am: a3d199dd  -s ours

Change-Id: I09cf25b52e7c15b57e8a103d43b468dcef466154

am: 45c72ddf

Change-Id: Iad601fb52e9e145b1a2729a37867de40556d9d3a

am: 96805f15

Change-Id: I862b984b3f7508406183709fffda803284aade3e

am: ac2e4cce

Change-Id: I595507e45f563ae0ecfb07e842f446a34b3e3446

am: e63f0e9c

Change-Id: Ib6b1721b59b6df2944584a3236076885c9218930

am: e0163411

Change-Id: I32f6cd37506d4e6f6feb73c6d1b2eabcdb4988b3

Bug: 75987246
Test: succeeded builing and tested with taimen
Change-Id: I2d8bc91c305e665ed9c69459e51204117afb3eee

am: 1382984c

Change-Id: Icc3cd3d88873627f93cb59f69083b0c68f1a51ea

Addresses:
avc: denied { find } for
interface=android.hardware.tetheroffload.config::IOffloadConfig
scontext=u:r:system_server:s0
tcontext=u:object_r:default_android_hwservice:s0
tclass=hwservice_manager

Bug: 77855688
Test: build/boot Sailfish, turn on tethering, no selinux denial
Change-Id: I97cae0928b5311a4da41d19cbd5c863c3137a49f
(cherry picked from commit 3a346ea7)

am: 45b4704e

Change-Id: I29d90373b7cc4350244c81f9a5b24c31453d987d

am: 2e532d40

Change-Id: I7cd5f36005f7e5c26384525a038b54dac87294bd

Addresses:
avc: denied { find } for
interface=android.hardware.tetheroffload.config::IOffloadConfig
scontext=u:r:system_server:s0
tcontext=u:object_r:default_android_hwservice:s0
tclass=hwservice_manager

Bug: 77855688
Test: build/boot Sailfish, turn on tethering, no selinux denial
Change-Id: I97cae0928b5311a4da41d19cbd5c863c3137a49f

* changes:
  Suppress spurious denial
  Suppress spurious denial

am: 106a5b31

Change-Id: Icebdaa72e68c6ac79cc05caf53cab612addb335f

Addresses:
avc: denied { sys_resource } scontext=u:r:zygote:s0
tcontext=u:r:zygote:s0 tclass=capability

Bug: 77905989
Test: build and flash taimen-userdebug
Change-Id: If2413c3005df02a70661464d695211acbcda4094
(cherry picked from commit 816e744d998cb327fbd20f3124b22398bea2b8e4)

Addresses:
avc: denied { sys_resource } for comm="ip6tables" capability=24
scontext=u:r:netutils_wrapper:s0 tcontext=u:r:netutils_wrapper:s0
tclass=capability

Bug: 77905989
Test: build and flash taimen-userdebug
Change-Id: Ic5d7c96152b96b55255eeec00b19948f38c1923c
(cherry picked from commit 443a43c9)

am: a949ddb5

Change-Id: Ife6c721b66c23ddd8cfcf94a1f45b9491a272252

We have seen crash_dump denials for radio_data_file,
shared_relro_file, shell_data_file, and vendor_app_file.  This commit
widens an existing dontaudit to include them as well as others that we
might see.

Bug: 77908066
Test: Boot device.
Change-Id: I9ad2a2dafa8e73b13c08d0cc6886274a7c0e3bac
(cherry picked from commit a3b3bdbb)

We often see the following denials:

avc: denied { sys_rawio } for comm="update_engine" capability=17 scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0 tclass=capability permissive=0
avc: denied { sys_rawio } for comm="boot@1.0-servic" capability=17 scontext=u:r:hal_bootctl_default:s0 tcontext=u:r:hal_bootctl_default:s0 tclass=capability permissive=0

These are benign, so we are hiding them.

Bug: 37778617
Test: Boot device.
Change-Id: Iac196653933d79aa9cdeef7670076f0efc97b44a
(cherry picked from commit bf4afae1)

am: 26776b03  -s ours

Change-Id: Ia9ec9e2a510a495bd9b339b33f4c4c1b5735d91b

am: be79c7b2

Change-Id: Iac6379199a0f0a0680bd0ddda32644333fbaef74

am: 97e41802

Change-Id: I07a20906f2c536e573198219e4d3d567ea715144

am: 6cdc9a82

Change-Id: I3fdc8fa4f4486ccfadf785ff82e147ad47123c37

am: 8966b8e5

Bug: 74435522
Test: traceur can share to betterbug
Change-Id: Ic24196b6a4050696d92f18a6879c569ccf5eaec7
(cherry picked from commit f66fd522)

am: b5f3e88e

Change-Id: Ia52abf98b65da8309e014ac5fd3c642511e6f189

am: 354a2530

Change-Id: Iae854d7e794e9616cd1878e8096473cf9bbe0680

avc: denied { read } for name="ext4" dev="sysfs" ino=32709
scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0
tclass=dir permissive=0 b/72749888
avc: denied { read } for name="state" dev="sysfs" ino=51318
scontext=u:r:priv_app:s0:c512,c768
tcontext=u:object_r:sysfs_android_usb:s0 tclass=file permissive=0
b/72749888

Bug: 72749888
Test: build/boot taimen-userdebug. No more logspam
Change-Id: Ic43d1c8b71e1e5e0e6f9af1e03816c4084120e7e
Merged-In: Ic43d1c8b71e1e5e0e6f9af1e03816c4084120e7e
(cherry picked from commit 558cdf1e)

Bug: 69390067
Test: manual run of treble_sepolicy_tests
Change-Id: I1b772a3f7c96875765c75bfc1031f249411c3338
Merged-In: I1b772a3f7c96875765c75bfc1031f249411c3338
(cherry picked from commit 9fbd6520)

We often see the following denials:

avc: denied { sys_rawio } for comm="update_engine" capability=17 scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0 tclass=capability permissive=0
avc: denied { sys_rawio } for comm="boot@1.0-servic" capability=17 scontext=u:r:hal_bootctl_default:s0 tcontext=u:r:hal_bootctl_default:s0 tclass=capability permissive=0

These are benign, so we are hiding them.

Bug: 37778617
Test: Boot device.
Change-Id: Iac196653933d79aa9cdeef7670076f0efc97b44a

am: bf685274

Change-Id: I2d17d76e68d60454ca53f4448a71fc619bbd5cd7

am: 589226df

Change-Id: I5e6efda7d87fcffed4733058ae2fab3ff1cdaecd