am: c6afcb7f  -s ours

Change-Id: I9c89b5179d68943f4e090fbd596b4cd4be68100f

This hwservice isn't registered with hwservicemanager but rather passed
to the thermal hal, so it doesn't need sepolicy associated with it to
do so.

Test: manual: boot, inspect logs
Test: VtsHalThermalV1_1TargetTest
Bug: 109802374
Change-Id: Ifb727572bf8eebddc58deba6c0ce513008e01861
Merged-In: Ifb727572bf8eebddc58deba6c0ce513008e01861

am: 05fc3f25

Change-Id: Iebf4303790c7b87cd9e82abf073c895f7b4fa38e

Suppress selinux logspam for non-API files in /sys.

Bug: 110914297
Test: build
Change-Id: I9b3bcf2dbf80f282ae5c74b61df360c85d02483c

am: d6c47bc1

Change-Id: I9f8f996c182701bb52cb60c8403c9e817f777691

am: ff91d5d6

Change-Id: I4d7fcb2a08b8d95342a075ce95abd931bae73ad3

Test: build aosp_taimen-userdebug
Change-Id: Ie35ffcb8d2e3b83b6592f863caca946270aa4032

Bug: 110757800
Test: none
Change-Id: I2627c43fc45a78c936fa4a7ca968c606c89b9728

am: 92142384

Change-Id: Ib1a4c54dacb5e3999ffa130d170cdef04e383b57

Test: ls -laZ /vendor/bin/hw/android.hardware.bluetooth*
Change-Id: I394594ad041f87583ca6b5b44d836cfab5da8103
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Merged-In: I394594ad041f87583ca6b5b44d836cfab5da8103

am: 26d589a3

Change-Id: Icf8add102adce4f34f9800fdab872ad968989d49

am: bbb439e7

Change-Id: I5e7036e4ad9c19229835d9b7b36cc77bb476ef9c

"ro.telephony.default_network" can define as comma-separated Sting per
slot for multi SIM device. However, it cannot be read correctly due to
it defined as Int in property_contexts file.

Bug: 110626665
Test: manual - Checked the ro.telephony.default_network can be read per
slot for multi SIM device.
Change-Id: I900620e46c819c14bf339751f00a1db1473fd45f

Bug: 110230810
Test: N/A
Change-Id: Ide135dd5a8da05f0ea639bf03ce9612862108225

am: 22f98197

Change-Id: Ie2678a964788b3a064ec12b06cb7b129ccc9b4b5

This reverts commit b5dc6137.

Reason for revert: Reverted incorrect change

Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d

am: b5dc6137

Change-Id: I27e69743664613630765598869203b71437182b2

This reverts commit faebeaca.

Reason for revert: broke the build

Change-Id: I3d61ce011ad42c6ff0e9f122de3daa37e846407a

am: faebeaca

Change-Id: I263f10cc06e23a01f1928d3c8dae3ab4e6357788

This change makes it such that only init can start adbd directly. It
also introduces new rules for ctl.{start,stop,restart} properties such
that only usbd and recovery (and su, since it's permissive) can directly
ask init to start adbd.

Bug: 64720460
Test: adbd still runs
Test: /data/nativetest64/adbd_test/adbd_test
Test: python system/core/adb/test_adb.py
Test: "USB debugging" in System Settings still start/stop adbd
Test: Recovery menu still make the device show as "recovery" in adb
      devices
Test: "Apply update from ADB" in recovery menu still works
Change-Id: Iafcda8aa44e85129afcc958036b472d856fa1192

am: 3ac71f8d

Change-Id: Ia0db4d6a305d7f815f38a119475ebb346e873249

This property is read by the audio service in system server to toggle
camera shutter sound enforcement on a device-specific basis.

Test: Camera shutter sound enforcement works when audio.camerasound.force is set
Bug: 110126976
Change-Id: I2720d3c699c4712d1a328f59dde0b16bbf1016f3

am: b794ad0f

Change-Id: I46c7aa4b511da69d7f852023cff23871b6c8468e

This adds a label for system properties that will affect system-wide
time / time detection logic.

The first example will be something like:
persist.time.detection_impl_version

Bug: 78217059
Test: build
Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a

am: 0474b119

Change-Id: Ie24f599f2d7e74aac38393c20762d16d6a48e355

am: 4b9a3128

Change-Id: I91b225a67ba9a63ac325882bdbb8ac78e487b323

When we have wide color gamut content, SurfaceFlinger might want to send a
PowerHint through Power Hal to boost GPU to higher frequency, to make sure GPU
composition can finish in time.

BUG: 110112323
Test: adb shell cat /sys/class/kgsl/kgsl-3d0/devfreq/cur_freq
Change-Id: If60c13aedc4ff84eaefd3430794dc15a478c5a73

am: 512e1c4d

Change-Id: I452b2ac620461bc7d16dda8a0ec9855a8dbfd593

Grant access to icmp_socket to netdomain. This was previously
labeled as rawip_socket which apps are allowed to use. Neverallow
all other new socket types for apps.

Kernels versions > 4.9 redefine ICMP sockets from rawip_socket
to icmp_socket. To pass neverallow tests, we need to define
which IOCTLs are allowed (and disallowed).

Note that this does not change behavior on devices with
kernel versions <=4.9. However, it is necessary (although not
sufficient) to pass CTS on kernel version 4.14.

Bug: 110520616
Test: Grant icmp_socket in net.te and build.
Change-Id: I5c7cb6867d1a4cd1554a8da0d55daa8e06daf803

am: 981aac14

Change-Id: I0d15f9bb47e3c77256f8c904662bedccd55333f3

Like /system and /product, /product-services will contain apps that
should have the same privileges as the one in other system partitions.

Bug: 80741439
Test: successfully tested e2e on two devices, one with
/product-services partition and another with /product-services
symlinking to -> /system/product-services
Change-Id: Ieee7a9a7641a178f44bb406dbdef39ed46713899

am: 2c489685

Change-Id: Id1617e2d98be5bc10784337e7c2758843dfeb960