(cherry picked from commit ec4b9d67)

Vendor apps are usually not preopted, so A/B dexopt should pick
them up. update_engine is not mounting the vendor partition, so
let otapreopt_chroot do the work.

This change gives otapreopt_chroot permission to mount /vendor
into the chroot environment.

Bug: 25612095
Bug: 29498238
Change-Id: I5a77bdb78a8e478ce10f6c1d0f911a8d6686becb

(cherry picked from commit 6c3f2831)

Allow priv_app, uncrypt, update_engine to access the OTA packages at
/data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks
the existence of the folder, and downloads the package there if present.

Bug: 28944800
Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5

(cherry picked from commit e123f061)

b/30832947

Change-Id: Icd5117d655f1197524b39fe7bc1b11c4d920093c

(cherry picked from commit 8cac2586)

More read rights are required now.

Bug: 25612095
Change-Id: I766b3b56064ca2f265b9d60e532cd22712f95a42

(cherry picked from commit 63203a01)

bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5

(cherry picked from commit e01654f9)

For Retail Demo mode, we need to preload photos in
/data/preloads and allow regular apps to access the
photos returned by the media provider from the preloads
directory.

Bug: 29940807
Change-Id: Ic1061dac55ace1b125ae04b5b0c70aae9aa0c732

(cherry picked from commit d47c1e93)

To include target slot names in the naming of A/B OTA artifacts,
and new path has been implemented. Instead of passing through
the system server and forking off of installd, otapreopt_chroot
is now driven directly from the otapreopt script.

Change the selinux policy accordingly: allow a transition from
postinstall to otapreopt_chroot, and let otapreopt_chroot inherit
the file descriptors that update_engine had opened (it will close
them immediately, do not give rights to the downstream executables
otapreopt and dex2oat).

Bug: 25612095
Bug: 28069686
Change-Id: I6b476183572c85e75eda4d52f60e4eb5d8f48dbb

(cherry picked from commit cf63957d)

This is needed in order to include profile files in bugreports.

Bug: 28610953
Change-Id: I025189a4ac66b936711fdb4e20b10c2b0a7427d1

(cherry picked from commit f23b870a)

avc: denied { read } for comm="generic" path="/data/system_de/0/ringtones/ringtone_cache" dev="sda35" ino=1114120 scontext=u:r:drmserver:s0 tcontext=u:object_r:ringtone_file:s0 tclass=file

Change-Id: I40992733d779743be92c15a094d166a3df64a10f
Fixes: 30167454

(cherry picked from commit d3edd6b5)

Bug: 29278988
Change-Id: I199572377a6b5c33116c718a545159ddcf50df30

(cherry picked from commit ad5b4be3)

Required for using native audio in BootAnimation

Bug: 29055299
Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478

* changes:
  fix build: exclude bluetooth from neverallow restriction
  Remove platform_app from neverallow execute from /data
  Rework neverallow for /data execute permission

This addresses error messages like:

11-30 18:00:15.196  6917  6917 W Binder:6596_2: type=1400 audit(0.0:46):
avc: denied { fowner } for capability=3 scontext=u:r:netd:s0
tcontext=u:r:netd:s0 tclass=capability permissive=0

11-30 18:00:15.200  6596  6917 E /system/bin/netd:
android::WriteStringToFile fchmod failed: Operation not permitted

11-30 18:00:15.200  6596  6917 E Netd    : failed to write to
/data/misc/net/rt_tables (Operation not permitted)

Bug: 31147892
Change-Id: Id11704f8e2b8c08db92de374ed44913b70d6ae66

Bluetooth is sometimes started from init.

Addresses the following compiler error:

  libsepol.report_failure: neverallow on line 489 of
  system/sepolicy/domain.te (or line 9149 of policy.conf) violated by
  allow init bluetooth:process { transition };
  libsepol.check_assertions: 1 neverallow failures occurred
  Error while expanding policy

(cherry-picked from commit 7e380216)

Change-Id: I2bc1e15217892e1ba2a62c9683af0f3c0aa16b86

Apparently some manufacturers sign APKs with the platform key
which use renderscript. Renderscript works by compiling the
.so file, and placing it in the app's home directory, where the
app loads the content.

Drop platform_app from the neverallow restriction to allow partners
to add rules allowing /data execute for this class of apps.

We should revisit this in the future after we have a better
solution for apps which use renderscript.

(cherry picked from commit c55cf17a)

Bug: 29857189
Change-Id: I058a802ad5eb2a67e657b6d759a3ef4e21cbb8cc

Previously appdomains allowed to execute off of /data
where whitelisted. This had the unfortunate side effect of
disallowing the creation of device specific app domains
with fewer permissions than untrusted_app. Instead grant
all apps a neverallow exemption and blacklist specific app
domains that should still abide by the restriction.

This allows devices to add new app domains that need
/data execute permission without conflicting with this rule.

Bug: 26906711

(cherry picked from commit c5266df9)

Change-Id: I4adb58e8c8b35122d6295db58cedaa355cdd3924

No "granted" messages for the removed permissions observed in three
months of log audits.

Bug: 28760354
Change-Id: I7713a9ad9a1604b17119ecad4970e2aa46c15bd0

No "granted" messages for the removed permissions observed in three
months of log audits.

Bug: 28760354
Change-Id: I6bd9525b663a2bdad4f5b2d4a85d3dd46d5fd106

Remove the ioctl permission for most socket types. For others, such as
tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist
that individual domains may extend (except where neverallowed like
untrusted_app). Enforce via a neverallowxperm rule.

Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe

Grant permissions observed.

Bug: 28760354
Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b

Fix file diffs.

Change-Id: Iac673c718b49779bba380e75ddd083caf6a2a1c3

Bug: 31364540
Change-Id: I2e11ef4666048c94b4754d50de74d1c526c6933c

(cherry picked from commit 8f40b41e)

bug 24503801

Change-Id: I6cf1afb3982c4da4f5e57188d3e24ac01c4bd416

Bug: 31246864

Change-Id: I8319e632b3be1e558dfc550453b8298914c89064
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Bug: 30041228
Test: WiFi tethering, client mode continues to function

Change-Id: I95a583ad4d57642f4731e415abb77732df5289ac
(cherry picked from commit fb5b13ee)