Remove the permission to execute dex2oat from apps targetSdkVersion>28.
This has been historically used by ART to compile secondary dex files
but that functionality has been removed in Q and the permission is
therefore not needed.

Some legacy apps do invoke dex2oat directly. Hence allow (with audit) for
targetSdkVersion<= 28.

Test: atest CtsSelinuxTargetSdk25TestCases
Test: atest CtsSelinuxTargetSdk27TestCases
Test: atest CtsSelinuxTargetSdkCurrentTestCases
Bug: 117606664
Change-Id: I2ea9cd56861fcf280cab388a251aa53e618160e5

This is world-readable so it can be checked in libc's process init.

Test: m
Test: flash sailfish

Bug: 117821125

Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d

system server reads this property to keep track of whether server
configurable flags have been reset during current boot.
system server needs this information to decide whether to perform
following disaster recovery actions on framework level.

the get_prop added in this cl in system_server.te is not grouped
in the same place as the set_prop in system_server.te in another
cl (https://android-review.googlesource.com/c/platform/system/sepolicy/+/828284).
This is because these 2 properties are serving for different purposes:
device_config_flags_health_check_prop is used to control features(so will be
all the future set_prop added by other feature teams under "# server configurable flags properties"),
while device_config_reset_performed_prop is used by our API's internal implementation.
So I feel like it might be clearer if I put this get_prop in a different place rather than
appending to "# server configurable flags properties".

Test: build suceeded.

Change-Id: I64379aa8f0bbe093969b98d62093696a32aabe59

I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system
properties. And have init to write them to files under dev/.

This change set SELinux rules for these properties and files.

For the system properties: vendor/default.prop will set them. init will
read them.
For the files /dev/cpu_variant:.*: init will write them. bionic libc
will read them. (Basically world readable).

This is to allow libc select the right optimized routine at runtime.
Like memcpy / strcmp etc.

Test: getprop to make sure the properties are set.
Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled.

Change-Id: I41662493dce30eae6d41bf0985709045c44247d3

bug: 110870380
Test: device boots, artificially creating a rwx mapping in zygote works.

Change-Id: I81a32b616a68f186867af25528a0348d1ad73a50

 * Account for all possible sdcard-related filesystem types and not only
   sdcardfs:

   public/file.te:108:type fuse, sdcard_type, fs_type, mlstrustedobject;
   public/file.te:109:type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
   public/file.te:111:type vfat, sdcard_type, fs_type, mlstrustedobject;
   public/file.te:112:type exfat, sdcard_type, fs_type, mlstrustedobject;

Change-Id: Ic508397bf4ca66a002ada33ac3f600c17b8a1a10

The dynamic linker calls realpath(3) on paths found in the linker config
script. Since realpath() calls lstat() on the parent paths, not allowing
getattr on /apex and its subdirectories will cause selinux denial spam
whenever something is executed from APEXes.

Silence the spam by allowing getattr on apex_mnt_dir.

Bug: 117403679
Bug: 115787633
Test: m apex.test; m; device is bootable

Change-Id: Ic659582760a3ae146e73770266bc64332b36a97c

The auditallow added in commit
7a4af30b ("Start the process of locking
down proc/net", May 04 2018), has not been triggered. This is safe to
delete.

Test: Policy compiles
Test: no collected SELinux denials
Bug: 68016944
Change-Id: Ib45519b91742d09e7b93bbaf972e558848691a80

cgroup is labeled from genfs_contexts. Also, cgroup filesystems can't be
context mounted, i.e. it's not possible to mount them with a label other
than "cgroup".

Bug: 110962171
Test: m selinux_policy
Test: boot aosp_walleye
Change-Id: I8319b10136c42a42d1edaee47b77ad1698e87f2c

Bug: 110962171
Test: boot aosp_walleye, aosp_blueline, no log spam from new audit
Change-Id: Ibeeb317e2cf15584395e3dbb73eb01b827e19a09

device_config_flags_health_check_prop is used for enabling/disabling
program flags_health_check which is executed during device booting.
"1" means enabling health check actions in flags_health_check, other
values mean flags_health_check will not perform any action.

