Change-Id: Idc94ca2258aebc7c001b79e13e61bc8da4e8e356

am: 03596f28

Change-Id: I5fe53ee3d82ea83b97bf9de91dfdae897df06445

This file is necessary for using an mr1 system image in conjunction
with an oc-dev vendor image.  This is currently needed by GSI testing,
for example.

Bug: 66358348
Test: File is included on system image.
Change-Id: I3a6b7ed5edf1c07941bbf835e70f2ae8d03fee25

release-request-1884541d-2ec2-444e-b6d7-f957c5507fbe-for-git_oc-mr1-iot-release-4364659 snap-temp-L75200000106831384

Change-Id: I23b31e860efc980860723fcc1a10990913e757f6

am: 8c8994f5

Change-Id: Ia25366a937ca35cd7b0ab4a8c1cfcdc6abd4d9ba

am: f8e09172

Change-Id: I911b1bfd9a2f1add2374acc9ee3159f0dbc165a8

type=1400 audit(0.0:6): avc: denied { read } for comm="Thread-5"
name="cache" dev="dm-0" ino=13 scontext=u:r:system_server:s0
tcontext=u:object_r:cache_file:s0 tclass=lnk_file permissive=0

Bug: 64067152
Bug: 65843095
Test: build
Change-Id: Ie90c0343a834aa87b7ded41f503e05d9b63b3244
(cherry picked from commit a4cada74)

release-request-4f6cb965-f793-476d-8f14-d0ae08308fb7-for-git_oc-mr1-iot-release-4362168 snap-temp-L66300000106450614

Change-Id: I4f214d52592ac78ec18b0f3a16156e5370794c4d

am: 6b8088ba

Change-Id: Id33c3e7f23b84fa10bad8c2ee7bf7c44265acc25

Particularly useful for suppressing selinux logspam for debug-only
permissions.

Bug: 65843095
Test: build, boot, and run tests on user and userdebug builds.
Change-Id: I18ce0b2cf1e96ca037e93309dddb476a150b677f

release-request-030039d5-8903-46d2-ba83-18bbd0db1bf6-for-git_oc-mr1-iot-release-4358977 snap-temp-L66100000106019344

Change-Id: I0d25d8a4b8bf2e00798fe975c9da557c2a9a7d19

It's used in CTS neverallow tests.

Addresses:
Warning!  Type or attribute hal_cas_server used in neverallow
undefined in policy being checked.

Bug: 66910049
Test: build
Change-Id: Ia185f266fc1e3cb87c39939fdd45d02efa6c2c94
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38

am: 5d8b059f

Change-Id: I511ddcdb2f8bec7b52985e25b0c9d4c8d763cf21

These are no longer necessary as domain_deprecated has been
removed in AOSP master.

Bug: 66749762
Test: build
Merged-In: I99953ecc7d275fdbe8e56d8f47a27d1f9e1cc09a
Change-Id: I01878a4410f8cb3c97ff96c67845dfaa7b0051ce

release-request-ff422c3c-f322-4fd6-8018-3005297c3ce9-for-git_oc-mr1-iot-release-4351313 snap-temp-L99900000104754319

Change-Id: I4a0f68ce004a2c292a45002604dbb19195195b66

Bug: b/64090883
Change-Id: I566a380db2f8f4d886252eee26181e37a4fb0d61

* changes:
  RESTRICT AUTOMERGE: lowpan: Add wpantund to SEPolicy
  RESTRICT AUTOMERGE: lowpan: Added support for LoWPAN Service and android.hardware.lowpan

Bug: b/64399219
Test: Manual
Change-Id: I4f6c7e4e3339ae95e43299bf364edff40d07c796

Bug: b/64090883
Bug: b/33073713
Test: Manual
Change-Id: I7aa23c31b1fccae56c1a0e0bd4cfe370aeb911dd

release-request-dd2c83a3-1a86-4bcc-b1ec-9277060c0335-for-git_oc-mr1-iot-release-4346196 snap-temp-L73000000103995506

Change-Id: I92ba7951b439fdf36b28bc63b9e6b4492e6ed704

am: 4c4b433c

Change-Id: Ibb136df8fadd90013455cd8ff476ed28551f40e2

Added permission related to use of wake lock. Wakelock in sensor
HAL is used to gurantee delivery of wake up sensor events before
system go back to sleep.

Bug: 63995095
Test: QCOM and nanohub sensor hal are able to acquire wakelock
      successfuly.

Change-Id: Id4ac3552e18a1cad252017e3dc9ab3d4be8d4ab9
Merged-In: Id4ac3552e18a1cad252017e3dc9ab3d4be8d4ab9

release-request-c7ef57d3-badc-414a-a047-fc71124a9598-for-git_oc-mr1-iot-release-4343992 snap-temp-L17700000103593829

Change-Id: I1da0945d1b42def500587e85e152d8e948bea8d2

am: aa5f37da

Change-Id: I2bf881164990b2517b81d3bf3b6560537dc94636

Addresses:
junit.framework.AssertionFailedError: The following errors were
encountered when validating the SELinuxneverallow rule:
neverallow {   domain   -adbd   -dumpstate   -hal_drm -hal_cas -init
-mediadrmserver   -recovery   -shell   -system_server }
serialno_prop:file { getattr open read ioctl lock map };
Warning!  Type or attribute hal_cas used in neverallow undefined in
policy being checked.
libsepol.report_failure: neverallow violated by allow mediaextractor
serialno_prop:file { ioctl read getattr lock map open };
libsepol.report_failure: neverallow violated by allow mediacodec
serialno_prop:file { ioctl read getattr lock map open };
libsepol.report_failure: neverallow violated by allow hal_cas_default
serialno_prop:file { ioctl read getattr lock map open };
libsepol.check_assertions: 3 neverallow failures occurred

Bug: 65681219
Test: build
Change-Id: I2a6445d6372ee4e768cc2cea2140c6de97707a74
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38

am: 99ee8b97

Change-Id: I56484d6fe14ecdb3028c6dfa29ee0c590d1e617c
(cherry picked from commit 544a7317)

am: 123cf237

Change-Id: Ic6b60c2168b9f5b75cbeaeebee2acd5310df489d

am: 15f9d052

Change-Id: I0c1390ade37884ff86a8089d25c9cce794b31877

am: ba4d04e0

Change-Id: I54773febe86aeb79eba33494f5481762f2698584

am: 60e53837

Change-Id: I43de8298c9dac061ca6fbd81e17fb4b8eed904c3

am: f606a51e

Change-Id: Id385d64ac63bee08c1457f0a003718ecb03546ea

am: 9c571765

Change-Id: I6ea1d962cf03ee18102e22d29df59749afc3d5bd

Allows groups to be mounted at /dev/memcg

Addresses:
avc: denied { associate } for comm="init" name="memcg"
scontext=u:object_r:cgroup:s0 tcontext=u:object_r:tmpfs:s0
tclass=filesystem permissive=0

Bug: 64067152
Test: build
Change-Id: Ic8f641e841fe09c8f7fd487ed67cf0ab4860a1cc

Currently lmkd is not able to read memcg info. The mem/swap usage
info are used by lmkd to ugrade medium pressure events to critical
level.

Test: tested on gobo
Bug: 65180281
Change-Id: I19d0eb53d5e754c176ffeda1b5d07049e6af8570