This prevents denials from being generated by the base policy.
Over time, these rules will be incrementally tightened to improve
security.

Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11

This reverts commit b77b3aff.

Bug: 4070557
Change-Id: I027f76cff6df90e9909711cb81fbd17db95233c1

Bug: 8841348
Change-Id: I1acf355b8e700500eeb0ddcbb8203a4769bde3bc

Faugh. Typo.

This reverts commit adb481dd

Change-Id: Id1ccc0a59cc79b8ad7171fcb6b3d8cb3aaf29bee

Bug: 8841348
Change-Id: I83497c9b5346ba3b35e4e288190fc217a26be505

Change-Id: I40f3ccd9813e0a337ced0a44e686ab489277d78b

Change-Id: Id41891b89c7b067919cbda06ab97d5eff2ad044f

I have no idea what vold is doing when this operation is attempted
(when a full-disk encrypted device is booting up). Thus, I don't know
if there is a better way of restricting the policy.

Change-Id: I537b70b1abb73c36e5abf0357b766292f625e1af

klog_write/init create /dev/__kmsg__ backed by a kernel character
device, keep the file descriptor, and then immediately unlink the
file.

Change-Id: I729d224347a003eaca29299d216a53c99cc3197c

Change-Id: I2b7bf3037c94de4fecf3c3081497e0ac1dfef8a9

Change-Id: I91f6965dafad54e98e2f7deda956e86acf7d0c96

vold reboots needs to reboot the system when it succeeds or fails to
encrypt partitions.

Change-Id: Ibb1a5378228be60215162ae248e6c1049a16b830

Change-Id: I544c0c1bbe84834970958a65fcef1d10e7e29047

This allows wpa_supplicant to interact with the sockets created
for it by init. Eventually we'll want those to be properly
labelled, but allow until then.

Change-Id: I33fcd22173a8d47bbc4ada8d6aa62b4d159cbb15

"init_shell" is used for shell processes spawned by init.

Change-Id: I9e35d485bac91f3d0e4f3704acdbb9af7d617173

Change-Id: I9b05f0f2ce6c6c52b4207cac3120f06565b7da30

Properties under bluetooth. and persist.service.bdroid. are
considered Bluetooth-related properties.

Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7

Merge "Expand permissions for 3 existing allow policies for rild and a new one for rild." into jb-mr2-dev

Change-Id: Iafe68ac1b742e40c1a23a2f6cfd6373ea89cc07b

Change-Id: I168f681d8c67f470b6e639f0b1bf39346c4eb396

Change-Id: I56e3ddae08b0c3d5e6b2492a6754899cc4e25a21

Long term this should be scoped down.

Change-Id: I261f05568566cca38bc5c43fbfa7ff1c816e5846

Change-Id: Ia7457e3fd4f1100bbee821f412e80ba17fede5ec

Change-Id: Ie96d573be971b2dcc3d60614794ba9ca13b31471

Change-Id: Iaa8fb6fa8726d083ee3c49edbbd398f0e8f33a37

This rule doesn't work, as /proc/sysrq-trigger isn't properly labeled.
Revert this change for now.

This reverts commit bb2591e5.

This reverts commit 69fbbdd5.

Some of these will get factored out into device-specific
configs later.

Change-Id: I359915e2607b56112bb22456d28e06c162fcbdff

This reverts commit e7e54fac

Change-Id: I26b577cf46a0eaccf6adf7ae851383a10bf03b4b

This reverts commit 1c101164

Restoring now that the conflict with tuna has passed.

Change-Id: I587dab8d7102c913fc03825a006e96d76680858d