am: 7c4ecc87

Change-Id: Ic40b023f6f61a00026a56ae2c9d8faba38440129

am: 63203a01

Change-Id: I5beb026a80cf9c2c6613d77c1b798797aa10eeb5

bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5

am: 6269ecd0

Change-Id: Iad6cbe6b2215f125a7558e7618a82e3b97a44672

am: a3f6339a

Change-Id: I755afa8558556df83c18e87fea526f76e6fa249f

am: f247dcba

Change-Id: Ie24129d68ee32fe0178dd0fe4aea4208e72f050f

Bug: 28746284
Change-Id: I59aa235ecba05e22aaa531e387a77f47267ac9ae

am: bba39385

Change-Id: I88c59ac92116183242b475c6beeb2b7a3dba069b

am: aaa363cd

Change-Id: Ieb71a3d8c51fd33ee60213fad43824db18da59aa

am: 9b5b32c0

Change-Id: I5d8f73b32be174189a88e07c638af4daaa612cce

am: 750d797b

Change-Id: I1e9de6697e2755da0b9f0ff11a799ad976ccd8a0

fix build: exclude bluetooth from neverallow restriction am: 7e380216 am: a59830d9 am: ce84793b
am: 5e09765c

Change-Id: Id995a0e15de633a40c48c2d48f2389031a03c122

am: ce84793b

Change-Id: Ief73a034bbd522f633cda815e7a4d0f319e78f49

am: a59830d9

Change-Id: Ibb2f08c673f62136d51b6c510b830bcc958ce236

am: 73150780

Change-Id: I68eb5d995288ea6c48dc82440f59587120bda524

am: 7e380216

Change-Id: I7cbf52fd8cee1f5e40fa06f114abf294cb9c61f5

am: 7e380216

Change-Id: I827a8b38264906bd06a8fefb9c3a8209dbc1035f

am: bb1270b9

Change-Id: Ia9af52ba31e492abda87b753eb8912f250e385c9

am: 28a896bf

Change-Id: I03d4d3dddf505125b09750f2b79b426edf06c158

am: a67411c9

Change-Id: If2ab59c09b2ccf444281fdf9003e36119eb7295f

Bluetooth is sometimes started from init.

Addresses the following compiler error:

  libsepol.report_failure: neverallow on line 489 of
  system/sepolicy/domain.te (or line 9149 of policy.conf) violated by
  allow init bluetooth:process { transition };
  libsepol.check_assertions: 1 neverallow failures occurred
  Error while expanding policy

Change-Id: I2bc1e15217892e1ba2a62c9683af0f3c0aa16b86

am: 4bfb943d

Change-Id: Ia68728329a2ec6bab7a75ebd872fd6166b573a44

am: 4cd633b2

Change-Id: Ic5d8569386f2f88e02b7da6edc37a1d6c926b7e8

am: 31bb306a

Change-Id: I542273a4affe02b0f7df0c90cf6bb33d77b79958

am: 76e85e8c

Change-Id: I6a7c4aa29186b32ab3dd94d028104ed50048735b

am: 69fe5d07

Change-Id: Iaaea2aaeaba08869a8885c88e07c436196134d11

am: 81fb2363

Change-Id: I129acfbecd2b8bb840c4d4897dbcc43f2ed0d2e2

am: b81614a7

Change-Id: I5a009f8f314c69cb13f449c13ef8b148504d4f65

am: 4706ba48

Change-Id: Ibddf8569ed074c29055cb54f5d114822f03ca627

am: c55cf17a

Change-Id: I48f8bbfab4cdd36e6f1555919ff5d032c07af0a2

am: c55cf17a

Change-Id: I391b6da84ad3b390511a73f7b874e2de2c4399c1

am: eedacf83

Change-Id: I4b23d564c6a4787180fea2c1530cc78808cbd0d0

am: eedacf83

Change-Id: I70ec1b35449727df62817f482c8199e5a58716aa

Bug: 28746284
Change-Id: Ib5e294402c549d8ed6764722220484c5655951a9

Apparently some manufacturers sign APKs with the platform key
which use renderscript. Renderscript works by compiling the
.so file, and placing it in the app's home directory, where the
app loads the content.

Drop platform_app from the neverallow restriction to allow partners
to add rules allowing /data execute for this class of apps.

We should revisit this in the future after we have a better
solution for apps which use renderscript.

Bug: 29857189
Change-Id: I058a802ad5eb2a67e657b6d759a3ef4e21cbb8cc

Previously appdomains allowed to execute off of /data
where whitelisted. This had the unfortunate side effect of
disallowing the creation of device specific app domains
with fewer permissions than untrusted_app. Instead grant
all apps a neverallow exemption and blacklist specific app
domains that should still abide by the restriction.

This allows devices to add new app domains that need
/data execute permission without conflicting with this rule.

Bug: 26906711

(cherry picked from commit c5266df9)

Change-Id: I4adb58e8c8b35122d6295db58cedaa355cdd3924

Ports check_seapp to pcre2.

Change-Id: If3faac5b911765a66eab074f7da2511624c3fc97

am: c753392e

Change-Id: I07ac991a1982ecc25223477e3ce6a9c8ae6a15a4

am: a7d5e610

Change-Id: I482b66f4a53034a16f7a943d105f73b7b07c07b0