am: 5fe8881b

Change-Id: Iad652a00f3f963668cda1a6c2e2cf79d351a042c

am: 8027f979

Change-Id: I51f5c7186619238cb82b04d3db26b961d0c361a4

am: 74a96734

Change-Id: Id1a20ebb9c2bd1dfa6edcb11354bcb3e525e3f04

am: 11772818

Change-Id: Ia8e5462edc9038be7142331cfb524efd4f0e2edf

am: d8112255

Change-Id: I2b30d171bbce0013b4f63fd3639747936d6674df

am: bddd1893

Change-Id: I9c312bd8203cb859bb5bc6f2604d17bbc812a1a6

Bug:  37713584
Test: With GtsMediaTestCases.apk installed, try:
      adb shell am instrument -w
      -e class 'com.google.android.media.gts.MediaPlayerTest#testLLAMA_H264_BASELINE_240P_800_DOWNLOADED_V0_SYNC'
      'com.google.android.media.gts/android.support.test.runner.AndroidJUnitRunner'

Change-Id: Icc2066e9d9bbc5c020b6d694e9627487771ef35e

The linker now requires getattr rights for the filesystem. Otherwise
linking otapreopt and patchoat/dex2oat will fail.

Bug: 37776530
Test: m
Test: manual OTA
Change-Id: I1351fbfa101beca4ba80f84b0dd9dbcabe2c9d39

Test: Manual use of Camera app
Test: lshal shows IOmxStore

Bug: 37657124
Bug: 37726880
Change-Id: I5459d992c2feb14bd26765673864e583d48e3ba4

Fixes `adb shell cmd gpu vkjson`, which was previously failing due to
surfaceflinger not being able to use the socket passed to it by adbd.

Bug: b/37157136
Test: run above command, verified on marlin + bullhead
Change-Id: I57fa7e99d5c3dc7bc7d033b83f8ce6032162d7d3

The typical use case is where vendor apps which run as untrusted apps
use libraries that are packaged withing the apk

Bug: 37753883
Test: Tested by runnig pre-installed app that packages a library from
      /vendor/app

Change-Id: I445144e37e49e531f4f43b13f34d6f2e78d7a3cf
Signed-off-by: Sandeep Patil <sspatil@google.com>

Adding the default label/mapping is important because:
1.  Lookups of services without an selinux label should generate
    a denial.
2.  In permissive mode, lookups of a service without a label should be
    be allowed, without the default label service manager disallows
    access.
3.  We can neverallow use of the default label.

Bug: 37762790
Test: Build and flash policy onto Marlin with unlabeled vendor services.
    Add/find of unlabeled vendor services generate a denial.

Change-Id: I66531deedc3f9b79616f5d0681c87ed66aca5b80
(cherry picked from commit 639a2b84)

am: 4c1385a6

Change-Id: I4da23806c532acfaaa1535ee87b25383a99723d7

am: 4a318ad6

Change-Id: Iffd30a9cfee48626dc01635877b90ef7a1e8f9b0

am: ee8b67df

Change-Id: Ic2fe390f95f0be43ad39a50366e0300a398aa0ad

am: 89671020

Change-Id: Icbb3d5a87181e65d574007764d69c766d7b31e57

am: 22ebf24e

Change-Id: If8dc1ae0d2269cbe70617748fded75b5162780b8

Destroy the policy before exiting (for successful = expected runs).

Bug: 37757759
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Change-Id: I67e35fbede696ec020a53b69a6cef9f374fae167

am: b9d5d5cc

Change-Id: Ie43b0d5ad797501a965ff6f69c37ba619fb5f588

* changes:
  NFC HAL no longer violates socket access restrictions
  Remove access to sock_file for hal_nfc

am: adfc5db0

Change-Id: Id0f7e56ee0473a2cf8bc04e4d1d02d6fa23d649c

Test: bit FrameworksCoreTests:android.view.textclassifier.TextClassificationManagerTest
Bug: 34780396
Change-Id: I8b98fef913df571e55474ea2529f71750874941c

Test: compiles
Bug: 37640900
Change-Id: Ia9960af9da880fd130b5fb211a054689e2353f1d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

Test: manual
Bug: 37640900
Change-Id: I6987d60c1eb1578134b51f4e7417700fd462ba4d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit ad41fa8d)

am: 3259f98c

Change-Id: I9c4cea46a1b5272974b484eeaa01a87ac41a8bdf

am: 8ad09d93

Change-Id: I745c85dd761cc68e0301a7a3fa32b29269c624d2

am: 608969b3

Change-Id: I99225c48524600248d3d76a56368dc96da67caa0

am: 16eb632a

Change-Id: Ifb5f7fd54973cf1de256404344bd8690a4f13c02

am: eb710332

Change-Id: I15f27cd755e5a8556e189af50b8bca52f050ad8f

am: db5962ce

Change-Id: I4ce4248dd0f780c1d466a7798a159d854d30a09a

This was accidentally omitted from all_untrusted_app

While I'm here, split across mutiple lines and alphabetize.

Test: policy compiles.
Change-Id: I7fe1d1d0a4ef2ed3ab010931ee2ba15637c2be51

am: 9829506c

Change-Id: I7a05cbb58ebbe4d23c9fc13ef429b444301a912e