am: feabf294

Change-Id: Id66b3cd36f5b7306de3684714b22a4ff51842e6f

am: 51251212

Change-Id: Ie3194b1314cef76240ff518ac2b86e094b9baa81

am: 6faa3a1a

Change-Id: Ica1a165a67f4db803e69757009a14145bb17c5b9

am: 997fcf16

Change-Id: Ic4fe495fb1064d32b4bac28242c53dae06e7ed70

am: a6966554

Change-Id: I8c09069290ffe1827212206b81616e9302bfe7ea

am: cd753d11

Change-Id: I01a332c51aa4a5c62e5b2bb4ba13565b48c46b88

am: 51871966

Change-Id: Id7363e8c5e6bc6a41bb74e0536eb80577189107d

am: dcd0baf6

Change-Id: I07782169b7a9b4ad05d8915e43599c0ae158fb2b

am: 97c86514

Change-Id: I170162843b04280105c76d4e5d7a8d3f89583588

Added access to proc_uptime and proc_asound to address these denials:

avc: denied { read } for name="uptime" dev="proc" ino=4026532080
scontext=u:r:shell:s0 tcontext=u:object_r:proc_uptime:s0 tclass=file
permissive=1

avc: denied { getattr } for path="/proc/asound/version" dev="proc"
ino=4026532017 scontext=u:r:shell:s0 tcontext=u:object_r:proc_asound:s0
tclass=file permissive=1

Bug: 65643247
Test: device boots with no denial from 'shell' domain.
Test: lsmod, ps, top, netstat
Test: No denials triggered from CtsSecurityHostTestCases
Test: external/toybox/run-tests-on-android.sh does not pass, but triggers
no denials from 'shell' domain to 'proc' type.

Change-Id: Ia4c26fd616e33e5962c6707a855dc24e338ec153

am: 80f63e0b

Change-Id: I93aa25bf35797a98fee8368711ef736614dcb0a4

am: 92652912

Change-Id: Id419994de8b6ca9dc29e0cb3a3c0d05cd07b982a

am: 499fd010

Change-Id: Ifdf2102a4305b3aa51607e78a1c6ce529b45d382

am: 00057abc

Change-Id: I6d6b75701e35b35501935162670f906f9c757d4b

am: 1bd4443a

Change-Id: Ia72d55f0a38fb9415166d5cf03cd67b2e9e2162c

am: 25576730

Change-Id: I97842c1a293bc68daa11adffec29514a9afbb868

- Allow system_server to create and write to /data/misc/wmtrace/*
- Allow surfaceflinger to create and write files from /data/misc/wmtrace/*
- Allow dumpstate to read files from /data/misc/wmtrace/*
permissions are restricted to userdebug or eng builds

Bug: 64831661

Test: adb shell cmd window tracing start && adb shell cmd window tracing stop
Test: adb shell su root service call SurfaceFlinger 1025 i32 1 >/dev/null && adb shell su root service call SurfaceFlinger 1025 i32 0 >/dev/null
Test: adb bugreport ~/tmp.zip && adb shell su root dmesg | grep 'avc: '

Change-Id: I0b15166560739d73d7749201f3ad197dbcf5791c

Bug: 65643247
Test: cts-tradefed run cts-dev -m \
CtsMediaTestCases --compatibility:module-arg \
CtsMediaTestCases:include-annotation:\
android.platform.test.annotations.RequiresDevice
No denials from mediaserver domain to sysfs type are observed.
Change-Id: Icb5c12f04af213452d82e226993fe13085c5c33f

am: c31c9096

Change-Id: I63b9ef7dc9ef200bdf4c520c6c93649655e63d33

am: f6aa0695

Change-Id: I109c44d4ebbb08aa5eb78e4d8a3b8ac106411dc2

am: 13c69b89

Change-Id: I81e8cc02afa5b87419a4e70ab46a70ca43b85c43

Label /proc/sys/fs/pipe-max-size with new type proc_pipe_conf and give
system_server access to it.

Addresses this denial:
avc: denied { read } for name="pipe-max-size" dev="proc" ino=93817
scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file
permissive=0

Bug: 69175449
Bug: 69324398
Test: sailfish boots
Test: adb bugreport
Test: craft an unresponsive app, trigger ANR, make sure traces are dumped
into /data/anr
Above denial from system_server not observed, no denials to proc_pipe_conf
observed.
Change-Id: I7c71f05820a4945ba982e29f76e9d9f4458b2b59

Only getattr and read are necessary for lnk_file. Open violates a new
neverallow for separating system and vendor data.

Bug: 34980020
Test: Enroll fingerprint on Taimen
Change-Id: I9434afbd5b4ecc1ead9f0ba47c7582fb5a6c6bf0

am: fa7f3a9d

Change-Id: Id56db24bfb5821d7a7255b8646fb2dfcf22271d9

am: 0181d23f

Change-Id: I7c75b607ce60eb60f8b0bfb58ed8a190940a8239

am: 0d7e5047

Change-Id: I29fd343005136d580763eff843fa94e8e3318c06

am: adda76ea

Change-Id: I38aa8d944a3d27c21dc4cc9aee3a72b501da5946

am: 7bd0bde4

Change-Id: I6aa0562fdc8e0fb482c8c81fbb256f57dbe59387

This reverts commit 248b6dc6.

Reason for revert: The dashboard complains that devices don't boot after this revert.

Change-Id: I6a4648b64b096cbaa97c67aae6bc38b76d54cb48

am: 5984301a

Change-Id: I7e6c4733471f5954a16f991adddda3657844b47d

am: 0386eaed

Change-Id: I7b2aec9510271d509759eb4822ba8d97993af2ff

am: e3cec841

Change-Id: Iefd431374378a736aa8e3a2f37b25cf026b3998f

am: 248b6dc6

Change-Id: Ie2990b86b85fbe29565ca7957fbce6b6121abec1