am: 426f78ca

Change-Id: I4f1983feed32c668d723932c61a6f51692c61f53

am: 7a22490c

Change-Id: I3e6731b04314f9c54c016c1c7584242cdd12e75f

am: 609aa6b8

Change-Id: I261753961c59527061254f0b1c7adca50a7c2bce

am: e39ba338

Change-Id: I56e9182157c8de6c3135ae8a33962bca46c405dd

am: d69acbbf

Change-Id: Id2e01070d5669362b78f4adc865c4ff358711e60

am: 142bb78c

Change-Id: I1e721f2bfb59d2510769b7ddae9c22d5c8ae7dba

am: 5b1c3b69

Change-Id: I8808fd94c8130a551803b2ed184c325d3dad86cb

am: 5d3e4f0c

Change-Id: I56412b40f7f306ac32b588aba8de9a48a4f16c00

am: ebc7b434

Change-Id: If7f94440e35ad5a009ac6fa9d1cda3cb4fc17825

The kernel is unusual in that it's both a core process, but vendor
provided. Exempt it from the restriction against accessing files from
on /vendor. Also, rework the neverallow rule so that it disallows
opening/modifying files, but allows reading files passed over IPC.

Bug: 68213100
Test: build (this is a build-time test)
Change-Id: I2f6b2698ec45d2e8480dc1de47bf12b9b53c4446

avc: denied { getattr } for path="/vendor/framework"
scontext=u:r:system_server:s0 tcontext=u:object_r:vendor_framework_file:s0
tclass=dir

Bug: 68826235
Test: boot Taimen, verify denials no longer occur.
Change-Id: Id4b311fd423342c8d6399c3b724417aff9d1cd88

Allow hal audio to use vndbinder

Change-Id: I83fc8d5b873bfc4e36f44e423d5740cb5e9739ee

am: 6e056dd6

Change-Id: Iead5e09dc52386aa88e6f2f4fd8df862f71e98f5

am: 1be44b83

Change-Id: Idc0e47c8644e5fcc93c04eca7bba7c0023c49c24

am: e32d9406

Change-Id: I92c156c14675d82d8678df545a168d1a74774cac

Now that Bluetooth supports delay reporting, audioserver needs
access to Bluetooth Properties in order to determine whether the
feature is enabled or disabled.

Bug: 32755225
Test: Enable the property and see that there was no error accessing it
Change-Id: I519d49deb2df4efb3cc2cce9c6d497db18b50c13

am: 067bc406

Change-Id: I3c71ec9699fae580c374c6e22eb2eae62a2d49b1

am: 4d168f1a

Change-Id: Ide10d23eafbb249e0ef5d264d956ce74af38d847

am: 641608a9

Change-Id: I82643e6e2f8eb626f1644efe94a89529c396b3a2

am: e5017318

Change-Id: I8fd310b4b3ba5da15826245b63276612cf5cbcfc

am: f7066845

Change-Id: I209563c2eeb181452e0ef196f7a8bcff1d4ce3dc

am: e31157d9

Change-Id: Ib843d139377ebcaf716d54108a2197ccc14b25bb

am: d647799d

Change-Id: Ic463f569bfe91dde1981168fb81654855ca6dc01

am: 8ce9b83f

Change-Id: I403a4bfdb235629105ff5e33dff1930100551ad2

am: 969d8cc4

Change-Id: I31f387a654065d5311a3f7b484a9833c0d5ba973

am: a6c6c046

Change-Id: I3e584da883f26d70b5269c101bd83afbf54bee10

am: 40a8bce6

Change-Id: I8946fbe77bcec0a30aa68752c38d1b49423b659d

am: b47efe34

Change-Id: Ida8efdbc56d4f1827a5b2e84122164d5ec1ee68f

* changes:
  Enable treble_sepolicy_tests against 27.0 release.
  Refactor build rule for treble sepolicy tests.

am: a84c15fd

Change-Id: I19b9fd4b0b629650199d3306ea0d576f716128c9

am: 2a483706

Change-Id: I5ae3137f68621e9d6f26932ace4553ec16167e8a

am: d5996eca

Change-Id: Ib0325c335e18ef1ed7d9986bdf64771862b5bce3

persist.sys.zram_enabled is set in vendor/build.prop in taimen and walleye,
which was added after the initial whitelist.
go/treble-sysprop-compatibility requires whitelisting such a property to
allow it to be overridden by vendor/{default|build}.prop.

Bug: 73905119
Test: succeeded building and test with taimen
Change-Id: I931182aa05eb90c14df6e2c7cc26913f3874fa18

Bug: 69390067
Test: build sepolicy
Change-Id: I4fc7438e4f825281d93a2849be9d2db819bea4ca

Bug: 69390067
Test: policy builds
Change-Id: I9b29a88ec071a17fc429892b5a8720b15fcbcf32