am: cdf186e4

Change-Id: I89df277c7a3ce19a69f6d3b5f2a4960515da8a2c

Configstore HAL uses a seccomp filter which blocks the standard
path of execing crash_dump to collect crash data. Add permission
to use crash_dump's fallback mechanism.

Allowing configstore to write to the socket provided by tombstoned
required either exempting configstore from a neverallow rule, or
removing the neverallow rule entirely. Since the neverallow rule
could potentially prevent partners for doing security hardening,
it has been removed.

Bug: 64768925
Bug: 36453956

Test: killall -ABRT android.hardware.configstore@1.1-service
    Results in a call stack in logcat, and tombstone in
    /data/tombstones
Test: configstore runs without crashing
Test: SANITIZE_TARGET="address coverage" make vts -j64
    vts-tradefedrun commandAndExit vts --skip-all-system-status-check \
    -primary-abi-only --skip-preconditions -l VERBOSE --module \
    VtsHalConfigstoreV1_0IfaceFuzzer

Change-Id: I1ed5265f173c760288d856adb9292c4026da43d6
(cherry picked from commit 9924d782)

am: cf627a49

Change-Id: I4c5d4a99d99bc95957c0083068f9299d769e9d57

am: c5bdf47c

Change-Id: Ic0c64373023fad16c4c54f57851cef4bf5360d1a

* changes:
  DO NOT MERGE: use 'expandattribute' for untrusted_app_visible_hwservice
  DO NOT MERGE: Add a way to allow untrusted_apps to talk to halserver domains
  DO NOT MERGE: Revert "Revert "Remove neverallow preventing hwservice access for apps.""

Bug: 62658302
Test: Boot device and observe no new denials

Change-Id: If9a21610897b14a419f276289818127412c29c55
Signed-off-by: Sandeep Patil <sspatil@google.com>

Vendor HAL extentsions are currently allowed to discover hardware
services that are labelled with 'untrusted_app_visible_hwservice'.
However, the policy doesn't allow these apps to talk to these services.
This CL makes sure that is now possible via the
'untrusted_app_visible_halserver' attribute for vendor domains that host
such a service.

Bug: 64382381
Test: Boot device and observe no new denials.

Change-Id: I1ffc1a62bdf7506a311f5a19acdab8c7caec902b
Signed-off-by: Sandeep Patil <sspatil@google.com>

am: 282d599f

Change-Id: I0dd51bc443866c43407f72ccf1da55fb85833abf

am: 51572137

Change-Id: I2137c4aff726537196f6799d5368fa2391e7f019

am: 7c55e171

Change-Id: I266e4a9374fa256adfba46a51325478e288fd22c

Performanced needs to talk to the permission service to verify
permissions of clients to access certain restricted scheduler
policies.

Bug: 64337476
Test: performance_service_tests passes; logs do not contain avc
      denials for performanced -> permission service.

Change-Id: I31618ab1d3e79c3c10138d567b0f5606527020f9

This reverts commit ceed7204.

New HALs services that are added in the policy while the CL was reverted
will are not made visible to applications by default. They are:
  hal_neuralnetworks_hwservice
  hal_wifi_offload_hwservice
  system_net_netd_hwservice
  thermalcallback_hwservice

Bug: 64578796
Test: Boot device

Change-Id: I84d65baddc757a5b0a38584430eff79a383aa8e0
Signed-off-by: Sandeep Patil <sspatil@google.com>

Make sure that any attributes removed from policy are declared
in the mapping file, in case they are relied upon by vendor
policy.

Bug: 36899958
Test: Builds successfull, but not with removed attribute not
in mapping file.
Change-Id: I25526cd88a50e90513ae298ccf4f2660e4627fb4

Bug: 63910933
Test: boot sailfish in normal mode, checks adbd is started
Test: boot sailfish in recovery mode, checks adbd is started
Test: boot bullhead in normal mode, checks adbd is started
Test: boot bullhead in recovery mode, checks adbd is started

Change-Id: I35ed78a15a34626fbd3c21d030e2bf51033f7b79

Test: gts-tradefed run gts-dev --module=GtsSecurityHostTestCases
Bug: 64127136
Change-Id: Ib50294488bb1a5d46faed00d6954db64648fed20

am: 1d5131e9

Change-Id: Ib7c75f525c905b0bbdb2a9dae43ba2fe4a209122

am: 78b3d573

Change-Id: I097dadd96f4b1c73e0092ac57e4e4d126461cc8a

The treble compatibility tests check for policy differences between old
and new policy.  To do this correctly, we must not modify the policy which
represents the older policies.  Move the files meant to be changed to a
different location from the ones that are not meant to be touched to avoid
any undesired changes to old policy, e.g. commit:
2bdefd65078d890889672938c6f0d2accdd25bc5

Bug: 36899958
Test: Build-time tests build.
Change-Id: I8fa3947cfae756f37556fb34e1654382e2e48372

am: 124e1f65

Change-Id: Iba3dd4ccfd1335d5cdb6b686865096f60daaae39

am: 346a913c

Change-Id: If186db958ffcdb22d68e8a4cd6dd9b9f07e43e91

am: 12d1c4f7

Change-Id: Ifbdf852456a7fdfd13b03ae307c9716a7b35701a

am: f27bba93

Change-Id: I402b01b2930ba30293c441f413c7b40f5abdf469

untrusted_app_visible_hwservice was an attribute that was meant to
give partners time to add their HALs to AOSP.  It was removed from mr1
and so needs to be accounted for in the compatibility mapping.

Bug: 64321916
Test: Builds with treble policy tests.
Change-Id: I359a842083016f0cf6c9d7ffed2116feb9e159c6

Only seeing this denial in permissive:
allow shell screencap_exec:file getattr;

Bug: 37565047
Test: adb shell screencap w/o root
Test: cts-tradefed run cts-dev --module CtsAadbHostTestCases
Change-Id: I9f31d2067e002e7042646ee38dbfc06687481ac7

On Full Treble devices, servicemanager should only service
services from the platform service_contexts file.

Created new type to separate plat_ and nonplat_service_contexts,
and added new type to mapping (although I don't think this type
should have been used by vendors).

Bug: 36866029
Test: Marlin/Taimen boot
Change-Id: Ied112c64f22f8486a7415197660faa029add82d9

Allow vendors to extend e2fs rules to format other partitions.

Bug: 64430395
Change-Id: I51566f72dea814af97b1fedbd4618cd4095d64c3

Also fix up set() additions in mini_parser.py and add global reference to
the parser in tests for clarity.

Bug: 36899958
Test: rm public type in old policy from policy and observe test failure.
Change-Id: I6cba2473526798be871cd69249c9bbc6df2c5b4c

am: 7f7c3b82

Change-Id: I837282bfcae027b959405db611639a203e37bdfe

Add support to the treble_sepolicy_tests suite that explicitly look at
the old and current policy versions, as well as the compatibility file,
to determine if any new types have been added without a compatibility
entry.  This first test catches the most common and likely changes that
could change the type label of an object for which vendor policy may have
needed access.  It also should prove the basis for additional compatibility
checks between old and new policies.

Bug: 36899958
Test: Policy builds and tests pass.
Change-Id: I609c913e6354eb10a04cc1a029ddd9fa0e592a4c

am: aaa94fa9

Change-Id: I2c7517758d6839f127f8a077f7719e2bf4922a49