am: 4c71423e

Change-Id: I3affd2da7a7b3315b3e719ce0cf88424c53d1908

am: 9ec226df

Change-Id: I8c966360f4d7b28e5b4fe60739bd36737a601db8

am: 0aca0241

Change-Id: Ieceee81236f8fa5d7d2bb328274b7e91c11fbae1

am: 9d8dff3c

Change-Id: I347d13fa5d4a1bb3a9c893afacd12d51428e839f

am: 9fa01919

Change-Id: I8625aca8f8c8e925585afd84822680e9e0d812ec

am: 5a2de627

Change-Id: I960ee43281da8c8c6b0ec68bbea2ac53f43ab457

This switches Wi-Fi HAL policy to the design which enables us to
conditionally remove unnecessary rules from domains which are clients
of Wi-Fi HAL.

Domains which are clients of Wi-Fi HAL, such as system_server domain,
are granted rules targeting hal_wifi only when the Wi-Fi HAL runs in
passthrough mode (i.e., inside the client's process). When the HAL
runs in binderized mode (i.e., in another process/domain, with clients
talking to the HAL over HwBinder IPC), rules targeting hal_wifi are
not granted to client domains.

Domains which offer a binderized implementation of Wi-Fi HAL, such as
hal_wifi_default domain, are always granted rules targeting hal_wifi.

Test: Setup Wizard (incl. adding a Google Account) completes fine with
      Wi-Fi connectivity only
Test: Toggle Wi-Fi off, on, off, on
Test: Use System UI to see list of WLANs and connect to one which does
      not require a password, and to one which requries a PSK
Test: ip6.me loads fine in Chrome over Wi-Fi
Bug: 34170079

Change-Id: I7a216a06727c88b7f2c23d529f67307e83bed17f

am: 82b02338

Change-Id: I6bbe28f12e9d72c5d01691b0ba7bf229ee9378d5

am: ade5c284

Change-Id: Ic0b15caac14587bb6a6326ca53f956c78188b42a

am: 20b8d6b9

Change-Id: I8d3fe3a79791560669be031c790cd3862fb8782b

Bug: 35657600
Test: user build of Marlin starts with BT
Change-Id: Ic2380da66467b9b1c385da7d7fa10fddf4c7fae1

am: f2c2bd94

Change-Id: Ibad3def8f3a226a0f94a0cd506511f83f1c4e9fc

am: 872ff684

Change-Id: Ic4e4cd105af65b5ee7c0adfb62f851bff55fed70

am: 706bb202

Change-Id: I0f2169981c80769e85c686f637135097e2d74f56

The 'overlay' service is the Overlay Manager Service, which tracks
packages and their Runtime Resource Overlay overlay packages.

Change-Id: I897dea6a32c653d31be88a7b3fc56ee4538cf178
Co-authored-by: Martin Wallgren <martin.wallgren@sonymobile.com>
Signed-off-by: Zoran Jovanovic <zoran.jovanovic@sonymobile.com>
Bug: 31052947
Test: boot the Android framework

am: b58ec714

Change-Id: I8334bd1c5d52366445b0edbce7c90d8e90c4c299

am: 2c99c9ff

Change-Id: Ic11f3abd6b27769ac1c77af0530cec6b4702d911

am: 2f348392

Change-Id: Ia375e92fac568547c44adc42090843ad9ba7eb9f

This switches Dumpstate HAL policy to the design which enables us to
conditionally remove unnecessary rules from domains which are clients
of Dumpstate HAL.

Domains which are clients of Dumpstate HAL, such as dumpstate domain,
are granted rules targeting hal_dumpstate only when the Dumpstate HAL
runs in passthrough mode (i.e., inside the client's process). When the
HAL runs in binderized mode (i.e., in another process/domain, with
clients talking to the HAL over HwBinder IPC), rules targeting
hal_dumpstate are not granted to client domains.

Domains which offer a binderized implementation of Dumpstate HAL, such
as hal_dumpstate_default domain, are always granted rules targeting
hal_dumpstate.

Test: adb bugreport
Test: Take bugreport through system UI
Bug: 34170079

(cherry picked from commit 47174e3b)

Change-Id: I3e827534af03cdfa876921c5fa4af3a53025ba27

This switches Dumpstate HAL policy to the design which enables us to
conditionally remove unnecessary rules from domains which are clients
of Dumpstate HAL.

Domains which are clients of Dumpstate HAL, such as dumpstate domain,
are granted rules targeting hal_dumpstate only when the Dumpstate HAL
runs in passthrough mode (i.e., inside the client's process). When the
HAL runs in binderized mode (i.e., in another process/domain, with
clients talking to the HAL over HwBinder IPC), rules targeting
hal_dumpstate are not granted to client domains.

Domains which offer a binderized implementation of Dumpstate HAL, such
as hal_dumpstate_default domain, are always granted rules targeting
hal_dumpstate.

Test: adb bugreport
Test: Take bugreport through system UI
Bug: 34170079
Change-Id: I3e827534af03cdfa876921c5fa4af3a53025ba27

Bug: 35632346
Test: build and boot aosp_marlin
Change-Id: Ia2d019b0160e9b512f3e3a70ded70504fe4fea0c

am: d7cb7ff4

Change-Id: Iaa0c92775ab446010409cf784790763542cd4d48

am: 351ba2c8

Change-Id: I961d7edd3d14c0f87f54ecfe6b0947ed454d1f66

am: d68aae65

Change-Id: Ib57282ba98e07b330df27ae203f51ce17568088b

am: 58cc4a50

Change-Id: I6b0739595152d4716a246bf032e1e926e8e9ba87

am: bb252e98

Change-Id: Ic428c4301b2b6f8de5ba24b152e10d900c0f5aac

am: 313dfe7d

Change-Id: Id3134f3157f29b3e878cde82ed33cac35f162c87

In the master external/ipsec-tools/{main.c, racoon.rc},
racoon doesn't call setuid, and doesn't have the setuid capability.

Bug: 35642293
Signed-off-by: Lucas Duffey <lucas.duffey@invapid.org>

am: 9abc397b

Change-Id: I90dcdc32cbb48cc9dd9a583c1b13c3435cac2d72

am: a5c6cd06

Change-Id: I0100cedf44cf395891271228aa4ce0ef4bda86a0

am: 1c4014ab

Change-Id: I2a36fd9265032e343e92adf022705121bba287f4

am: d2dda9d9  -s ours

Change-Id: I09e43acbfd3d7e08fec3e274f81814fc51a482f5