am: 11620416

Change-Id: Iaeec958064ce96957b0e72622a94ec69014fc620

am: d090db9d

Change-Id: I4ea7560f259b3e28ac1881f133edd493dc545820

am: 29ec5d42

Change-Id: I461cb74c1151ac9ac91d80fe7ef1c2d9c8e433ca

am: 17d25942

Change-Id: If7b06933584b86347a1a7b162f66df2af8840938

am: c01a7e19

Change-Id: I9a68f3ec130cb1fc1ce06931e33b30736f43e578

Test: test_aaudio.cpp
Bug: 33398120
Change-Id: I0712f60c898136154d729ceb1103ee021cc6ab82
Signed-off-by: Phil Burk <philburk@google.com>
(cherry picked from commit 8b9d93f2)

am: 35d2a46a

Change-Id: I730360302ac12367607aa5ca8266413812ca82ab

Recovery is not meant to be versioned in the treble model, but rather
provided as part of the platform/framework component and self-sufficient.
Simplify its compilation by removing the attribute versioning steps, but
maintain device-specific policy, which is currently required for full
functionality.

Bug: 37240781
Bug: 36783775
Test: recovery boots and is able to select commands.  Also tried:
reboot system, boot to bootloader, factory reset, sideload, view logs,
run graphics test, and power off.

Change-Id: I637819844d9a8ea5b315404f4abd03e8f923303a

am: 718ec4f8

Change-Id: If987b23d2998ee35a18e938b37451a659a9841a4

am: c1463bfb

Change-Id: I252460e54aeae7f0e0fd84bf1aeeecddfe1225a6

am: 20fe64e7

Change-Id: Id1d70b14a7035d18b5bb6ef9720fc0b5689bb722

As the platform progresses in the split SELinux world, the platform
will need to maintain mapping files back to previous platform versions
to maintain backwards compatibility with vendor images which have SELinux
policy written based on the older versions.  This requires shipping multiple
mapping files with the system image so that the right one can be selected.
Change the name and location of the mapping file to reflect this.  Also add
a file to the vendor partition indicating which version is being targeted that
the platform can use to determine which mapping file to choose.

Bug: 36783775
Test: Force compilation of sepolicy on-device with mapping file changed
to new location and name, using the value reported on /vendor.

Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4

With build/core eaa9d88cf, system_server should not be loading code
from /data. Add an auditallow rule to report violations.

Bug: 37214733
Test: Boot marlin, no SELinux audit lines for system_server.
Change-Id: I2e25eb144503274025bd4fc9bb519555851f6521
(cherry picked from commit 665128fa)

am: 976fb16b

Change-Id: Ibbb29d866be7a7a59bf96bd30085c1d958d39971

am: 1950bb8c

Change-Id: I7e27cf5ea9d74113fbb159b87602673444ace6a2

am: 5f37f670

Change-Id: I6f8c6580a4ebe5f9099c3779548cf5ae46a9f3a8

am: f6eb2ad6

Change-Id: Ica844c95214cdf8b26a94e261f1f7a0ed734083c

Merge "system_server: Report dalvikcache_data_file execute violations." am: d16d039f am: 45ca6898
am: d95a14f2

Change-Id: Ia2cb64dd4dbe0713f87f76b91510b33e980995fc

am: 45ca6898

Change-Id: I5dd0b816654108c8b01e39a622fd3696ca99c8f9

am: d16d039f

Change-Id: I9778cef84531cfbbdead89be2bfaa48e4c067891

Follow-up to commit 1b5f81a2.

Bug: 36681210
Bug: 37158297
Test: lunch sailfish-userdebug && m
Test: Manually run OTA
Change-Id: Ifb4808c9255842a51a660c07ffd924cef52024c5

This was marked deprecated in 2014 and removed in 2015, let's remove
the sepolicy now too.

Test: see that logging still works on bullhead

Change-Id: I4caa0dbf77956fcbc61a07897242b951c275b502

am: 46293050  -s ours

Change-Id: I509c04a28242513cb26a39580e2a09a70e5b7529

am: 52f3c178

Change-Id: I669f86f7ed4d1d1338f33e39fd6b05bf89a34c94

am: 9a3a6a81

Change-Id: If95f7f3f75f213549a15cdab969073a25b9776c3

With build/core eaa9d88cf, system_server should not be loading code
from /data. Add an auditallow rule to report violations.

Bug: 37214733
Test: Boot marlin, no SELinux audit lines for system_server.
Change-Id: I2e25eb144503274025bd4fc9bb519555851f6521

We install all default hal implementations in /vendor/bin/hw along with
a few domains that are defined in vendor policy and installed in
/vendor. These files MUST be a subset of the global 'vendor_file_type'
which is used to address *all files installed in /vendor* throughout the
policy.

Bug: 36463595
Test: Boot sailfish without any new denials

Change-Id: I3d26778f9a26f9095f49d8ecc12f2ec9d2f4cb41
Signed-off-by: Sandeep Patil <sspatil@google.com>

Create PLATFORM_SEPOLICY_VERSION, which is a version string to represent
the platform sepolicy of the form "NN.m" where "NN" mirrors the
PLATFORM_SDK_VERSION and "m" is a policy-based minor version that is
incremented with every policy change that requires a new backward-compatible
mapping file to be added to allow for future-proofing vendor policy against
future platform policy.

(cherry-pick of commit 6f14f6b7)

Bug: 36783775
Test: Device boots when sha256 doesn't match and compilation is forced.
Change-Id: I4edb29824f2050a5a6e1bc078c100cf42e45c303

The sepolicy version takes SDK_INT.<minor> format. Make sure our
'current' policy version reflects the format and make it '100000.0'.
This ensures any vendor.img compiled with this will never work with
a production framework image either.

Make version_policy replace the '.' in version by '_' so secilc is
happy too.

This unblocks libvintf from giving out a runtme API to check vendor's
sepolicy version. The PLAT_PUBLIC_SEPOLICY_CURRENT_VERSION will
eventually be picked up from the build system.

(cherry-pick of commit 42f95984)

Bug: 35217573
Test: Build and boot sailfish.
      Boot sailfish with sepolicy compilation on device.
Signed-off-by: Sandeep Patil <sspatil@google.com>

Change-Id: Ic8b6687c4e71227bf9090018999149cd9e11d63b

am: c051300e

Change-Id: I433bbd9acfa7afb611da183c581dbb09e670575e