Merge cherrypicks of [4830548, 4830555, 4829713, 4830575, 4830576, 4829856, 4829857, 4829858, 4829859, 4830484, 4830595, 4830556, 4830557, 4830558, 4830559, 4830560, 4830561, 4830562, 4830563, 4829714, 4830551] into oc-mr1-iot-release

Change-Id: Ib39e589ccdc87cc818d87f0f1fae1a0223a9a74c

Remove permissions and add neverallow assertion.

Bug: 110107376
Test: kill -6 <components excluded from ptrace>
Change-Id: If8b9c932af03a551e40e786d591544ecdd4e5c98
Merged-In: If8b9c932af03a551e40e786d591544ecdd4e5c98
(cherry picked from commit f1554f1588eab05eca7eb7ccba41d5955a563837)
(cherry picked from commit f0e6a70ab554c8e9fc80aa0f4ff5833ddd90d61b)

Change-Id: I33b65b8cef46a25d889db6c5e9f85eb4ec7a2ec4

This permission is needed so that wpantund can enforce Android permissions.

Bug: b/69582511
Change-Id: If250c9edfff215e73072b0cd7ed8a597c475c586

Change-Id: I06817eb7922bd6378b8c3b276b7c31f6f03de4ea

am: fe836817

Change-Id: Icef06fedfa449877c1b2ebbea71a6b6569fc1577

This restriction causes issues with dynamite.

Since untrusted_v2_app was about enforcing this constraint put installed
v2 applications back into the normal untrusted_app domain.

Bug: 64806320
Test: Manual test with app using dynamite module

Change-Id: I3abf3ade64aaf689039a515de642759dd39ae6f7

Change-Id: Ife7bc4343ac7f88fb8631e1a6803f604c322bf16

Change-Id: I4f4c669d8b41aadcd31e5d97f3fda7fc380b9960

am: 67b2da44

Change-Id: Ie60e34e34cb091571f3e733c94a8e572d4c85e9b

Bug: 67848572
Test: mma
Change-Id: I75520b6aa19e44854129697b3c3e375427356e6a

Test: Builds and runs.
Change-Id: I6b8a73b8add2a402da2e7508606c41ee316f7539

Change-Id: I5e7c358ece3070f36fefaf30fd0dc14f9eef1268

This change allows wpantund to call any binder callbacks that have
been registered with it. Generally, only privileged apps are allowed
to register callbacks with wpantund, so we are limiting the scope for
callbacks to only privileged apps. We also add shell to allow the
command-line utility `lowpanctl` to work properly from `adb shell`.

Cherry-picked from commit 17319cb3.

Bug: b/67393078
Test: manual
Change-Id: I64c52cc5e202725a81230dc67e1cd7c911cf8e1c

Change-Id: Icd0329d733ecdd437f497dd9e84c19038db7c33d

am: 0ca69733

Change-Id: Ibdc77a53988ebf76d3786fff738ffadb577091c2

Change-Id: Idc94ca2258aebc7c001b79e13e61bc8da4e8e356

Addresses:
Warning!  Type or attribute hal_drm_server used in neverallow
undefined in policy being checked.

Bug: 67296580
Test: Build
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38
Change-Id: I07f9825536637a21a91c77e87366861503f6ebac

am: 03596f28

Change-Id: I5fe53ee3d82ea83b97bf9de91dfdae897df06445

This file is necessary for using an mr1 system image in conjunction
with an oc-dev vendor image.  This is currently needed by GSI testing,
for example.

Bug: 66358348
Test: File is included on system image.
Change-Id: I3a6b7ed5edf1c07941bbf835e70f2ae8d03fee25

release-request-1884541d-2ec2-444e-b6d7-f957c5507fbe-for-git_oc-mr1-iot-release-4364659 snap-temp-L75200000106831384

Change-Id: I23b31e860efc980860723fcc1a10990913e757f6

am: 8c8994f5

Change-Id: Ia25366a937ca35cd7b0ab4a8c1cfcdc6abd4d9ba

am: f8e09172

Change-Id: I911b1bfd9a2f1add2374acc9ee3159f0dbc165a8

type=1400 audit(0.0:6): avc: denied { read } for comm="Thread-5"
name="cache" dev="dm-0" ino=13 scontext=u:r:system_server:s0
tcontext=u:object_r:cache_file:s0 tclass=lnk_file permissive=0

Bug: 64067152
Bug: 65843095
Test: build
Change-Id: Ie90c0343a834aa87b7ded41f503e05d9b63b3244
(cherry picked from commit a4cada74)

release-request-4f6cb965-f793-476d-8f14-d0ae08308fb7-for-git_oc-mr1-iot-release-4362168 snap-temp-L66300000106450614

Change-Id: I4f214d52592ac78ec18b0f3a16156e5370794c4d

am: 6b8088ba

Change-Id: Id33c3e7f23b84fa10bad8c2ee7bf7c44265acc25

Particularly useful for suppressing selinux logspam for debug-only
permissions.

Bug: 65843095
Test: build, boot, and run tests on user and userdebug builds.
Change-Id: I18ce0b2cf1e96ca037e93309dddb476a150b677f

release-request-030039d5-8903-46d2-ba83-18bbd0db1bf6-for-git_oc-mr1-iot-release-4358977 snap-temp-L66100000106019344

Change-Id: I0d25d8a4b8bf2e00798fe975c9da557c2a9a7d19

It's used in CTS neverallow tests.

Addresses:
Warning!  Type or attribute hal_cas_server used in neverallow
undefined in policy being checked.

Bug: 66910049
Test: build
Change-Id: Ia185f266fc1e3cb87c39939fdd45d02efa6c2c94
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38

am: 5d8b059f

Change-Id: I511ddcdb2f8bec7b52985e25b0c9d4c8d763cf21

These are no longer necessary as domain_deprecated has been
removed in AOSP master.

Bug: 66749762
Test: build
Merged-In: I99953ecc7d275fdbe8e56d8f47a27d1f9e1cc09a
Change-Id: I01878a4410f8cb3c97ff96c67845dfaa7b0051ce

release-request-ff422c3c-f322-4fd6-8018-3005297c3ce9-for-git_oc-mr1-iot-release-4351313 snap-temp-L99900000104754319

Change-Id: I4a0f68ce004a2c292a45002604dbb19195195b66

Bug: b/64090883
Change-Id: I566a380db2f8f4d886252eee26181e37a4fb0d61

* changes:
  RESTRICT AUTOMERGE: lowpan: Add wpantund to SEPolicy
  RESTRICT AUTOMERGE: lowpan: Added support for LoWPAN Service and android.hardware.lowpan

Bug: b/64399219
Test: Manual
Change-Id: I4f6c7e4e3339ae95e43299bf364edff40d07c796