am: f4739f40

Change-Id: Ie07e3ababe6836f6b5c2522c3a3255367d01b662

am: b5081ea0

Change-Id: I3decd5c29ee797486d563393212cfc09666b77e1

Runas/libselinux needs access to seapp_contexts_file to determine
transitions into app domains.

Addresses:
avc: denied { read } for pid=7154 comm="run-as" name="plat_seapp_contexts"
dev="rootfs" ino=9827 scontext=u:r:runas:s0
tcontext=u:object_r:seapp_contexts_file:s0 tclass=file

Bug: 36782586
Test: Marlin policy builds
Change-Id: I0f0e937e56721d458e250d48ce62f80e3694900f

am: a21b3b19

Change-Id: I3e0bb56e66f2e4dc2ac04288e96c79070a710490

am: 6f700ae5

Change-Id: I6d58dcfa6037dc916d9ab5b995d2132e559783e1

am: 02d9d21d

Change-Id: I29861f9cc52001f2968c2313f48031dd01afe8c7

am: ef2057a6

Change-Id: I1c706c034571de2470fdb4458ab7c1ea43e4f52e

This tightens neverallows for looking up Binder servicemanager
services from vendor components. In particular, vendor components,
other than apps, are not permitted to look up any Binder services.
Vendor apps are permitted to look up only stable public API services
which is exactly what non-vendor apps are permitted to use as well.
If we permitted vendor apps to use non-stable/hidden Binder services,
they might break when core components get updated without updating
vendor components.

Test: mmm system/sepolicy
Bug: 35870313

Change-Id: I47d40d5d42cf4205d9e4e5e5f9d0794104efc28f

Devices that store their BT MAC address in /data/misc/bluedroid/ need
to find another place for that file.

Bug: 36602160
Test: Restart Bluetooth, check for selinux denials/files in /data/misc
Change-Id: Ib8d610f201a8c35f95b464c24857c6639205bc66
Merged-In: Ib8d610f201a8c35f95b464c24857c6639205bc66

am: 6c4c9bea

Change-Id: Ie6ab78d9c8f93ed00e3ec5923a9946d492199288

Devices that store their BT MAC address in /data/misc/bluedroid/ need
to find another place for that file.

Bug: 36602160
Test: Restart Bluetooth, check for selinux denials/files in /data/misc
Change-Id: Ib8d610f201a8c35f95b464c24857c6639205bc66

am: 36c8f160

Change-Id: I4c39b013d9d8f296171dde6d0b0b3400074f3825

am: d7a2f60d

Change-Id: Ifc66292d55f1daea28069cbf63cd70bf96fee74d

This reverts commit 5c09d123.

Broke the build

Bug: 35870313
Test: source build/envsetup.sh && lunch marlin-userdebug && m -j40
Change-Id: I71c968be6e89462fd286be5663933552d478f8bf

am: c673770a

Change-Id: Icb5276a3b73419b4b0e3a9fea1af157d0e1ef882

Full treble targets cannot have sockets between framework and vendor
processes. In theory, this should not affect aosp_arm64_ab where only
framework binaries are built. However, /system/sepolicy has rild.te
which is now vendor binary and this causes neverallow conflict when
building aosp_arm64_ab.

So, we just temporarily annotate the rild with
socket_between_core_and_vendor_violators so that the neverallow conflict
can be avoided.

Test: choosecombo 1 aosp_arm64_ab userdebug; m -j 80 The build should
not break.

Change-Id: I260757cde96857cc3f539d5f82ca69c50653f8c7

am: 3ad5c9e7

Change-Id: I41a829460d932c30e564060fceb9169a7443014f

am: b78fd545

Change-Id: I227c5aee3e635922f39192bc9ce5a1ca5db46451

am: a581c048

Change-Id: Ic71ef550af5cb26ca7d4db01fa78bd6c74b98ca5

am: eaa5e298

Change-Id: I232deac94123b1e07a20789cc247aa95bb9b3327

am: 75760e9d

Change-Id: I02cfb5b418c2edaeaa02831113205e0a73f92342

am: 32815389

Change-Id: Id6cc5e3c1dc6b098f893b566dcbf09fc29973162

am: 7eb3dd3b

Change-Id: Iafaa3fd315533c4cb49847d927d2c7cbae71bb51

* changes:
  Add IpSecService SEPolicy
  Update Common NetD SEPolicy to allow Netlink XFRM

Test: denials go away
Change-Id: I103cf3ad8d86b461bcba8edce02f6202fd2bcbe8

am: 394539c5

Change-Id: Ibaa6911b4656ceb41167eab09eddfb3ca8c783f2

am: 136caa1b

Change-Id: I35ffe4d2cd233582c9dc73f1c20602c1a1c953eb

am: 1e149967

Change-Id: Ie6fe25279ff73d4b200463bd07116a40a2272382

am: c9cf7361

Change-Id: Ib2588c6117fdaf79665f61d4c872c60fb6579613

am: 939d16b5

Change-Id: I1c351ee36100730bf98a3fe820d1f51f7b672ba5

am: 54a42001

Change-Id: I8281fcee3729b0a48131a860381db2a2be5f8c84

* changes:
  mac_permissions: explicitly label all mac_permissions files
  sepolicy: explicitly label all sepolicy files
  seapp_context: explicitly label all seapp context files
  file_context: explicitly label all file context files
  service_contexts: label service_contexts explicitly
  prop_context: correctly label all property_context files