Configstore HAL uses a seccomp filter which blocks the standard
path of execing crash_dump to collect crash data. Add permission
to use crash_dump's fallback mechanism.

Allowing configstore to write to the socket provided by tombstoned
required either exempting configstore from a neverallow rule, or
removing the neverallow rule entirely. Since the neverallow rule
could potentially prevent partners for doing security hardening,
it has been removed.

Bug: 64768925
Bug: 36453956

Test: killall -ABRT android.hardware.configstore@1.1-service
    Results in a call stack in logcat, and tombstone in
    /data/tombstones
Test: configstore runs without crashing
Test: SANITIZE_TARGET="address coverage" make vts -j64
    vts-tradefedrun commandAndExit vts --skip-all-system-status-check \
    -primary-abi-only --skip-preconditions -l VERBOSE --module \
    VtsHalConfigstoreV1_0IfaceFuzzer

Change-Id: I1ed5265f173c760288d856adb9292c4026da43d6

Merge "treble compat: Add test for removed public types without compat entry." into oc-mr1-dev am: 1d5131e9
am: fa78c144

Change-Id: I4646853633fe4f99a2ff48bcef7d334356ee1b89

am: 1d5131e9

Change-Id: Ia4c1e0c1969f1bc110c46a10f07b30eb7f8093a0

Merge "Add screencap domain." into stage-aosp-master am: 09d37ab9  -s ours am: 091d3fcc  -s ours am: 407cf088  -s ours
am: e44c624b  -s ours

Change-Id: Ib279dde2a1e1026bac635da1aa4a0cb96ca4a3f8

Merge "Add screencap domain." into stage-aosp-master am: 09d37ab9  -s ours am: 091d3fcc  -s ours
am: 407cf088  -s ours

Change-Id: I73e2866bbb6957ea7ebc05aa529623359e53da48

am: 091d3fcc  -s ours

Change-Id: I1411de756196e749c61cf8301bb35dd75c5ade67

am: 09d37ab9  -s ours

Change-Id: I9a1585c559e893e95292194c3656f2e5cce9871d

am: 43c8ea3b

Change-Id: I6962a57683745fd917bacef13996627f3d32bb14

am: 78b3d573

Change-Id: Iddbaf4be33221bacf04b7da18f98af6d0567f8c6

am: 3998fe08  -s ours

Change-Id: Ib15e20258b9abad1752dc6e3262a2dfbd9479f0e

am: acbaa3ae  -s ours

Change-Id: I6fcf94293ac5139d1295ae8386e59b2899329e50

am: b190016b

Change-Id: I998048a103664eacfc3b6aecc89ffea1cf277906

am: 0bf4d0db

Change-Id: I352f1142406af5fbe3d5c8142d0053cf4dc23f52

am: 6b780b35  -s ours

Change-Id: I61d2951d682b236e7643b7b81eb5c52f84024950

Only seeing this denial in permissive:
allow shell screencap_exec:file getattr;

Bug: 37565047
Test: adb shell screencap w/o root
Test: cts-tradefed run cts-dev --module CtsAadbHostTestCases
Merged-In: I9f31d2067e002e7042646ee38dbfc06687481ac7
Change-Id: I9f31d2067e002e7042646ee38dbfc06687481ac7

Only seeing this denial in permissive:
allow shell screencap_exec:file getattr;

Bug: 37565047
Test: adb shell screencap w/o root
Test: cts-tradefed run cts-dev --module CtsAadbHostTestCases
Merged-In: I9f31d2067e002e7042646ee38dbfc06687481ac7
Change-Id: I9f31d2067e002e7042646ee38dbfc06687481ac7

The treble compatibility tests check for policy differences between old
and new policy.  To do this correctly, we must not modify the policy which
represents the older policies.  Move the files meant to be changed to a
different location from the ones that are not meant to be touched to avoid
any undesired changes to old policy, e.g. commit:
2bdefd65078d890889672938c6f0d2accdd25bc5

Bug: 36899958
Test: Build-time tests build.
Change-Id: I8fa3947cfae756f37556fb34e1654382e2e48372

am: d3543981

Change-Id: I823de92dbec39e2c65f11901d0f19118b3d9f898

am: 124e1f65

Change-Id: Ic2268896648ecc125e7dde3fa173ef40907ce9a5

am: f7942eb3

Change-Id: Id13460375d61601b71291cfeee9c1aeb750a5e76

am: 346a913c

Change-Id: Icb294c01b8a8af1f8e0cff4bce13b0eaab8ab8c3

am: 7b2fb8c8

Change-Id: I8742c9e483b761672ecdb0ab3efb3f503fe4160f

Currently the build target sepolicy_tests is only being built for Treble
devices. However, the tests performed are not specific to Treble
devices.

Unconditionally build sepolicy_tests regardless of Trebleized status.

Bug: 64612408
Test: Policy compiles
Change-Id: I1bf37f6e17a0bcfde451fe668e32798120a66043

am: 12d1c4f7

Change-Id: Ieaaeeca773586aeb4ae404e5a137ec7ef67a75eb

am: 28d6e8d4

Change-Id: I4f856650230ab036caf0086009c045c1ce0e242c

am: 040e9794

Change-Id: I258d039dc2b1db6a88a79fb076cb8329530e8deb

am: 751a627c

Change-Id: I13c3fc66e68d36038d7eb3370bfdc396caf65293

am: 530e168c

Change-Id: If5108a28adc67a8f951b1429febf82080d15bdd9

am: 94e2a921

Change-Id: I3cb9bd4305fe3f6d720f757a232d4bb38de98895

Add /dev/kmsg_debug on userdebug devices, to allow crash_dump to log
crashes to dmesg when logd isn't up yet (or is the one crashing).

Bug: http://b/36574794
Test: stop tombstoned; crasher; dmesg
Change-Id: I6ffe11bc613e88198893e82712719522b74fe1be

Validate no-cross-domain /proc/PID access am: 7a463809 am: 881fe06f am: 25d4a090 am: 457c08cc
am: 8d19f93b

Change-Id: I75a8f4ae8aba2857814aa04060ca4d22e3bcc6b8

am: 457c08cc

Change-Id: I96e26eb2f86bc3df8e482c677cdbb6e655652c16

am: 25d4a090

Change-Id: I4e9bd171ca88b955d3ae2a7217336a9fa2b103fe

am: 881fe06f

Change-Id: I0868a42de485ac8d94c19f1d6082d12928ed8047