]" dev="pipefs" ino=68438 scontext=u:r:mediaextractor:s0 tcontext=u:r:dumpstate:s0 tclass=fifo_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"

Bug: http://b/38444258
Test: none
Change-Id: I58162e3a28b744a58396e77d6b0e2becb5633d6a

am: 14e577fa

Change-Id: Ib759c17d736440a44f83f0af79b3db5bebd93d4f

am: c67fa9bf

Change-Id: Id47543705ea3f501fb26b2bf0af1e3a234c6dd71

Update SE Policy to allow calls to and callbacks for the Tether Offload HAL
HIDL binderized service.

Bug: 38417260
Test: New functionality. So we don't have any tests.
Change-Id: I2c95b290523c55c081afa1bca091f368559c9125
(cherry picked from commit 722249b3)

Update SE Policy to allow calls to and callbacks for the Tether Offload HAL
HIDL binderized service.

Bug: 38417260
Test: New functionality. So we don't have any tests.
Change-Id: I2c95b290523c55c081afa1bca091f368559c9125

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855 am: 9c87eb45
am: e190656f

Change-Id: I4a01a0807caf8b53c9caf426f2ad686414566ca8

am: a2c24197

Change-Id: I126a9e8f6015083515f2c85ac42f0c14f6c47f88

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855 am: 11cf0629
am: 9911fbd7

Change-Id: Id7421d9867030c0bbe1e9b57add37a6e3b1e1a02

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855
am: 9c87eb45

Change-Id: I6dace62c8033551536597e4d5bb0105b06508346

am: 69bb06e5

Change-Id: Ia87985dca88d3f5ebf8db51b7a27bc44e6090538

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855
am: 11cf0629

Change-Id: Ibc72bad82047986aea1cbb643463de64a1d2e9d3

am: ca7d90ca

Change-Id: Ibe4770026852338dcfde327857ccffb1fc91a5a0

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921
am: ed21f855

Change-Id: Iba0094323da99989b1abf4e7002facce9af20e39

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921
am: ed21f855

Change-Id: I629201783c38c41032960e633f2a9f53eeadf8b9

am: de5db3ab

Change-Id: If61aa850ab0f6060ec7a863cc0107f68f1db9400

am: 6b3ef921

Change-Id: Iefc3436c532f5f291345e3d01a1cbe175d69e619

am: 5ee08053

Change-Id: I530872c3d9a8ddf5a03353b27e75ea1043cd2ab2

am: dddbd2f3

Change-Id: I517d7bbd415e28d2ba7719f17c1ddcc7c28f20a0

am: 3d8dde0e

Change-Id: I19cb50ee62d217f025bb7fcf535257dac3b3610e

Commit https://android.googlesource.com/kernel/common/+/f0ce0eee added
CAP_SYS_RESOURCE as a capability check which would allow access to
sensitive /proc/PID files. However, in an SELinux based world, allowing
this access causes CAP_SYS_RESOURCE to duplicate what CAP_SYS_PTRACE
(without :process ptrace) already provides.

Use CAP_SYS_PTRACE instead of CAP_SYS_RESOURCE.

Test: Device boots, functionality remains identical, no sys_resource
denials from system_server.
Bug: 34951864
Bug: 38496951
Change-Id: I04d745b436ad75ee1ebecf0a61c6891858022e34
(cherry picked from commit 44866954)

Test: manual
Bug: 37014702
Change-Id: Id43dc7a8506fe60015c2f82242ba45cf85d3e74b

Test: Boot sailfish with shared system image
Bug: 36814984
Change-Id: I2937c20c3b6ca7bf4edab66a74742c48e76c7687

am: e8cd8fe7

Change-Id: I739f3edb772b497566f0ce3e83505ecdf97b02a7

am: 7eeded9e

Change-Id: I9fc8f229d3f03a3850819664a71edc8d418259d9

Enable writing of events/lowmemorykiller/enable.

Bug: 38457440
Test: Tested writability of flag via Traceur apk
Change-Id: Ic138062e9667aa66412388046dea37236a7efd49

Right now, the hwcomposer hidl hal is unable to figure out where
to get the hidl mapper implementation.

It is expected that all graphics composer objects will need this
permission. The interfaces are written to work together with the
"IMapper" being the same-process ("sphal") component and the
"IComposer" interface being the binderized compoenent.

10-09 00:24:38.900   457   457 E SELinux : avc:  denied  { find } for
interface=android.hardware.graphics.mapper::IMapper pid=495
scontext=u:r:hal_graphics_composer_default:s0
tcontext=u:object_r:hal_graphics_mapper_hwservice:s0 tclass=hwservice_manager

Test: boot marlin, denial no longer present.
Bug: 38415912
Change-Id: I1b274be10e115fa7b53fb81e85be8827da05997e

am: 84d81690

Change-Id: Ia1a35f5608169d6c54e27836dbadd75b8f6ec361

am: effa2dad

Change-Id: Ic21e6dcaaa0bbf13b6eb8f3fc82303b227d61d35