Merge changes If2413c30,Ic5d7c961 am: 45b4704e am: 1382984c

am: 8f126091

Change-Id: Ic2fef87250cc7cf2db32b9c6fcc86be4ceb65ee1

private/netutils_wrapper.te

@@ -33,3 +33,9 @@ domain_auto_trans({
     -coredomain
     -appdomain
 }, netutils_wrapper_exec, netutils_wrapper)
+
+# suppress spurious denials
+dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
+
+# netutils wrapper may only use the following capabilities.
+neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };

private/zygote.te

@@ -114,6 +114,9 @@ allow zygote tmpfs:dir r_dir_perms;
 get_prop(zygote, overlay_prop)
 get_prop(zygote, exported_overlay_prop)
 
+# ingore spurious denials
+dontaudit zygote self:capability sys_resource;
+
 ###
 ### neverallow rules
 ###