am: 40ec83ce

Change-Id: I46f17e0dade926056c4ab9f39a9ec4064d12e597

am: 1f447485

Change-Id: Ia504ee90ef703fd46f6021e2b893f8f4104a4b65

am: 73a2cf20

Change-Id: Iae2c40185b51dfb87c7e444483efde7641cf4d59

am: 5670dd1f

Change-Id: I13a91e18ba39271693fa7d2cdae641882e533806

Test: n/a
Change-Id: I7041cc0f17ece86c01db1d9c17f68b58473cf27c

am: 5a0e658f

Change-Id: I35b03c9600d9c94a1be98e145a62570e073a52c5

am: 2732f149

Change-Id: Icaf1a00c58252fa8aee8aefd4b25df5dafb94107

CTS tests need to be able to call, from hostside:
adb shell cmd stats dump-report (and others)
On a user build, this will fail because of an selinux policy violation
from shell. This cl fixes this by granting shell permission.

Similarly, Settings needs to communicate with statsd, so
system_app-statsd binder calls are given permission.

Bug: 72961153
Bug: 73255014
Test: run cts-dev -m CtsStatsdHostTestCases -t android.cts.statsd.atom.HostAtomTests
Test: manual confirmation
Change-Id: I6589ab4ef5c91a4a7f78eb97b63d9bb43e3d8f02

Allows the traced_probes daemon to access the core ftrace
functionalities on user builds. Specifically this involves:
- Whitelisting the per_cpu/ subdirectory to access:
  1) trace_pipe_raw file to allow perfetto to read the raw
     ftrace buffer (rather than the text-based /trace endpoint)
  2) cpuX/stats and cpuX/buffer_size_kb that allow to
     tune the buffer size per-cpu pipe and to get basic
     statistics about the ftrace buffer (#events, overruns)
- Whitelistiing the full event directories rather than the
  /enable files. This gives also access to the /format files
  for the events that are already enabled on user builds.
  /format files simply describe the memory layout
  of the binary logs. Example: https://ghostbin.com/paste/f8m4k

This still does NOT allow enabling the events labeled as
"_debug" (mostly events that return activity on inodes).
We'll deal with that separately as soon as we get a POC
of inode resolution and a sensible blacklist/whitelist model.

Bug: 70942310
Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8

am: 17777d53

Change-Id: Ib9f522a40252df20ce13cd29f50060db6d2a8c36

am: 7a567e3a

Change-Id: I729a92e34531f6726372b5639c94dcbd49edbe25

am: 40e15ab3

Change-Id: I486933e6d02f1905c31c336d12ee4e5bf9802d95

am: a099830e

Change-Id: Ia34c9097e45d7d68dfffc2a90cf1306ff2ce0e9c

This should fix presubmit tests.

Bug: 72550646
Test: Built policy.
Change-Id: Ib17d2a5e1635ff661d39d14169652f88b7a6e4f5

Bug: 72809699
Test: build
Change-Id: Ifb66ad13557af7d2dc6d3ef823e326a5fba51b24

am: 5f51fc76

Change-Id: Ie3f9b5172ec6dd17dd4803e5b425b5799e982530

am: d388f370

Change-Id: Id3a7f0adc0ee9c20a219174c90a184d8d50acfc8

am: 7fd715ea

Change-Id: I451ac21739b42b5206cb679de09093e97f4d3af0

am: 3721b051

Change-Id: Ice083b2e11c0fb3daefbe64eba4adb9632ba0774

This should fix presubmit tests.

Bug: 73128755
Test: Built policy.
Change-Id: Ie389de04360090594e627e629a59a60092dda6ca

am: 1cb7fa83

Change-Id: Iefb398cf0eff6199aa1f9be67b0a130a22bf8f9e

am: 74e408c4

Change-Id: Ie54bee4b5bb68460394e552305a16c61e62405a1

Restrictions introduced in vendor init mean that new devices
may not no longer exempt vendor init from writing to system_data_file.
This means we must introduce a new label for /data/vendor which
vendor_init may write to.

Bug: 73087047
Test: build and boot Taimen and Marlin. Complete SUW, enroll fingerprint
    No new denials.

Change-Id: I65f904bb28952d4776aab947515947e14befbe34

am: 3ede597e

Change-Id: Ie3b4a150c35a5c08fc202c27921eeac8c6d9d2b0

am: 8c87c2ad

Change-Id: I0e0aa1f84fce0bcf4fe6912f453ff6c9221e6c2d

am: 680fa3d6

Change-Id: I2cbcf36454b9034f57e830e5f0c969c0bfe9ccdf

am: 2787c19f

Change-Id: I8c1c40e266ccc54e3a436eb7935fae132c929288

am: 602575ec

Change-Id: I6ad1399b8adf591eea47bcd375f868ef0f313777

am: 9eb4de16

Change-Id: I6343d29e2f4d4298c40ef782d7aa85825eccf7e8

am: 3dff9ab4

Change-Id: I6080271008eff31de9bf407250cf64c4001f8ff4

am: 8c8ed1f0

Change-Id: I51f11f3d4296ed4a349221c567b953499576c31d

* changes:
  Use PLATFORM_SEPOLICY_COMPAT_VERSIONS
  Move PLATFORM_SEPOLICY_VERSION to make/core/config.mk