am: 0d12c356

Change-Id: I245c2914f51f317758148123dc1368c326f562f1

am: 324e6ef5

Change-Id: I6ed15ce344d61eab4d81928b09020d7fb0fb757a

am: 17d008ae

Change-Id: Ib6305067a4f3bf30df918c63a049b7d689f9c255

We already grant rw file access, but without dir search it's not much
use.

denied { search } for name="vibrator" dev="sysfs" ino=49606 scontext=u:r:hal_vibrator_default:s0 tcontext=u:object_r:sysfs_vibrator:s0 tclass=dir permissive=0

Bug: 72643420
Test: Builds, denial gone
Change-Id: I3513c0a14f0ac1e60517009046e2654f1fc45c66

am: 50830871

Change-Id: I23c9f800c4faab0d03a9d239bbb2d0a61b6263ab

am: 42756b76

Change-Id: Ia8e879b894c75a28461bd90e86888703c20a604a

am: a6acef9a

Change-Id: I4a6816ae90ced3afb04f8d40afb2267f3a2994cf

Bug: 73952536
Test: run cts -m CtsCameraTestCases -t android.hardware.camera2.cts.IdleUidTest#testCameraAccessBecomingInactiveUid
Change-Id: I508352671367dfa106e80108c3a5c0255b5273b2

am: 426f78ca

Change-Id: I4f1983feed32c668d723932c61a6f51692c61f53

am: 7a22490c

Change-Id: I3e6731b04314f9c54c016c1c7584242cdd12e75f

am: 609aa6b8

Change-Id: I261753961c59527061254f0b1c7adca50a7c2bce

am: e39ba338

Change-Id: I56e9182157c8de6c3135ae8a33962bca46c405dd

am: d69acbbf

Change-Id: Id2e01070d5669362b78f4adc865c4ff358711e60

am: 142bb78c

Change-Id: I1e721f2bfb59d2510769b7ddae9c22d5c8ae7dba

am: 5b1c3b69

Change-Id: I8808fd94c8130a551803b2ed184c325d3dad86cb

am: 5d3e4f0c

Change-Id: I56412b40f7f306ac32b588aba8de9a48a4f16c00

am: ebc7b434

Change-Id: If7f94440e35ad5a009ac6fa9d1cda3cb4fc17825

The kernel is unusual in that it's both a core process, but vendor
provided. Exempt it from the restriction against accessing files from
on /vendor. Also, rework the neverallow rule so that it disallows
opening/modifying files, but allows reading files passed over IPC.

Bug: 68213100
Test: build (this is a build-time test)
Change-Id: I2f6b2698ec45d2e8480dc1de47bf12b9b53c4446

avc: denied { getattr } for path="/vendor/framework"
scontext=u:r:system_server:s0 tcontext=u:object_r:vendor_framework_file:s0
tclass=dir

Bug: 68826235
Test: boot Taimen, verify denials no longer occur.
Change-Id: Id4b311fd423342c8d6399c3b724417aff9d1cd88

Allow hal audio to use vndbinder

Change-Id: I83fc8d5b873bfc4e36f44e423d5740cb5e9739ee

am: 6e056dd6

Change-Id: Iead5e09dc52386aa88e6f2f4fd8df862f71e98f5

am: 1be44b83

Change-Id: Idc0e47c8644e5fcc93c04eca7bba7c0023c49c24

am: e32d9406

Change-Id: I92c156c14675d82d8678df545a168d1a74774cac

Now that Bluetooth supports delay reporting, audioserver needs
access to Bluetooth Properties in order to determine whether the
feature is enabled or disabled.

Bug: 32755225
Test: Enable the property and see that there was no error accessing it
Change-Id: I519d49deb2df4efb3cc2cce9c6d497db18b50c13

am: 067bc406

Change-Id: I3c71ec9699fae580c374c6e22eb2eae62a2d49b1

am: 4d168f1a

Change-Id: Ide10d23eafbb249e0ef5d264d956ce74af38d847

am: 641608a9

Change-Id: I82643e6e2f8eb626f1644efe94a89529c396b3a2

am: e5017318

Change-Id: I8fd310b4b3ba5da15826245b63276612cf5cbcfc

am: f7066845

Change-Id: I209563c2eeb181452e0ef196f7a8bcff1d4ce3dc

am: e31157d9

Change-Id: Ib843d139377ebcaf716d54108a2197ccc14b25bb

am: d647799d

Change-Id: Ic463f569bfe91dde1981168fb81654855ca6dc01

am: 8ce9b83f

Change-Id: I403a4bfdb235629105ff5e33dff1930100551ad2

am: 969d8cc4

Change-Id: I31f387a654065d5311a3f7b484a9833c0d5ba973

am: a6c6c046

Change-Id: I3e584da883f26d70b5269c101bd83afbf54bee10

am: 40a8bce6

Change-Id: I8946fbe77bcec0a30aa68752c38d1b49423b659d

am: b47efe34

Change-Id: Ida8efdbc56d4f1827a5b2e84122164d5ec1ee68f

* changes:
  Enable treble_sepolicy_tests against 27.0 release.
  Refactor build rule for treble sepolicy tests.