am: bb1270b9

Change-Id: Ia9af52ba31e492abda87b753eb8912f250e385c9

am: 28a896bf

Change-Id: I03d4d3dddf505125b09750f2b79b426edf06c158

am: a67411c9

Change-Id: If2ab59c09b2ccf444281fdf9003e36119eb7295f

am: 4bfb943d

Change-Id: Ia68728329a2ec6bab7a75ebd872fd6166b573a44

am: 4cd633b2

Change-Id: Ic5d8569386f2f88e02b7da6edc37a1d6c926b7e8

am: 31bb306a

Change-Id: I542273a4affe02b0f7df0c90cf6bb33d77b79958

am: 76e85e8c

Change-Id: I6a7c4aa29186b32ab3dd94d028104ed50048735b

am: 69fe5d07

Change-Id: Iaaea2aaeaba08869a8885c88e07c436196134d11

am: 81fb2363

Change-Id: I129acfbecd2b8bb840c4d4897dbcc43f2ed0d2e2

am: b81614a7

Change-Id: I5a009f8f314c69cb13f449c13ef8b148504d4f65

am: 4706ba48

Change-Id: Ibddf8569ed074c29055cb54f5d114822f03ca627

am: c55cf17a

Change-Id: I391b6da84ad3b390511a73f7b874e2de2c4399c1

am: c55cf17a

Change-Id: I48f8bbfab4cdd36e6f1555919ff5d032c07af0a2

am: eedacf83

Change-Id: I4b23d564c6a4787180fea2c1530cc78808cbd0d0

am: eedacf83

Change-Id: I70ec1b35449727df62817f482c8199e5a58716aa

Bug: 28746284
Change-Id: Ib5e294402c549d8ed6764722220484c5655951a9

Apparently some manufacturers sign APKs with the platform key
which use renderscript. Renderscript works by compiling the
.so file, and placing it in the app's home directory, where the
app loads the content.

Drop platform_app from the neverallow restriction to allow partners
to add rules allowing /data execute for this class of apps.

We should revisit this in the future after we have a better
solution for apps which use renderscript.

Bug: 29857189
Change-Id: I058a802ad5eb2a67e657b6d759a3ef4e21cbb8cc

Previously appdomains allowed to execute off of /data
where whitelisted. This had the unfortunate side effect of
disallowing the creation of device specific app domains
with fewer permissions than untrusted_app. Instead grant
all apps a neverallow exemption and blacklist specific app
domains that should still abide by the restriction.

This allows devices to add new app domains that need
/data execute permission without conflicting with this rule.

Bug: 26906711

(cherry picked from commit c5266df9)

Change-Id: I4adb58e8c8b35122d6295db58cedaa355cdd3924

am: c753392e

Change-Id: I07ac991a1982ecc25223477e3ce6a9c8ae6a15a4

am: a7d5e610

Change-Id: I482b66f4a53034a16f7a943d105f73b7b07c07b0

am: a15ea578  -s ours

Change-Id: I8acaaf29d6cd06291c45f3a1fb2e246718543922

am: e123f061

Change-Id: Ib9f66e0a8402db4d936578130e07022a5d6e2dae

Ports check_seapp to pcre2.

Merged-In: Ib9977326cfbb19ce143b04504f41afb884f2ec17
Bug: 24091652
Change-Id: Ib9977326cfbb19ce143b04504f41afb884f2ec17

b/30832947

Change-Id: Icd5117d655f1197524b39fe7bc1b11c4d920093c

am: 3a0f4f60

Change-Id: Ia17b382db5ef45be2e8936aa59de3014f8db76ee

am: a54911b6

Change-Id: I694d22230efe31c8b05374311cbe479b06c062fb

am: c3774720

Change-Id: I7ffbc6c1d4213fe68c52ded884bd9db9f6b37fb1

am: a59a44db

Change-Id: I0b63a11190a24617c2b163d23998eef659526ddc

am: 88ece842

Change-Id: Id1f699a18dcc5de07abc7434eac96db75e8fc8cb

am: 1be3b599

Change-Id: Ic03e67552c00de2971476e09820895b7fa970e80

am: 028ed753

Change-Id: Iaa9668ca04cf60d0adf43b42c3a27da824f4f094

am: fff27052

Change-Id: Ie48ab38994ecc7f5833ada2d9d3af77052361f07

am: e6cbe254

Change-Id: I40d10c04857b85bb135d01dc456d1a1812d5bd7b

am: 6ef377a0

Change-Id: I5b2d822f8414feadd61ef195a9e357ccba8481ba

am: 88c51465

Change-Id: I0033d9fa5d4f46a73e7778690fab899464154def

Specifically we need init to relabel (/dev/device-mapper, /dev/block/dm-?)
and other files in /dev/block/* from tmpfs to dm_device and block_device
respectively.

BUG=27805372

Change-Id: I16af6e803f8e4150481137aba24d5406872f9c62

am: 1cf57199

Change-Id: I8e47035f7f931d9567fdd8bb6caa7f717036c626

am: 9cb9c4bd

Change-Id: I1b8dc30e19617d9081219d38e417c4157dd88be1