am: a9a3df31

Change-Id: I83c5170513890c90b576d6a07f4e7d73a400bae2

am: 62022c71

Change-Id: I3f7438d9883bf25c41674965b963c788df2c69ef

am: 3abc81ce

Change-Id: If6350ea61bd6447af7913a7b474e719e0f7707d3

am: d5a2f3e2

Change-Id: Ie35b0b80c929066186c35d31b8f8d803f374d969

am: 99accb4a

Change-Id: I4f5d6f57fc4440c9b09a67e92fbda5d2d133fb62

am: 56719282

Change-Id: I96129052f94f0748a6a5a964959270c5a8a118e3

vendor implementations need to be able to run modprobe as part of
init.rc scripts.  They cannot do so because of the strict neverallow
currently in place that disallows all coredomains (including init)
to execute vendor toybox.

Fix this by adding init to the exception list for the neverallow so
vendors can then run modprobe from .rc scripts and also add the rule to
allow init to transition to modprobe domain using vendor_toolbox.

Bug: b/38212864
Test: Boot sailfish

Change-Id: Ib839246954e9002859f3ba986094f206bfead137
Signed-off-by: Sandeep Patil <sspatil@google.com>

am: aa15c0af

Change-Id: I2472fae6dec8202842dc35d36eb03248256dcd45

am: 1c8e8e0e

Change-Id: I45c6a937eea4a110c0137d1e1573fe50fd71f4cd

Merge "Let fallback crash dumping write to dumpstate pipes." am: 4a608d31 am: 0bcb92a5 am: b1cf5ae4
am: cebd95b6

Change-Id: I9fb4ddebd9e9cecc08f2dab47b3e90018cd12b6d

am: b1cf5ae4

Change-Id: If2351db2a2f76837f7081fc052b03dfbae877cf4

am: 0bcb92a5

Change-Id: I86ba3626798b4f1afc49c767ad756c8a3b1f9e75

am: 4a608d31

Change-Id: I1ac7b6ddaa3f6c7ee88426cf5ec6e6dec7bc8767

Fix the following denial:
    avc: denied { append } for pid=1093 comm="mediaextractor" path="pipe:[68438]" dev="pipefs" ino=68438 scontext=u:r:mediaextractor:s0 tcontext=u:r:dumpstate:s0 tclass=fifo_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"

Bug: http://b/38444258
Test: none
Change-Id: I58162e3a28b744a58396e77d6b0e2becb5633d6a
(cherry picked from commit 5efadd91)

Needed to allow lower power Play Music of downloaded files.

    05-24 10:12:49.331 24025 24025 W generic : type=1400
          audit(0.0:1259): avc: denied { read } for
          path="/data/data/com.google.android.music/files/music/925.mp3"
          dev="sda35" ino=2179256 scontext=u:r:mediaextractor:s0
          tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file
          permissive=0

Test: Play Music
Bug: 62059834

Change-Id: I97bdb1d175dba8f7a8ec6cd9084323cfcd3660bd

Fix the following denial:
    avc: denied { append } for pid=1093 comm="mediaextractor" path="pipe:[68438]" dev="pipefs" ino=68438 scontext=u:r:mediaextractor:s0 tcontext=u:r:dumpstate:s0 tclass=fifo_file permissive=1 ppid=1 pcomm="init" pgid=1 pgcomm="init"

Bug: http://b/38444258
Test: none
Change-Id: I58162e3a28b744a58396e77d6b0e2becb5633d6a

am: 14e577fa

Change-Id: Ib759c17d736440a44f83f0af79b3db5bebd93d4f

am: c67fa9bf

Change-Id: Id47543705ea3f501fb26b2bf0af1e3a234c6dd71

Update SE Policy to allow calls to and callbacks for the Tether Offload HAL
HIDL binderized service.

Bug: 38417260
Test: New functionality. So we don't have any tests.
Change-Id: I2c95b290523c55c081afa1bca091f368559c9125
(cherry picked from commit 722249b3)

These directories were added to allow for partner extensions to the
android framework without needing to add changes to the AOSP global
sepolicy.  There should only ever be one owner of the framework and
corresponding updates, so enforce this restriction to prevent
accidental accrual of policy in the system image.

Bug: 36467375
Test: Add public and private files to policy and verify that they are
added to the appropriate policy files.  Also test that specifying
multiple directories for public or private results in an error.

Change-Id: I397ca4e7d6c8233d1aefb2a23e7b44315052678f

Update SE Policy to allow calls to and callbacks for the Tether Offload HAL
HIDL binderized service.

Bug: 38417260
Test: New functionality. So we don't have any tests.
Change-Id: I2c95b290523c55c081afa1bca091f368559c9125

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855 am: 9c87eb45
am: e190656f

Change-Id: I4a01a0807caf8b53c9caf426f2ad686414566ca8

am: a2c24197

Change-Id: I126a9e8f6015083515f2c85ac42f0c14f6c47f88

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855 am: 11cf0629
am: 9911fbd7

Change-Id: Id7421d9867030c0bbe1e9b57add37a6e3b1e1a02

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855
am: 9c87eb45

Change-Id: I6dace62c8033551536597e4d5bb0105b06508346

am: 69bb06e5

Change-Id: Ia87985dca88d3f5ebf8db51b7a27bc44e6090538

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921 am: ed21f855
am: 11cf0629

Change-Id: Ibc72bad82047986aea1cbb643463de64a1d2e9d3

am: ca7d90ca

Change-Id: Ibe4770026852338dcfde327857ccffb1fc91a5a0

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921
am: ed21f855

Change-Id: Iba0094323da99989b1abf4e7002facce9af20e39

system_server: replace sys_resource with sys_ptrace am: 3d8dde0e am: dddbd2f3 am: 5ee08053 am: 6b3ef921
am: ed21f855

Change-Id: I629201783c38c41032960e633f2a9f53eeadf8b9

am: de5db3ab

Change-Id: If61aa850ab0f6060ec7a863cc0107f68f1db9400

am: 6b3ef921

Change-Id: Iefc3436c532f5f291345e3d01a1cbe175d69e619