am: 67b2da44

Change-Id: Ie60e34e34cb091571f3e733c94a8e572d4c85e9b

Bug: 67848572
Test: mma
Change-Id: I75520b6aa19e44854129697b3c3e375427356e6a

This change allows wpantund to call any binder callbacks that have
been registered with it. Generally, only privileged apps are allowed
to register callbacks with wpantund, so we are limiting the scope for
callbacks to only privileged apps. We also add shell to allow the
command-line utility `lowpanctl` to work properly from `adb shell`.

Cherry-picked from commit 17319cb3.

Bug: b/67393078
Test: manual
Change-Id: I64c52cc5e202725a81230dc67e1cd7c911cf8e1c

am: 0ca69733

Change-Id: Ibdc77a53988ebf76d3786fff738ffadb577091c2

Addresses:
Warning!  Type or attribute hal_drm_server used in neverallow
undefined in policy being checked.

Bug: 67296580
Test: Build
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38
Change-Id: I07f9825536637a21a91c77e87366861503f6ebac

am: 03596f28

Change-Id: I5fe53ee3d82ea83b97bf9de91dfdae897df06445

This file is necessary for using an mr1 system image in conjunction
with an oc-dev vendor image.  This is currently needed by GSI testing,
for example.

Bug: 66358348
Test: File is included on system image.
Change-Id: I3a6b7ed5edf1c07941bbf835e70f2ae8d03fee25

am: 8c8994f5

Change-Id: Ia25366a937ca35cd7b0ab4a8c1cfcdc6abd4d9ba

am: f8e09172

Change-Id: I911b1bfd9a2f1add2374acc9ee3159f0dbc165a8

type=1400 audit(0.0:6): avc: denied { read } for comm="Thread-5"
name="cache" dev="dm-0" ino=13 scontext=u:r:system_server:s0
tcontext=u:object_r:cache_file:s0 tclass=lnk_file permissive=0

Bug: 64067152
Bug: 65843095
Test: build
Change-Id: Ie90c0343a834aa87b7ded41f503e05d9b63b3244
(cherry picked from commit a4cada74)

am: 6b8088ba

Change-Id: Id33c3e7f23b84fa10bad8c2ee7bf7c44265acc25

Particularly useful for suppressing selinux logspam for debug-only
permissions.

Bug: 65843095
Test: build, boot, and run tests on user and userdebug builds.
Change-Id: I18ce0b2cf1e96ca037e93309dddb476a150b677f

It's used in CTS neverallow tests.

Addresses:
Warning!  Type or attribute hal_cas_server used in neverallow
undefined in policy being checked.

Bug: 66910049
Test: build
Change-Id: Ia185f266fc1e3cb87c39939fdd45d02efa6c2c94
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38

am: 5d8b059f

Change-Id: I511ddcdb2f8bec7b52985e25b0c9d4c8d763cf21

These are no longer necessary as domain_deprecated has been
removed in AOSP master.

Bug: 66749762
Test: build
Merged-In: I99953ecc7d275fdbe8e56d8f47a27d1f9e1cc09a
Change-Id: I01878a4410f8cb3c97ff96c67845dfaa7b0051ce

Bug: b/64090883
Change-Id: I566a380db2f8f4d886252eee26181e37a4fb0d61

* changes:
  RESTRICT AUTOMERGE: lowpan: Add wpantund to SEPolicy
  RESTRICT AUTOMERGE: lowpan: Added support for LoWPAN Service and android.hardware.lowpan

Bug: b/64399219
Test: Manual
Change-Id: I4f6c7e4e3339ae95e43299bf364edff40d07c796

Bug: b/64090883
Bug: b/33073713
Test: Manual
Change-Id: I7aa23c31b1fccae56c1a0e0bd4cfe370aeb911dd

am: 4c4b433c

Change-Id: Ibb136df8fadd90013455cd8ff476ed28551f40e2

Added permission related to use of wake lock. Wakelock in sensor
HAL is used to gurantee delivery of wake up sensor events before
system go back to sleep.

Bug: 63995095
Test: QCOM and nanohub sensor hal are able to acquire wakelock
      successfuly.

Change-Id: Id4ac3552e18a1cad252017e3dc9ab3d4be8d4ab9
Merged-In: Id4ac3552e18a1cad252017e3dc9ab3d4be8d4ab9

am: aa5f37da

Change-Id: I2bf881164990b2517b81d3bf3b6560537dc94636

Addresses:
junit.framework.AssertionFailedError: The following errors were
encountered when validating the SELinuxneverallow rule:
neverallow {   domain   -adbd   -dumpstate   -hal_drm -hal_cas -init
-mediadrmserver   -recovery   -shell   -system_server }
serialno_prop:file { getattr open read ioctl lock map };
Warning!  Type or attribute hal_cas used in neverallow undefined in
policy being checked.
libsepol.report_failure: neverallow violated by allow mediaextractor
serialno_prop:file { ioctl read getattr lock map open };
libsepol.report_failure: neverallow violated by allow mediacodec
serialno_prop:file { ioctl read getattr lock map open };
libsepol.report_failure: neverallow violated by allow hal_cas_default
serialno_prop:file { ioctl read getattr lock map open };
libsepol.check_assertions: 3 neverallow failures occurred

Bug: 65681219
Test: build
Change-Id: I2a6445d6372ee4e768cc2cea2140c6de97707a74
Merged-In: I1092aff40da9dcf09bd044400bedd1f549eb7e38

am: 99ee8b97

Change-Id: I56484d6fe14ecdb3028c6dfa29ee0c590d1e617c
(cherry picked from commit 544a7317)

am: 123cf237

Change-Id: Ic6b60c2168b9f5b75cbeaeebee2acd5310df489d

am: 15f9d052

Change-Id: I0c1390ade37884ff86a8089d25c9cce794b31877

am: ba4d04e0

Change-Id: I54773febe86aeb79eba33494f5481762f2698584

am: 60e53837

Change-Id: I43de8298c9dac061ca6fbd81e17fb4b8eed904c3

am: f606a51e

Change-Id: Id385d64ac63bee08c1457f0a003718ecb03546ea

am: 9c571765

Change-Id: I6ea1d962cf03ee18102e22d29df59749afc3d5bd

Allows groups to be mounted at /dev/memcg

Addresses:
avc: denied { associate } for comm="init" name="memcg"
scontext=u:object_r:cgroup:s0 tcontext=u:object_r:tmpfs:s0
tclass=filesystem permissive=0

Bug: 64067152
Test: build
Change-Id: Ic8f641e841fe09c8f7fd487ed67cf0ab4860a1cc

Currently lmkd is not able to read memcg info. The mem/swap usage
info are used by lmkd to ugrade medium pressure events to critical
level.

Test: tested on gobo
Bug: 65180281
Change-Id: I19d0eb53d5e754c176ffeda1b5d07049e6af8570

This reverts commit f27bba93.

Bug: 65206688

Change-Id: I8e61b77a1abe9543e4fba77defb8062407676fcf