am: 98ff70cc

Change-Id: Ia8d1ee546acddb9b19827e6db9d6ce1d8d25411d

am: 2b33112a

Change-Id: I08987ae7229ebbbbcf980be4aaef2eb8fb7e24da

boolean and setenforce macros are not used in base policy
and cannot be used in any policy, since they violate
neverallow rules.

Remove these from the policy.

Change-Id: Icc0780eaf06e95af36306031e1f615b05cb79869
Signed-off-by: William Roberts <william.c.roberts@intel.com>

am: e4025649

Change-Id: Ief8c1bb3927c2dca50459db8e71b330e0a58608e

am: 19b6485f

Change-Id: I0574ab7e70a8b3d906a5b11368239d58d1d64e70

With v4.8+ kernels, CAP_WAKE_ALARM is needed to set
alarmtimers via timerfd (this change is likely to be
backported to stable as well).

However, with selinux enabled, we also need to allow
the capability on the system_server so this enables it.

Change-Id: I7cd64d587906f3fbc8a129d48a4db07373c74c7e
Signed-off-by: John Stultz <john.stultz@linaro.org>

am: 98fbb318

Change-Id: Ic7ffa7d6571647a165f83b47906f33908ac7745d

am: aa2aa219

Change-Id: I5e1634a8c0cee6cb759e0acea086b68dbd21fb7e

Bug: http://b/30317429
Change-Id: I5c499c48d5e321ebdf588a162d29e949935ad8ee
Test: adb shell dmesg | grep ueventd

am: 0f38c642

Change-Id: I0c0664680e916d1d8884ed77a129ddae13189d84

am: e88095d8

Change-Id: I2c5eb3e2d46ec6e8f2b41bdd614e7abacd2113d8

am: 362d6ff1

Change-Id: Ibe19ac1955bad48b5fa1db7ffada46aa78781781

Change-Id: I87b6797cd2bc9efafe2590e1f69d5787de99af07

am: 320a0f54

Change-Id: Id8486a660a4426798f2843d3c2e33c9c64447fd6

Change-Id: Ia938d73b1a49b9ba4acf906df37095d21edee22e

Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff
Bug: 19160983

Change-Id: Ia938d73b1a49b9ba4acf906df37095d21edee22e

am: 4cffd854

Change-Id: I6903431d1c1bc117a4af1c856681722c22f9f7e0

am: 23d703ee

Change-Id: I98383d496812ced491a892c1ffb29527d77c63a9

Bug: 30156807
Change-Id: Ie9faf72d35579fa69b4397bdffc8d674f040736c

am: 2c4718fc

Change-Id: I9d5bc1904eb8ee7bc5ea1203bc30274639e53caf

Change-Id: Ic549f8c8060a17981302f2af75debf34595475bb

* changes:
  adbd: allow reading apk_data_file
  adbd: allow reading rootfs dir

avc: denied { search } for comm=73657276696365203139 name="app" dev="sda35" ino=770049 scontext=u:r:adbd:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir permissive=0

Bug: 30000600
Change-Id: I86958ebcca815ee1779f85fb425592493f40101a

Bug: 30213958
Change-Id: I0449575a5ec6cc4997bc36a13676474505a4190f

am: 7d9487c9

Change-Id: I126ab87aa6aaf06aee132d912889f25d82c78ca4

am: afad0c35

Change-Id: Id4a4937cc3b7c2ddd6d363144e6fafc90be60498

am: a584f2f6

Change-Id: If3cd0f298578fc81ed1659d855743e57f551801b

am: ee69a2e7

Change-Id: If61f5720180243ec1b5aa9e16d66c95c37f49b88

am: e0585ca8

Change-Id: I473381ffec422498cab41973e7e4f3119ddf6a64

am: 83348b0b

Change-Id: Ia19aeffe64e733deb695206dcbd8cb824c9db222

untrusted_app lost all of the domain_deprecated permissions in N,
including the ability to read asec_apk_file dirs.  This is used for
forward locked apps.

Addresses the following denials:
avc: denied { search } for name="asec" dev="tmpfs" ino=9298 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:asec_apk_file:s0 tclass=dir permissive=0
avc: denied { getattr } for path="/mnt/asec" dev="tmpfs" ino=9298 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:asec_apk_file:s0 tclass=dir permissive=0

(cherry-pick of internal commit: addd3c9f)

Bug: 30082229
Change-Id: I87758f1daee19197d9299bca261f0324e01af5e0

am: 479712b0

Change-Id: I3b2c84810c4c40e86b6e4c0ba0154c009626537d

avc:  denied  { find } for service=drm.drmManager pid=4320 uid=1027 scontext=u:r:nfc:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager

Arrange in alphabetical order.

Bug: 30112127
Change-Id: I6592497a937c6a6d2c7c3d444beba3db333f4852
(cherry picked from commit 24ad5862)

am: 4970997a

Change-Id: I74394634be2c91d10d69f3bac82d56c82e48ea8d