am: a8af61f0

Change-Id: I9c49e79fd976c9c4bf37d79102d22d1e4c350a40

am: ae709241

Change-Id: Ia52cb0d049a82b2ce682243ff1fbe90ebd0a4614

am: a61f7f60

Change-Id: I5a0ff1b9233deb5ab7a6f4eb63498bbbefc169b3

am: ec470829

Change-Id: Ic6f08b67da93f015e9561c52311e0b1c3b610446

Bug: 37476041
Test: make, pair and connect to HID device
Change-Id: Ic7e81382994769e3f3a91255dcf3624edeaf6bfd

am: 557d1916

Change-Id: I8f5bc75892aca2132d15a3b38d79dcf195119b01

am: c45e9b9a

Change-Id: I6af916d823b983581c5f7b33858364af6b2e4456

am: fdb9c018

Change-Id: I97a63c04df7a70822015d99eb619b4ae0147241f

am: 9d46f9b4

Change-Id: Id3bd7d69bd07fafdf76453e52de01b2b5bb67472

These rules allow the additional tracepoints we need for running traceur
in userdebug builds to be writeable.

Bug: 37110010
Test: I'm testing by running atrace -l and confirming that the
tracepoints that I'm attempting to enable are available.

Change-Id: Ia352100ed67819ae5acca2aad803fa392d8b80fd

This commit marks surfaceflinger and app domain (except isolated_app)
as clients of Configstore HAL. This cleans up the policy and will make
it easier to restrict access to HwBinder services later.

Test: Play YouTube clip in YouTube app and YouTube web page in Chrome
Test: Take an HDR+ photo, a normal photo, a video, and slow motion
      video in Google Camera app. Check that photos show up fine and
      that videos play back with sound.
Test: Play movie using Google Play Movies
Test: Google Maps app displays the Android's correct location
Bug: 34454312
Change-Id: I0f468a4289132f4eaacfb1d13ce4e61604c2a371

This could be useful in diffs between policy versions.

Bug: 37357742
Test: sepolicy-analyze lists all attributes in precompiled_policy.
Change-Id: I6532a93d4102cf9cb12b73ee8ed86ece368f9131

am: 5007c10a

Change-Id: I7a35f4749c90e08632bb0013e99624cd34920d9b

Change-Id: Iafa4abcff36fe75e031fc6b6c2108a7617d34b97

am: f5defc90

Change-Id: I8a59ecbf59f8e6618bd5a06e61a46594638d6bcd

am: 9f152d98

Change-Id: I1c319ac3558e5ff96072638dc4be97502da61056

MediaProvider requires permissions that diverge from those
of a typical priv_app. This create a new domain and removes
Mtp related permissions from priv_app.

Bug: 33574909
Test: Connect with MTP, download apps and files, select ringtones
Test: DownloadProvider instrument tests, CtsProviderTestCases

Change-Id: I950dc11f21048c34af639cb3ab81873d2a6730a9

This commit marks system_server and app domains (except isolated_app)
as clients of Graphics Allocator HAL. This makes the policy cleaner
and prepares ground for restricting access to HwBinder services.

Test: Play video in YouTube app and in Google Chrome YouTube web page
Test: Using Google Camera app, take an HDR+ photo, a conventional
      photo, record a video with sound and a slow motion video with
      sound, then check that photos look good and videos play back
      fine, including sound.
Bug: 34454312
Change-Id: Iea04d38fa5520432f06af94570fa6ce16ed7979a

am: 0d1b2ce1

Change-Id: I2f2bb8fb9974dca42398f7c7cc5e7ace76824d47

am: 04a9c429

Change-Id: I9c44efe98a994ac302436325809657762ca6d26a

Bug: 36604251
Test: Netflix protected content, Play movies
Change-Id: I5c2c542007abddbe56b933ff44d65bd376b6691e

am: f69d535c

Change-Id: I19a518a9f84d17fdd7d3f7b8613d85785948187f

am: 80cab7de

Change-Id: Iba1cf44b3e7c965b8ea7033b80a25393730512e9

The new binder_call() lines had to be added
because this change removes mediacodec from
binderservicedomain (on full-treble), hence
domains that could previously reach mediacodec
with binder_call(domain, binderservicedomain)
now need explicit calls instead.

Test: Youtube, Netflix, Maps, Chrome, Music
Change-Id: I3325ce20d9304bc07659fd435554cbcbacbc9829

am: e506cda3

Change-Id: I9df35ecb00db0ed5d3a1430e64056e09579ab0a5

am: acb66317

Change-Id: Ib10b8c031066507b72361e302204646d3c9f9814

Test: WIP
Change-Id: I678b0d0e9750b25628b86060574fd516d3749cdf

am: 748cae86

Change-Id: Ia9c8f25a66ba8cf8528e80b3ce4c151f10574a6d

Temporary attribute (checked against in CTS) to point out vendor
processes that run /system executables. These are currently only down to
2-3 of them that are related to telephony on sailfish

Bug: 36463595
Test: Build succeeds for sailfish
Test: ./cts-tradefed run cts -m CtsSecurityHostTestCases -t \
          android.security.cts.SELinuxHostTest#testNoExemptionsForVendorExecutingCore \
          --skip-device-info --skip-preconditions --skip-connectivity-check \
          --abi arm64-v8a

Change-Id: I9eb40ad259aefba73869d6a1b40186d33fa475dd
Signed-off-by: Sandeep Patil <sspatil@google.com>

Bug: 36463595
Test: Boot sailfish, make wifi call, internet over data and wifi

Change-Id: I81259b6412d7197725afe2fe4976aa0a03b8df6e
Signed-off-by: Sandeep Patil <sspatil@google.com>

Attributes added to the policy by the policy compiler are causing
performance issues. Telling the compiler to expand these
auto-generated attributes to their underlying types prevents
preemtion during policy lookup.

Bug: 3650825
Test: Build and boot Bullhead
Change-Id: I9a33f5efb1e7c25d83dda1ea5dfe663b22846a2f

am: de2e79c5

Change-Id: Icc632129142cba968ca05206690adfef445f62c7