Merge "Add missing comment from my previous merge in 47966cec." into stage-aosp-master am: 55f0ecb7 am: 05928953
am: d015ea75

Change-Id: Icb3e3b8303f7edd9930cc66e44e2df09b3286efb

Merge "Add missing comment from my previous merge in 47966cec." into stage-aosp-master am: 55f0ecb7
am: 05928953

Change-Id: Ia89eaaa654e9421f895e20916ebdec0099f30042

am: 55f0ecb7

Change-Id: I8d46aa5e2b38de80ef0cd0d8028c8b2d13809b15

am: 6ae6fdbd

Change-Id: I6794b95989a210a7b9e509cd201ead6df395a405

am: 770d5f7e

Change-Id: I8e04c8b85aa2e7d6c9f7bb545cfa6de0afdaa422

am: 4ebe609a

Change-Id: I96a2b977bf125006e2453537670d1c3030872aee

am: bfbe96ac

Change-Id: I12a2ed20022edf9da528f0ab5941cc5df8e418ab

am: 5720f54f  -s ours

Change-Id: If9347a313be809312d7f63c57ee9034ed3841fff

am: 873724e0  -s ours

Change-Id: Iee307ca4ad4b6af58c7bdd121781027ad0f63ffc

am: e1be4a8c  -s ours

Change-Id: Idbe4fd24c527587cfe04df3b298d6a11cdcb099b

am: 7cb39b2b  -s ours

Change-Id: Ie6f611872338b24d7a3ceb1e47c1178e35ddf880

am: 427a0c7b  -s ours

Change-Id: I0a169fa4aecf078f35b8f18144e6634ef5fa49de

am: 427a0c7b  -s ours

Change-Id: I2716725d186d6660b5a1390224fe5c06669d6485

am: faaf86bc

Change-Id: I546b7be93591d638ad82978aca5f4823e7b6ab93

am: faaf86bc  -s ours

Change-Id: I6ac64581e0e879c4ad077eaab748ecf33dd3a73a

am: c6fed228

Change-Id: Ia53e910cfa1a516074df67820a1ad27f044fc5e9

am: adf6e309

Change-Id: Ifc312ccd0d0c6f0cc181771d90a296a679b88222

Merge "netd: relax binder neverallow rules for hwservices" am: 4fc64f2f am: d7989e8b am: e3ebb591
am: 2562e322

Change-Id: Ia4d1497d9de70b5e1265614543366c34d2bb909a

am: 1dd3a55e  -s ours

Change-Id: Ie6a8467402b585371bc5819991c315e58fe9f04e

am: e934bee6

Change-Id: I9943ee2240a108031b10f7e5123a8b239ef872bf

am: 8e589af6

Change-Id: I5d9f0e7908d62aa4a0c3e5d626ad40dd281c50b0

am: 275f6dd5

Change-Id: I02b2eb1a5bbd0cf3a4bbeffbe70e442ba4cf8ee6

am: e3ebb591

Change-Id: Ib9588de643e54cada696392b1957bd78325e857b

avc: denied { read } for pid=1704 comm="top" name="stat" dev="proc" ino=4026532297 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_stat:s0 tclass=file permissive=0
avc: denied { read } for pid=1636 comm="dumpstate" name="lcd-backlight" dev="sysfs" ino=16592 scontext=u:r:dumpstate:s0 tcontext=u:object_r:sysfs_leds:s0 tclass=lnk_file permissive=0
avc: denied { call } for pid=2230 comm="dumpsys" scontext=u:r:dumpstate:s0 tcontext=u:r:installd:s0 tclass=binder permissive=0
avc: denied { create } for pid=1700 comm="ip" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=netlink_xfrm_socket permissive=0

Bug: 62410287
Bug: 35350306
Change-Id: I65be3678c64214ebeb544e0e155bce88b21adf02
Signed-off-by: Tim Kryger <tkryger@google.com>

Clean up the remaining granted permissions in domain_deprecated.

avc: granted { read open } for comm="uncrypt"
path="/sys/firmware/devicetree/base/firmware/android/fstab/compatible"
dev="sysfs" ino=17591 scontext=u:r:uncrypt:s0
tcontext=u:object_r:sysfs:s0 tclass=file
avc: granted { getattr } for comm="uncrypt"
path="/sys/firmware/devicetree/base/firmware/android/compatible"
dev="sysfs" ino=17583 scontext=u:r:uncrypt:s0
tcontext=u:object_r:sysfs:s0 tclass=file

vc: granted { read open } for comm="update_engine"
path="/sys/firmware/devicetree/base/firmware/android/fstab" dev="sysfs"
ino=17258 scontext=u:r:update_engine:s0 tcontext=u:object_r:sysfs:s0
tclass=dir
avc: granted { getattr } for comm="update_engine"
path="/sys/firmware/devicetree/base/firmware/android/fstab/compatible"
dev="sysfs" ino=17259 scontext=u:r:update_engine:s0
tcontext=u:object_r:sysfs:s0 tclass=file

Bug: 28760354
Test: build
Change-Id: Id318ce84894c1001361923f5205de093a15c1e6a

am: d7989e8b

Change-Id: I1e148607abab46b1733bfeafa3faef6e250ecc47

am: 4fc64f2f

Change-Id: I7dd6ea7bb5d767afb98a39e56214dd05d4585c93

Test: I solemnly swear I tested this conflict resolution.

Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5
Change-Id: Id19f3f30daa4bff64db75d8d4a48a8f077bfc75d

Test: Built.
Change-Id: Ia5f5b52e10e9411cd87901053675d9e77a622529

am: 47966cec

Change-Id: If294b49998475d4cdfb4435d720a494f10325ab8

Test: I solemnly swear I tested this conflict resolution.

Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5
Change-Id: I1f087fe5e7a71761a16673331619f52998473b44

Relax neverallow rule restricting binder access to/from netd so that
netd can export hwbinder services to vendor components.

Continue to disallow app access to netd via binder.

Bug: 36682246
Test: build
Merged-In: I8e558ea1add6c36b966ec1da204062ea82df3f3f
Change-Id: I063df6dded94d8b0f5214b2c94c4f46bdafb03d7

Relax neverallow rule restricting binder access to/from netd so that
netd can export hwbinder services to vendor components.

Continue to disallow app access to netd via binder.

Bug: 36682246
Test: build
Change-Id: I8e558ea1add6c36b966ec1da204062ea82df3f3f
(cherry picked from commit 07c650eb)

Relax neverallow rule restricting binder access to/from netd so that
netd can export hwbinder services to vendor components.

Continue to disallow app access to netd via binder.

Bug: 36682246
Test: build
Change-Id: I8e558ea1add6c36b966ec1da204062ea82df3f3f

This should improve performance, as file_contexts is slower than
genfs_contexts.

Bug: 62413700
Test: Built, flashed, and booted Sailfish.  Verified that the
files have the correct context and that wifi, web, and atrace work.

Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5
Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef

am: 3c5e3f94

Change-Id: I9547735f91d7d9fb1ad5bbf8122945c3342d5410