Test: build succeeded & manual test
Change-Id: I93739dc5d155e057d72d08fd13097eb63c1193b5

Add an InputFlinger service in system_server and allow SurfaceFlinger to
exchange sockets with it.

Test: None
Bug: 80101428
Bug: 113136004
Bug: 111440400
Change-Id: I1533ab7a1da0ca61d8a28037fffbc189d796f737

With Treble, cameraserver no longer depends on camera devices directly.
Moreover, pixel 3 doesn't have /dev/cam node.

We still keep "camera_device" type around since vendor policy uses it to
label its /dev nodes.

Bug: 110962171
Test: boot aosp_walleye
Test: camera app still works
Change-Id: If12d640c2a0006b9fc3c9f6704285eb8eb66c626

Changed the GPU service name back to be compatible with external
engines/tools' usage of vkjson cmd.

Bug: 118347356
Test: adb shell cmd gpu vkjson
Change-Id: Ie432fd8be63d33070ad037c509467c8367b42d39

Auditallow added in commit 72edbb3e ("Audit generic debugfs access for
removal", May 01 2018) has not triggered. Remove allow rule and tighten
up neverallow rule.

Test: policy compiles
Test: no collected SELinux denials.
Change-Id: I9a90463575f9eab4711b72d6f444fa9d526b80e1

This will be needed if vendors remove a label, as vendor_init would
need to relabel from it (which would be unlabeled) to the new label.

Test: Build policy.
Change-Id: Ieea0fcd7379da26b2864b971f7773ed61f413bb9

This CL adds rules to allow traced_probes to dup a pipe as the stderr
for atrace and also send a sigkill to atrace after a timeout.

This fixes b/119656920

Change-Id: Ie66aaba47c11ef7c733b442f35fee042b7c546fb

Label the surfaceflinger binary as surfaceflinger_exec

Test: m apex.test; m; device is bootable

Change-Id: I22297ba514f7ba298a1d0d4b476a447f26e48078

1b1d133b added the process2 class but
forgot to suppress SELinux denials associated with these permissions
for the su domain. Suppress them.

Ensure xdp_socket is in socket_class_set, so the existing dontaudit rule
in su.te is relevant. Inspired by
https://github.com/SELinuxProject/refpolicy/commit/66a337eec6d7244e44e51936835b4e904f275a02

Add xdp_socket to various other neverallow rules.

Test: policy compiles.
Change-Id: If5422ecfa0cc864a51dd69559a51d759e078c8e7

Remove the special case that allowed init to relabel app_data_file and
privapp_data_file. The auditallow added in
ab82125f has never triggered.

Bug: 80190017
Test: policy compiles
Test: no SELinux denials collected for the auditallow rule
Change-Id: Ide7c31e1a0628464ec2fcf041e8975087c39166d

It is unnecessary to use get_prop() rules for the su domain. The
su domain is always in permissive mode [1] and not subject to SELinux
enforcement. It's also possible these rules were added to avoid SELinux
denial log spam from showing up, however, there are already dontaudit
rules in place [2] to prevent this.

Delete the unnecessary rules.

[1] https://android.googlesource.com/platform/system/sepolicy/+/96b62a60c2ccae777fdcabe7d2ed28b52056860b/private/su.te#19
[2] https://android.googlesource.com/platform/system/sepolicy/+/96b62a60c2ccae777fdcabe7d2ed28b52056860b/public/su.te#42

Test: policy compiles
Change-Id: I5913f360738725bf915f0606d381029b9ba4318f

Test: vold is able to create directories, ag/5534962

Bug: 116528212

Change-Id: I61dd8802c13b1c42d334a80b678ca6a877848fc2

We lose git history with this, but imo the rules being moved don't have
much reference material. Also, as we write more neverallow rules for
CKI, I'd like to consolidate them in private/coredomain.te

Test: m selinux_policy
Change-Id: I6d0c3d2af0c4dfe7dd3cb1d8836b4b5e00db37a4