Snap for 4453288 from faf1dbcf to pi-release

Change-Id: I079fcca28b416c2b162249fca5070c88595536b5

private/bug_map

@@ -3,3 +3,6 @@ update_engine update_engine capability 69197466
 vold system_data_file file 62140539
 system_server proc file 69175449
 system_server vendor_framework_file dir 68826235
+crash_dump app_data_file dir 68319037
+crash_dump bluetooth_data_file 68319037
+crash_dump vendor_overlay_file 68319037

public/charger.te

@@ -17,8 +17,8 @@ wakelock_use(charger)
 
 allow charger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
 
-# Write to /sys/power/state
-allow charger sysfs_power:file write;
+# Read/write to /sys/power/state
+allow charger sysfs_power:file rw_file_perms;
 
 allow charger sysfs_batteryinfo:file r_file_perms;
 

public/update_engine.te

@@ -12,6 +12,12 @@ allow update_engine qtaguid_device:chr_file r_file_perms;
 # Following permissions are needed for update_engine.
 allow update_engine self:process { setsched };
 allow update_engine self:capability { fowner sys_admin };
+# Note: fsetid checks are triggered when creating a file in a directory with
+# the setgid bit set to determine if the file should inherit setgid. In this
+# case, setgid on the file is undesirable so we should just suppress the
+# denial.
+dontaudit update_engine self:capability fsetid;
+
 allow update_engine kmsg_device:chr_file w_file_perms;
 allow update_engine update_engine_exec:file rx_file_perms;
 wakelock_use(update_engine);