Merge "Add dex2oat permissions to open and read the tmp apk." am: 47061e59 am: 70269b78 am: 24409c36
am: 78a5ffd3  -s ours

Change-Id: I0e43fb52c0d608d0a95d0f0f76121d0792ea4990

am: 24409c36

Change-Id: I213a2aaca2c4fe4e7b1eac0971b99517dab2bb6f

am: 70269b78

Change-Id: I9fb2b4fc6b5664ac90e922a1253445cc51b16462

am: 47061e59

Change-Id: I924bfbc908321e321ca464adf8017bd3e212450f

am: a242ee6f

Change-Id: I966d9c6a9608116ab2b8f5ed68c8baa1b518439f

am: 6c80fcba

Change-Id: Id265afd1eab295e5a3bd33b05e820e6eaa8fc6ff

Allow Bluetooth process to access /dev/uhid in SELinux Policy am: a61f7f60 am: ae709241 am: a8af61f0
am: 23ca0826

Change-Id: Ifd034a7c1ffe5371b30fa8af8f7f0776ecfdfef6

Bug: 37476041
Test: make, pair and connect to HID device
Change-Id: Ic7e81382994769e3f3a91255dcf3624edeaf6bfd
(cherry picked from commit a61f7f60)

am: a8af61f0

Change-Id: I9c49e79fd976c9c4bf37d79102d22d1e4c350a40

am: ae709241

Change-Id: Ia52cb0d049a82b2ce682243ff1fbe90ebd0a4614

am: a61f7f60

Change-Id: I5a0ff1b9233deb5ab7a6f4eb63498bbbefc169b3

am: dc8a278a

Change-Id: Ie2256f76ef644171b7eb67d63a0640aea21db445

am: ec470829

Change-Id: Ic6f08b67da93f015e9561c52311e0b1c3b610446

Bug: 37476041
Test: make, pair and connect to HID device
Change-Id: Ic7e81382994769e3f3a91255dcf3624edeaf6bfd

The PackageManager now passes previous code paths to dex2oat as shared
libraries. dex2oat needs extra permissions in order to access and open
the oat files of these libraries (if they were compiled).

Part of a multi-project change.

Bug: 34169257
Test: cts-tradefed run singleCommand cts -d --module
CtsAppSecurityHostTestCases -t android.appsecurity.cts.SplitTests

Merged-In: I7b9cfd7f3c3509f3e41f0590ab650bd85faab340
(cherry-picked from commit 1103f963)

Change-Id: I6d69d463af7a0a93391dd4b7edd5b700012ba58c

am: d648b5a7

Change-Id: I9e0ddd8adff4f93399b68f5d29ee0d5fa71627d6

am: 557d1916

Change-Id: I8f5bc75892aca2132d15a3b38d79dcf195119b01

am: c787f547

Change-Id: I785929439d8c81ae7d5bf587077708c23fa50170

am: c45e9b9a

Change-Id: I6af916d823b983581c5f7b33858364af6b2e4456

am: fdb9c018

Change-Id: I97a63c04df7a70822015d99eb619b4ae0147241f

am: 9d46f9b4

Change-Id: Id3bd7d69bd07fafdf76453e52de01b2b5bb67472

These rules allow the additional tracepoints we need for running traceur
in userdebug builds to be writeable.

Bug: 37110010
Test: I'm testing by running atrace -l and confirming that the
tracepoints that I'm attempting to enable are available.

Change-Id: Ia352100ed67819ae5acca2aad803fa392d8b80fd

This commit marks surfaceflinger and app domain (except isolated_app)
as clients of Configstore HAL. This cleans up the policy and will make
it easier to restrict access to HwBinder services later.

Test: Play YouTube clip in YouTube app and YouTube web page in Chrome
Test: Take an HDR+ photo, a normal photo, a video, and slow motion
      video in Google Camera app. Check that photos show up fine and
      that videos play back with sound.
Test: Play movie using Google Play Movies
Test: Google Maps app displays the Android's correct location
Bug: 34454312
Change-Id: I0f468a4289132f4eaacfb1d13ce4e61604c2a371

This could be useful in diffs between policy versions.

Bug: 37357742
Test: sepolicy-analyze lists all attributes in precompiled_policy.
Change-Id: I6532a93d4102cf9cb12b73ee8ed86ece368f9131

am: fe84716c

Change-Id: Id6058cf5c252930b71ca648cdbf7ada0157204ff

am: 5007c10a

Change-Id: I7a35f4749c90e08632bb0013e99624cd34920d9b

am: 204da471

Change-Id: I266b02ec2b01b3a8717a724b2ca9b6b5dad258d9

Change-Id: Iafa4abcff36fe75e031fc6b6c2108a7617d34b97

am: f5defc90

Change-Id: I8a59ecbf59f8e6618bd5a06e61a46594638d6bcd

am: 9f152d98

Change-Id: I1c319ac3558e5ff96072638dc4be97502da61056

MediaProvider requires permissions that diverge from those
of a typical priv_app. This create a new domain and removes
Mtp related permissions from priv_app.

Bug: 33574909
Test: Connect with MTP, download apps and files, select ringtones
Test: DownloadProvider instrument tests, CtsProviderTestCases

Change-Id: I950dc11f21048c34af639cb3ab81873d2a6730a9

MediaProvider requires permissions that diverge from those
of a typical priv_app. This create a new domain and removes
Mtp related permissions from priv_app.

Bug: 33574909
Test: Connect with MTP, download apps and files, select ringtones
Test: DownloadProvider instrument tests, CtsProviderTestCases

Change-Id: I950dc11f21048c34af639cb3ab81873d2a6730a9

This commit marks system_server and app domains (except isolated_app)
as clients of Graphics Allocator HAL. This makes the policy cleaner
and prepares ground for restricting access to HwBinder services.

Test: Play video in YouTube app and in Google Chrome YouTube web page
Test: Using Google Camera app, take an HDR+ photo, a conventional
      photo, record a video with sound and a slow motion video with
      sound, then check that photos look good and videos play back
      fine, including sound.
Bug: 34454312
Change-Id: Iea04d38fa5520432f06af94570fa6ce16ed7979a

am: 94eaf989

Change-Id: Idb0275994d21bda3b79f83588adf67004486c410

am: 0d1b2ce1

Change-Id: I2f2bb8fb9974dca42398f7c7cc5e7ace76824d47