am: f781f952

Change-Id: If31aa1ecf8dae506d7e556702f3ca08d0efdabc9

am: 21d78e0f

Change-Id: I2f9829077cf1f48b718afefc4d7d35f92d6e73b9

am: c6effa90

Change-Id: Id257877621b9375bca7d32e68d90c7a5c2a91f5d

am: 63c7ad6e

Change-Id: I5b9383b4c50d2eecd995db6943a0a27e50fb6fdd

Bug: 23113288
Change-Id: I123e5d40955358665800fe3b86cd5f8dbaeb8717

Allow bootanim process to access audioserver service.

Bug: 31651778
Change-Id: I5bec8812877792b1df3b37dddc5ccea3b243f5c4

am: d0561efe

Change-Id: Id1537bf36a218f3727caef36659a40087c19feb9

This allows the ConnectivityMetrics app to dump connmetrics service
metrics.

Bug: 31254800
Change-Id: I4c3da8cc80a5820dbed9843badc1464f3ae40581

am: 5ed3131e

Change-Id: Idd271962226c30a157c1b04f6ee3c56afe1f7f28

am: f412cc62

Change-Id: I576ad54dc5526a022e0725b15a2e326df5432e31

Bug: 31254800
Change-Id: If8708c8a4e0ea7655f31028881248a14cf2ba5f7

am: 030632f0

Change-Id: I2a2a4208770736207aeb1226f5d4f00b3eb3d57e

am: 8db0f254

Change-Id: I10537bd00dcb129741b10c3af960e7f6eacd459e

am: 35a0597a

Change-Id: I8ee43acea1274d46ca6071c472b8c7427101b384

am: 28e18c3a

Change-Id: I88bec1549bb1a28b70cb32b10911baa8d91669e9

am: a60342b7

Change-Id: I2d7c99660b6bb9b45922f1203cb1eafe90659238

bug: 30963384

(cherry picked from commit 63203a01)

Change-Id: Ifa4b9a645f8edcf51e3f025316106e5b65a4790d

am: 4af6d81b

Change-Id: I3ee22a0599e0333662a743a99ae92a8a46313135

am: 63203a01

Change-Id: I5beb026a80cf9c2c6613d77c1b798797aa10eeb5

bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5

am: ce84793b

Change-Id: Ief73a034bbd522f633cda815e7a4d0f319e78f49

am: a59830d9

Change-Id: Ibb2f08c673f62136d51b6c510b830bcc958ce236

am: 7e380216

Change-Id: I827a8b38264906bd06a8fefb9c3a8209dbc1035f

Bluetooth is sometimes started from init.

Addresses the following compiler error:

  libsepol.report_failure: neverallow on line 489 of
  system/sepolicy/domain.te (or line 9149 of policy.conf) violated by
  allow init bluetooth:process { transition };
  libsepol.check_assertions: 1 neverallow failures occurred
  Error while expanding policy

Change-Id: I2bc1e15217892e1ba2a62c9683af0f3c0aa16b86

am: 31bb306a

Change-Id: I542273a4affe02b0f7df0c90cf6bb33d77b79958

am: 76e85e8c

Change-Id: I6a7c4aa29186b32ab3dd94d028104ed50048735b

am: 69fe5d07

Change-Id: Iaaea2aaeaba08869a8885c88e07c436196134d11

am: 81fb2363

Change-Id: I129acfbecd2b8bb840c4d4897dbcc43f2ed0d2e2

am: c55cf17a

Change-Id: I48f8bbfab4cdd36e6f1555919ff5d032c07af0a2

am: eedacf83

Change-Id: I4b23d564c6a4787180fea2c1530cc78808cbd0d0

Apparently some manufacturers sign APKs with the platform key
which use renderscript. Renderscript works by compiling the
.so file, and placing it in the app's home directory, where the
app loads the content.

Drop platform_app from the neverallow restriction to allow partners
to add rules allowing /data execute for this class of apps.

We should revisit this in the future after we have a better
solution for apps which use renderscript.

Bug: 29857189
Change-Id: I058a802ad5eb2a67e657b6d759a3ef4e21cbb8cc

Previously appdomains allowed to execute off of /data
where whitelisted. This had the unfortunate side effect of
disallowing the creation of device specific app domains
with fewer permissions than untrusted_app. Instead grant
all apps a neverallow exemption and blacklist specific app
domains that should still abide by the restriction.

This allows devices to add new app domains that need
/data execute permission without conflicting with this rule.

Bug: 26906711

(cherry picked from commit c5266df9)

Change-Id: I4adb58e8c8b35122d6295db58cedaa355cdd3924

b/30832947

Change-Id: Icd5117d655f1197524b39fe7bc1b11c4d920093c

am: 1be3b599

Change-Id: Ic03e67552c00de2971476e09820895b7fa970e80

am: 028ed753

Change-Id: Iaa9668ca04cf60d0adf43b42c3a27da824f4f094

am: 6ef377a0

Change-Id: I5b2d822f8414feadd61ef195a9e357ccba8481ba