am: ebcb5806

Change-Id: I75a10381448606004af255a5f9dfc1a8f6b6350e

am: 8027f979

Change-Id: I51f5c7186619238cb82b04d3db26b961d0c361a4

am: ea9d1b1f

Change-Id: I1f7a86c0abf6d7c65a0f47772ac47026a961bee6

am: 74a96734

Change-Id: Id1a20ebb9c2bd1dfa6edcb11354bcb3e525e3f04

am: b525fd0b

Change-Id: Ib6b086efb93d866207879a97e379851de6a7a84b

am: 11772818

Change-Id: Ia8e5462edc9038be7142331cfb524efd4f0e2edf

am: f7e9cee6

Change-Id: Ib4f4a9b29e93984aafe702ad46b9cda89d289584

am: d8112255

Change-Id: I2b30d171bbce0013b4f63fd3639747936d6674df

am: 72a8d918

Change-Id: I0723954ba2243a537d7b53545e1c9295a56c9556

am: bddd1893

Change-Id: I9c312bd8203cb859bb5bc6f2604d17bbc812a1a6

The linker now requires getattr rights for the filesystem. Otherwise
linking otapreopt and patchoat/dex2oat will fail.

Bug: 37776530
Test: m
Test: manual OTA
Change-Id: I1351fbfa101beca4ba80f84b0dd9dbcabe2c9d39

Test: Manual use of Camera app
Test: lshal shows IOmxStore

Bug: 37657124
Bug: 37726880
Change-Id: I5459d992c2feb14bd26765673864e583d48e3ba4

Fixes `adb shell cmd gpu vkjson`, which was previously failing due to
surfaceflinger not being able to use the socket passed to it by adbd.

Bug: b/37157136
Test: run above command, verified on marlin + bullhead
Change-Id: I57fa7e99d5c3dc7bc7d033b83f8ce6032162d7d3

The typical use case is where vendor apps which run as untrusted apps
use libraries that are packaged withing the apk

Bug: 37753883
Test: Tested by runnig pre-installed app that packages a library from
      /vendor/app

Change-Id: I445144e37e49e531f4f43b13f34d6f2e78d7a3cf
Signed-off-by: Sandeep Patil <sspatil@google.com>

Adding the default label/mapping is important because:
1.  Lookups of services without an selinux label should generate
    a denial.
2.  In permissive mode, lookups of a service without a label should be
    be allowed, without the default label service manager disallows
    access.
3.  We can neverallow use of the default label.

Bug: 37762790
Test: Build and flash policy onto Marlin with unlabeled vendor services.
    Add/find of unlabeled vendor services generate a denial.

Change-Id: I66531deedc3f9b79616f5d0681c87ed66aca5b80
(cherry picked from commit 639a2b84)

Adding the default label/mapping is important because:
1.  Lookups of services without an selinux label should generate
    a denial.
2.  In permissive mode, lookups of a service without a label should be
    be allowed, without the default label service manager disallows
    access.
3.  We can neverallow use of the default label.

Bug: 37762790
Test: Build and flash policy onto Marlin with unlabeled vendor services.
    Add/find of unlabeled vendor services generate a denial.

Change-Id: I66531deedc3f9b79616f5d0681c87ed66aca5b80

am: a1ccbd3d

Change-Id: I0fc9473875e27c9d3fcfb4d20aafa9b3741ccf35

am: 4c1385a6

Change-Id: I4da23806c532acfaaa1535ee87b25383a99723d7

am: 4a318ad6

Change-Id: Iffd30a9cfee48626dc01635877b90ef7a1e8f9b0

am: ee8b67df

Change-Id: Ic2fe390f95f0be43ad39a50366e0300a398aa0ad

am: 3644d0f5

Change-Id: I7da846bfe3db1a19782db13be6c2ab3d1b17accb

am: 89671020

Change-Id: Icbb3d5a87181e65d574007764d69c766d7b31e57

am: c9e21b60

Change-Id: If501dc948b6214052e5ee3ab2c50e0efc439bcf0

am: 22ebf24e

Change-Id: If8dc1ae0d2269cbe70617748fded75b5162780b8

am: d792de48

Change-Id: I94257c20a5b7621c883c9386dc327501e713860c

Destroy the policy before exiting (for successful = expected runs).

Bug: 37757759
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Change-Id: I67e35fbede696ec020a53b69a6cef9f374fae167

am: b9d5d5cc

Change-Id: Ie43b0d5ad797501a965ff6f69c37ba619fb5f588

* changes:
  NFC HAL no longer violates socket access restrictions
  Remove access to sock_file for hal_nfc

am: f0226fd3

Change-Id: If2878d81835f8e429dd7c82c17edd4290028d4d1

am: adfc5db0

Change-Id: Id0f7e56ee0473a2cf8bc04e4d1d02d6fa23d649c

Test: bit FrameworksCoreTests:android.view.textclassifier.TextClassificationManagerTest
Bug: 34780396
Change-Id: I8b98fef913df571e55474ea2529f71750874941c

Test: compiles
Bug: 37640900
Change-Id: Ia9960af9da880fd130b5fb211a054689e2353f1d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>

Test: manual
Bug: 37640900
Change-Id: I6987d60c1eb1578134b51f4e7417700fd462ba4d
Signed-off-by: Ruchi Kandoi <kandoiruchi@google.com>
(cherry picked from commit ad41fa8d)