am: 1b433165

Change-Id: Icfea6a7041a010be502d31b4082e8bf242abf3de

am: ff146962

Change-Id: Ia7fac0ce2f9818d94c9b9f55e1e42f7bdd8cf462

This is needed to be able to scan the labels we have
permission on.

Denial:

04-06 12:52:22.674   874   874 W traced_probes: type=1400 audit(0.0:10314): avc: denied { search } for name="backup" dev="sda45" ino=6422529 scontext=u:r:traced_probes:s0 tcontext=u:object_r:backup_data_file:s0 tclass=dir permissive=0

Bug: 73625480

am: 46e4c189

Change-Id: Ieb549d5211f6906a8a65715d64f645ddd44155cb

am: 04529dc6

Change-Id: I630f9fe7b662cdb87094eb90a7bf24d62a0b4876

This should help fix presubmit tests.

Bug: 77634061
Test: Built policy.
Change-Id: Ib9f15c93b71c2b67f25d4c9f949a5e2b3ce93b9c

am: 558cdf1e

Change-Id: I998cb4d7b507c39ddd027a9e24646303c4765512

am: 62861f86

Change-Id: Ia6eefc0d79c77ba363faccb42fb3e8d9e7f9ce24

am: c9dd7149

Change-Id: Ideee1c776e572f0e8d90eb340f1d2e58b1182a4c

am: e505a35d

Change-Id: I7183822e3930dc6ef1b995027d784831b74aaf9f

am: 7a99df89

Change-Id: I577f211e913fd5ad2150a54d6931a810ec58cb43

am: f3220aa6

Change-Id: Ibf50ab24fa12e07fc44e89420bba99d5665156d9

am: 9d28625f

Change-Id: Iadb2f23c577f3641ed9785891c97a000d757957a

avc: denied { read } for name="ext4" dev="sysfs" ino=32709
scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0
tclass=dir permissive=0 b/72749888
avc: denied { read } for name="state" dev="sysfs" ino=51318
scontext=u:r:priv_app:s0:c512,c768
tcontext=u:object_r:sysfs_android_usb:s0 tclass=file permissive=0
b/72749888

Bug: 72749888
Test: build/boot taimen-userdebug. No more logspam
Change-Id: Ic43d1c8b71e1e5e0e6f9af1e03816c4084120e7e

System components should use the public tagSocket() API, not direct
file access to /proc/net/xt_qtaguid/* and /dev/xt_qtaguid.

Test: build/boot taimen-userdebug. Use youtube, browse chrome,
    navigate maps on both cellular and wifi.
Bug: 68774956

Change-Id: Id895395de100d8f9a09886aceb0d6061fef832ef

Remove unecessary access to /proc/net/xt_qtaguid/ctrl and
/dev/xt_qtaguid.

Bug: 68774956
Test: atest CtsNativeNetTestCases
Test: adb root; atest tagSocket
Change-Id: If3a1e823be0e342faefff28ecd878189c68a8e92

am: 5f98693a

Change-Id: Iaeaaeb8195e2ffcbf148b1764d57d4e1c7da6f4f

am: 985db6d8

Change-Id: I1c05fb2469df71f5572aaf8ed88333dc3c92d3c5

Bug: 72177715
Test: flash device and check incident output
Change-Id: I16c172caec235d985a6767642134fbd5e5c23912

am: 3c0b8c01  -s ours

Change-Id: I1a3b2f22453bf846f0d68d13aa72c57822c336a8

am: f7d49787

Change-Id: Ia141cdcd71b7f76a566ce2f9d0cf720d90693af2

am: d093691c

Change-Id: Ie6ffba47ea2164260d60115a738c57f0e47f04be

am: 38a84cf8

Change-Id: I76cbd596ac70b065c288b30855db956fd456b5f6

am: 40e6b795  -s ours

Change-Id: I08541ef49695b32c24cdfcff9c112cb9cf7c9ccb

am: 7698c72f  -s ours

Change-Id: I8e68dd92f2513906a0fcceaffaeb464b7ff66237

* changes:
  Test that /proc files have proc_type attribute.
  Assert types labeled in genfs_contexts have correct attributes

am: c9f91a8c

Change-Id: I19acbd57012782c82995dacd3165a6ae8605c00a

am: c69cbe55

Change-Id: I741c90bf96d43b6ab5227696ac24d8891cf5dc97

am: 9f33cad7  -s ours

Change-Id: I71e710f8cae8cceb8eaaea8cfe007561487feee5

am: 252b0153

Change-Id: I1800da081c5f164c35a470978053514f67c016da

Because applications should be able to set the receive
timeout on UDP encapsulation sockets, we need to allow
setsockopt(). getsockopt() is an obvious allowance as
well.

Bug: 68689438
Test: compilation
Merged-In: I2eaf72bcce5695f1aee7a95ec03111eca577651c
Change-Id: I2eaf72bcce5695f1aee7a95ec03111eca577651c

Test: build
Bug: 68774956
Change-Id: I0f9fd87eb41e67e14f35e49eba13e3d1de745250

The file under /proc/net/xt_qtaguid is going away in future release.
Apps should use the provided public api instead of directly reading the
proc file. This change will block apps that based on SDK 28 or above to
directly read that file and we will delete that file after apps move
away from it.

Test: Flashed with master branch on marlin, verified phone boot, can
      browse web, watch youtube video, make phone call and use google
      map for navigation with wifi on and off.
      run cts -m CtsNetTestCases -t android.net.cts.TrafficStatsTest
      run cts -m CtsAppSecurityHostTestCases -t \
      		android.appsecurity.cts.AppSecurityTests

Change-Id: I4c4d6c9ab28b426acef23db53f171de8f20be1dc
(cherry picked from commit 5ec8f843)

am: 950388f0  -s ours

Change-Id: I4f19bd1606be3e17f03b3c63d2265b8f01f663b0