Bug: 26039641
Change-Id: Ifd96b105f054b67f881529db3fe94718cab4a0f4
(cherry picked from commit 8eaf2585)

The update_engine daemon from Brillo is expected to be used also in
Android so move its selinux policy to AOSP.

Put update_engine in the whitelist (currently only has the recovery
there) allowing it to bypass the notallow for writing to partititions
labeled as system_block_device.

Also introduce the misc_block_device dev_type as update_engine in some
configurations may need to read/write the misc partition. Start
migrating uncrypt to use this instead of overly broad
block_device:blk_file access.

Bug: 23186405
Test: Manually tested with Brillo build.

Change-Id: Icf8cdb4133d4bbdf14bacc6c0fa7418810ac307a
(cherry picked from commit a10f789d)

Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440

Change-Id: I08aaf89e2ef23f9528d107a1c9d66c1c9979b3ac

am: 32d207e0

* commit '32d207e0':
  Enable permission checking by binderservicedomain.

binderservicedomain services often expose their methods to untrusted
clients and rely on permission checks for access control.  Allow these
services to query the permission service for access decisions.

Bug: 25282923
Change-Id: I39bbef479de3a0df63e0cbca956f3546e13bbb9b

This reverts commit cda36e31.
This will be moved to a device specific file.

BUG: 24555181

Change-Id: I0eb543211245c37da77bbf42449f70ff3fdf79ec

am: 5eac9217

* commit '5eac9217':

am: a8bbe96d

* commit 'a8bbe96d':

am: 7d20f408

* commit '7d20f408':

am: 6ab438dc

* commit '6ab438dc':
  untrusted_apps: Allow untrusted apps to find healthd_service.

This allows apps to find the healthd service which is used to query
battery properties.

Bug: 24759218
Change-Id: I72ce5a28b2ffd57aa424faeb2d039b6c92f9597d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

* commit '9fcc949f':
  bluetooth.te: Relax bluetooth neverallow rule.

* commit '63af426a':
  bluetooth.te: Relax bluetooth neverallow rule.

am: 33a779fe

* commit '33a779fe':
  bluetooth.te: Relax bluetooth neverallow rule.

Bug: 24866874
Change-Id: Ic13ad4d3292fe8284e5771a28abaebb0ec9590f0

Bug: 21445745
Change-Id: I59fd20f61a5e669e000f696f3738cc11071920aa

* commit '48dae29f':
  Allow system_server to bind ping sockets.

This allows NetworkDiagnostics to send ping packets from specific
source addresses in order to detect reachability problems on the
reverse path.

This addresses the following denial:

[  209.744636] type=1400 audit(1441805730.510:14): avc: denied { node_bind } for pid=8347 comm="Thread-202" saddr=2400:xxxx:xxxx:xxxx:40b1:7e:a1d7:b3ae scontext=u:r:system_server:s0 tcontext=u:object_r:node:s0 tclass=rawip_socket permissive=0

Bug: 23661687

(cherry picked from commit c3712143)

Change-Id: Ia93c14bc7fec17e2622e1b48bfbf591029d84be2

* commit '0b764ae9':
  Allow untrusted_app to list services.

CTS relies on the ability to see all services on the system to make sure
the dump permission is properly enforced on all services.  Allow this.

Bug: 23476772
Change-Id: I144b825c3a637962aaca59565c9f567953a866e8

Bug: 23375670
Change-Id: I0454c580b465a2f0edc928cf0effb71733866f03

am 4496a389: am 78b54b5d: am bf323ff8: am 21827ff0: am f82f5e01: Accept command-line input for neverallow-check.

* commit '4496a389':

am f84c740b: am ed21ab14: am c9b882dc: am a045ca42: am 87f3802a: appdomain: relax netlink_socket neverallow rule

* commit 'f84c740b':

am 5e911116: am f35d737d: am a669507e: am b5dd69a1: am c423b1aa: Add neverallow checking to sepolicy-analyze.

* commit '5e911116':

am 7dea3ae2: am 22db098e: am 5c190886: am 57dec60c: am 6f201ddc: App: add permissions to read symlinks from dalvik cache.

* commit '7dea3ae2':

am c80e805c: am f08d0446: am 582620ae: am c2eb12b2: am 9f0af9ec: Merge "zygote/dex2oat: Grant additional symlink permissions" into lmp-sprout-dev

* commit 'c80e805c':

am eced16c0: am fd352211: am f83e617f: am 4008b6c6: am b7934922: allow run-as to access /data/local/tmp

* commit 'eced16c0':

am 8ef2fed6: am d5d55306: am 330dd6e4: am 0edbecf2: am 7cd346a7: am 0055ea90: Allow recovery to create device nodes and modify rootfs

* commit '8ef2fed6':

* commit '58aa4481':

* commit '78b54b5d':

* commit 'ed21ab14':

* commit 'f35d737d':

am 22db098e: am 5c190886: am 57dec60c: am 6f201ddc: App: add permissions to read symlinks from dalvik cache.

* commit '22db098e':

am f08d0446: am 582620ae: am c2eb12b2: am 9f0af9ec: Merge "zygote/dex2oat: Grant additional symlink permissions" into lmp-sprout-dev

* commit 'f08d0446':

* commit 'fd352211':