am: 638ae7fe

Change-Id: Id7d7e918b3d7817a9da03613672aabf332a1563e

am: 97e2c65c

Change-Id: Iab07ec973bddeb2e431fadd4c839f6b882c433cf

am: edd41261

Change-Id: I86efaccb28dc12db792370a4499540676c71a71c

am: c28be992

Change-Id: I34d3f4538be44b29d56726d4f23219be765e0f32

am: bd087968

Change-Id: Ib9a7282686737a2087730734bd79fa7c7f041136

am: 5fe8881b

Change-Id: Iad652a00f3f963668cda1a6c2e2cf79d351a042c

am: 8027f979

Change-Id: I51f5c7186619238cb82b04d3db26b961d0c361a4

am: 74a96734

Change-Id: Id1a20ebb9c2bd1dfa6edcb11354bcb3e525e3f04

am: 11772818

Change-Id: Ia8e5462edc9038be7142331cfb524efd4f0e2edf

am: d8112255

Change-Id: I2b30d171bbce0013b4f63fd3639747936d6674df

am: bddd1893

Change-Id: I9c312bd8203cb859bb5bc6f2604d17bbc812a1a6

Bug:  37713584
Test: With GtsMediaTestCases.apk installed, try:
      adb shell am instrument -w
      -e class 'com.google.android.media.gts.MediaPlayerTest#testLLAMA_H264_BASELINE_240P_800_DOWNLOADED_V0_SYNC'
      'com.google.android.media.gts/android.support.test.runner.AndroidJUnitRunner'

Change-Id: Icc2066e9d9bbc5c020b6d694e9627487771ef35e

The linker now requires getattr rights for the filesystem. Otherwise
linking otapreopt and patchoat/dex2oat will fail.

Bug: 37776530
Test: m
Test: manual OTA
Change-Id: I1351fbfa101beca4ba80f84b0dd9dbcabe2c9d39

Test: Manual use of Camera app
Test: lshal shows IOmxStore

Bug: 37657124
Bug: 37726880
Change-Id: I5459d992c2feb14bd26765673864e583d48e3ba4

Fixes `adb shell cmd gpu vkjson`, which was previously failing due to
surfaceflinger not being able to use the socket passed to it by adbd.

Bug: b/37157136
Test: run above command, verified on marlin + bullhead
Change-Id: I57fa7e99d5c3dc7bc7d033b83f8ce6032162d7d3

The typical use case is where vendor apps which run as untrusted apps
use libraries that are packaged withing the apk

Bug: 37753883
Test: Tested by runnig pre-installed app that packages a library from
      /vendor/app

Change-Id: I445144e37e49e531f4f43b13f34d6f2e78d7a3cf
Signed-off-by: Sandeep Patil <sspatil@google.com>

Adding the default label/mapping is important because:
1.  Lookups of services without an selinux label should generate
    a denial.
2.  In permissive mode, lookups of a service without a label should be
    be allowed, without the default label service manager disallows
    access.
3.  We can neverallow use of the default label.

Bug: 37762790
Test: Build and flash policy onto Marlin with unlabeled vendor services.
    Add/find of unlabeled vendor services generate a denial.

Change-Id: I66531deedc3f9b79616f5d0681c87ed66aca5b80
(cherry picked from commit 639a2b84)

Test: Play Music over BT headset
Bug: 37640821
Change-Id: I1fe6c9a289315dc0118888e19250cd64aee9a0d5

Audioserver loads A2DP module directly. The A2DP module
talks to the bluetooth server.

Bug: 37640821
Test: Play Music over BT headset
Change-Id: Ie6233e52a3773b636a81234b73e5e64cfbff458e

am: 4c1385a6

Change-Id: I4da23806c532acfaaa1535ee87b25383a99723d7

am: 4a318ad6

Change-Id: Iffd30a9cfee48626dc01635877b90ef7a1e8f9b0

am: ee8b67df

Change-Id: Ic2fe390f95f0be43ad39a50366e0300a398aa0ad

Temporary workaround.

Bug: 37755687
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Change-Id: I001a42ea6463a1e137e1f5328755596f986323de

am: 89671020

Change-Id: Icbb3d5a87181e65d574007764d69c766d7b31e57

am: 22ebf24e

Change-Id: If8dc1ae0d2269cbe70617748fded75b5162780b8

Destroy the policy before exiting (for successful = expected runs).

Bug: 37757759
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Change-Id: I67e35fbede696ec020a53b69a6cef9f374fae167

am: b9d5d5cc

Change-Id: Ie43b0d5ad797501a965ff6f69c37ba619fb5f588

* changes:
  NFC HAL no longer violates socket access restrictions
  Remove access to sock_file for hal_nfc

am: adfc5db0

Change-Id: Id0f7e56ee0473a2cf8bc04e4d1d02d6fa23d649c