With build/core eaa9d88cf, system_server should not be loading code
from /data.

https://bugs.chromium.org/p/project-zero/issues/detail?id=955

Bug: 37214733
Bug: 31780877
Test: Device boots and no obvious problems.
Test: No collected SELinux denials for build-server generated builds.
Change-Id: I37b1e9e6c4555c937730ab491b6c38801b38ad38

am: da2e9165

Change-Id: Iad6538b4836542a6d03f830f95e073c099d6eae8

am: 1696a6e8

Change-Id: I1e5bdf92b84a56f5bdd7731afae6d324128f241a

am: eb80c0db

Change-Id: I1b5cbd08d80ba43979da2ab46b40d28ff14a93e8

am: bf030965

Change-Id: I3a10c619ce6e65ce531276ef4f97489605897062

This is needed by linker to be able to load libraries from memfd
which currently generated following denial:
avc: denied { getattr } for path=2F6D656D66643A666F6F626172202864656C6574656429 dev="tmpfs" ino=902079 scontext=u:r:shell:s0 tcontext=u:object_r:shell_tmpfs:s0 tclass=file permissive=0

Bug: http://b/37245203
Bug: http://b/37916741
Test: builds
Change-Id: I5b57b6cada50a62657c8daaaaaa56f1ee9cdb376
(cherry picked from commit a0d3ff8e)

am: d8c14e8a

Change-Id: Ieb2f49ac368b9a3178d788900b813bc11c5231ed

am: a0d3ff8e

Change-Id: I8965be0fe9d6ae9bb3a283731d3df226a5b4173b

This is needed by linker to be able to load libraries from memfd
which currently generated following denial:
avc: denied { getattr } for path=2F6D656D66643A666F6F626172202864656C6574656429 dev="tmpfs" ino=902079 scontext=u:r:shell:s0 tcontext=u:object_r:shell_tmpfs:s0 tclass=file permissive=0

Bug: http://b/37245203
Bug: http://b/37916741
Test: builds
Change-Id: I5b57b6cada50a62657c8daaaaaa56f1ee9cdb376

am: 998c2ff9

Change-Id: Iaee20b097f4cb7b36eb39deef3b2ce8ceb70fc67

am: 47859a93

Change-Id: I3ec67ae45f165601f22f7ebb446fc626300ee1b6

This reverts commit 8713882b.

Reason for revert:  b/37355569

Bug: 37480230
Bug: 37896931
Bug: 37355569
Change-Id: Ic07d948fd0b4a0a8434e1f4f0c8e559c4258cf5e

am: bccedfff

Change-Id: If7aabff4ab21801b06c782cc2330a1b4940419ef

am: a5192389

Change-Id: I3ea264c906559df8ef4dd109166f89cc0cf366b0

am: b9d5d207

Change-Id: I521150942c9f654ad038b7b74070b35a47370300

am: 7cc3f0a9

Change-Id: Ie5fbe081e35116ee4751b43f323b83ac56993870

Bug: 37480230
Bug: 37896931
Test: build, boot
Change-Id: Ib8d4309d37b8818163a17e7d8b25155c4645edcf

am: ae9b9254

Change-Id: I6700efa4ebee1a4dd703f724400cc0add39d397c

am: d64561f7

Change-Id: Ia2b7f107e2e1ccb38f3e9010dccb7411d168dcdf

Whether a device is full Treble or not, omx should be able to
access vndbinder

Test: (sanity) oc-dev marlin boots + YouTube + lshal
Fixes: 37528973
Change-Id: Idd734b42c7dfe3e09e544680a6893b03910ecd3e

am: d1e57585

Change-Id: Id89668b9af701e98dfa305439cd7233205082161

am: 274c4e33

Change-Id: Ic46f83ae348c57ad306748d03456e62c9a4600d4

am: acbf2ad3

Change-Id: Ic59386f9a2a02438299ee11f3b36fdd7b9b34c99

am: 7f4b2ad5

Change-Id: I3c10871ddc11f43f685ef4a7064d416a1ca450f1

Merge "Sepolicy: Disable leak sanitizer for checkpolicy" am: 9e0d6aeb am: 2d7ec8d4 am: e34a9569  -s ours
am: 720cfe51

Change-Id: I7bc72e4391e10c913e807ad4035d3fdb36d7cc15

am: e34a9569  -s ours

Change-Id: Ied60d0c619b9daf7d6ecdba40e7bd2b817b0f8fe

am: 3bbe57be

Change-Id: I726d09efcda561e0158baf018a41f0608a4dc005

am: 66109bdb

Change-Id: I5271b9b04cf08656a868a6297ebf0f64f4714fd9

am: 2d7ec8d4

Change-Id: I4fc205afca8f64a710d0ceaab356a8dd76a7923a

am: 9e0d6aeb

Change-Id: I6e08846e7f580851f9cd0d7050097dcba0f5dbb8

Temporary workaround.

Bug: 37755687
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Merged-In: I001a42ea6463a1e137e1f5328755596f986323de
Change-Id: I001a42ea6463a1e137e1f5328755596f986323de

am: 79299d98

Change-Id: I2efb273610b9b89eed4da2f9588a744017adff94