This addresses the following denials:

avc: denied { fowner } for comm="rm" scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:r:vold_prepare_subdirs:s0 tclass=capability
avc: denied { getattr } for comm="rm" scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:storaged_data_file:s0 tclass=file
avc: denied { relabelfrom } for comm="vold_prepare_su" name="storaged" scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir
avc: denied { getattr } for comm="rm" scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:system_data_file:s0 tclass=file

Bug: 77875245
Test: Boot device.
Change-Id: Id67bc99f151a6ccb9619bbfb7080452956405121
Test: Mislabel directories used by vold_prepare_subdirs, reboot, and
ensure it can relabel them without denials.
Test: Add user, reboot, delete user, reboot, observe no denials.

am: 0cd168c7

Change-Id: I83ff2bbba1fd9f7468e1c7ab2032eea9813b60d2

am: a949ddb5

Change-Id: Ife6c721b66c23ddd8cfcf94a1f45b9491a272252

[automerger skipped] Merge "Add internal types to 27.0[.ignore].cil." am: be79c7b2 am: 26776b03  -s ours
am: a5df96cf  -s ours

Change-Id: Ic0766929824e87a852f3faedf38f4d053133d45e

am: 26776b03  -s ours

Change-Id: Ia9ec9e2a510a495bd9b339b33f4c4c1b5735d91b

am: be79c7b2

Change-Id: Iac6379199a0f0a0680bd0ddda32644333fbaef74

am: d1c93612

Change-Id: I5e1d5378bc04449aa3c9bef5d219fc5c5030ec47

am: 97e41802

Change-Id: I07a20906f2c536e573198219e4d3d567ea715144

am: 6cdc9a82

Change-Id: I3fdc8fa4f4486ccfadf785ff82e147ad47123c37

am: 8966b8e5

Bug: 74435522
Test: traceur can share to betterbug
Change-Id: Ic24196b6a4050696d92f18a6879c569ccf5eaec7
(cherry picked from commit f66fd522)

am: fc29b9ba

Change-Id: I08862752d0e2f888adcab29c9c4dac762b8d2582

am: b5f3e88e

Change-Id: Ia52abf98b65da8309e014ac5fd3c642511e6f189

am: 354a2530

Change-Id: Iae854d7e794e9616cd1878e8096473cf9bbe0680

Bug: 69390067
Test: manual run of treble_sepolicy_tests
Change-Id: I1b772a3f7c96875765c75bfc1031f249411c3338
Merged-In: I1b772a3f7c96875765c75bfc1031f249411c3338
(cherry picked from commit 9fbd6520)

am: ddba04d0

Change-Id: Id149b9e739b3bab56f66b1855cb38a28e522de03

We often see the following denials:

avc: denied { sys_rawio } for comm="update_engine" capability=17 scontext=u:r:update_engine:s0 tcontext=u:r:update_engine:s0 tclass=capability permissive=0
avc: denied { sys_rawio } for comm="boot@1.0-servic" capability=17 scontext=u:r:hal_bootctl_default:s0 tcontext=u:r:hal_bootctl_default:s0 tclass=capability permissive=0

These are benign, so we are hiding them.

Bug: 37778617
Test: Boot device.
Change-Id: Iac196653933d79aa9cdeef7670076f0efc97b44a

am: bf685274

Change-Id: I2d17d76e68d60454ca53f4448a71fc619bbd5cd7

am: 589226df

Change-Id: I5e6efda7d87fcffed4733058ae2fab3ff1cdaecd

am: 15a9fbc2

Change-Id: I50ca168babcb859927ff96926bba0d2d60d5bdef

am: ad3602d2

Change-Id: I034f2f2c9eab3667cfa92ea41b4b5f4afa1c7df7

am: 5cac1aa9

Change-Id: I889d985e3a012545d15e3dd0f06b002682671157

Without this, we only have visibility into writes.

Looking at traces, we realised for many of the files we care about (.dex, .apk)
most filesystem events are actually reads.

See aosp/661782 for matching filesystem permission change.

Bug: 73625480

Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298

We have seen crash_dump denials for radio_data_file,
shared_relro_file, shell_data_file, and vendor_app_file.  This commit
widens an existing dontaudit to include them as well as others that we
might see.

Test: Boot device.
Change-Id: I9ad2a2dafa8e73b13c08d0cc6886274a7c0e3bac

This will allow adb shell getprop ro.vendor.build.security_patch to
properly return the correct build property, whereas previously it was
offlimits due to lack of label.

Test: adb shell getprop ro.vendor.build.security_patch successfully
returns whatever VENDOR_SECURITY_PATCH is defined to be in the Android
.mk files

Change-Id: Ie8427738125fc7f909ad8d51e4b76558f5544d49

am: c16e920d

Change-Id: I1db9f69e1abf6cc1e730fd341e06a67fe13b17ce

am: 2ccd99a5

Change-Id: I0e4eacb9cce9c995bf773176638a46af0e92af0a

avc: denied { read } for comm="batterystats-wo" name="show_stat" dev="sysfs"
scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file

Bug: 77816522
Test: build
Change-Id: I50a9bfe1a9e4df9c84cf4b2b4aedbb8f82ac94cd

am: ab2b079d

Change-Id: Iebe3e8285b1e438f635cde78b2e9f7af26751d07

am: e714c3b8

Change-Id: Ibf8b80dcca07f9a038c71ae0483ee025b27392fd

am: d4dd2f57

Change-Id: I5d027abc4455689d52284b59ae4d0d5bf7479299

am: 817d1472

Change-Id: Ic4012c572e374cc601c516fd466bf0662eddbe67

[automerger skipped] Merge "Add shell:fifo_file permission for audioserver" am: dceea502 am: dcedd5d5  -s ours
am: 4d5a7638  -s ours

Change-Id: Iec3f30a5b20b758dc6beea3f0e265a2e03884810

am: 21066890

Change-Id: I7fc2111bde48cc78b2cec9a9ca17101ac69d823a

am: 12e73685

Change-Id: Id5a3a8583d61559a9db7fae1e37a8124737f9696

am: dcedd5d5  -s ours

Change-Id: Ie0e347d32ab0b5053646558a0eafe4ff83b83d22