am: d64561f7

Change-Id: Ia2b7f107e2e1ccb38f3e9010dccb7411d168dcdf

Whether a device is full Treble or not, omx should be able to
access vndbinder

Test: (sanity) oc-dev marlin boots + YouTube + lshal
Fixes: 37528973
Change-Id: Idd734b42c7dfe3e09e544680a6893b03910ecd3e

am: 274c4e33

Change-Id: Ic46f83ae348c57ad306748d03456e62c9a4600d4

am: acbf2ad3

Change-Id: Ic59386f9a2a02438299ee11f3b36fdd7b9b34c99

am: 7f4b2ad5

Change-Id: I3c10871ddc11f43f685ef4a7064d416a1ca450f1

am: e34a9569  -s ours

Change-Id: Ied60d0c619b9daf7d6ecdba40e7bd2b817b0f8fe

am: 66109bdb

Change-Id: I5271b9b04cf08656a868a6297ebf0f64f4714fd9

am: 2d7ec8d4

Change-Id: I4fc205afca8f64a710d0ceaab356a8dd76a7923a

am: 9e0d6aeb

Change-Id: I6e08846e7f580851f9cd0d7050097dcba0f5dbb8

Temporary workaround.

Bug: 37755687
Test: ASAN_OPTIONS= SANITIZE_HOST=address m
Merged-In: I001a42ea6463a1e137e1f5328755596f986323de
Change-Id: I001a42ea6463a1e137e1f5328755596f986323de

am: 638ae7fe

Change-Id: Id7d7e918b3d7817a9da03613672aabf332a1563e

am: 97e2c65c

Change-Id: Iab07ec973bddeb2e431fadd4c839f6b882c433cf

am: edd41261

Change-Id: I86efaccb28dc12db792370a4499540676c71a71c

am: c28be992

Change-Id: I34d3f4538be44b29d56726d4f23219be765e0f32

am: bd087968

Change-Id: Ib9a7282686737a2087730734bd79fa7c7f041136

am: 5fe8881b

Change-Id: Iad652a00f3f963668cda1a6c2e2cf79d351a042c

am: 8027f979

Change-Id: I51f5c7186619238cb82b04d3db26b961d0c361a4

am: 74a96734

Change-Id: Id1a20ebb9c2bd1dfa6edcb11354bcb3e525e3f04

am: 11772818

Change-Id: Ia8e5462edc9038be7142331cfb524efd4f0e2edf

am: d8112255

Change-Id: I2b30d171bbce0013b4f63fd3639747936d6674df

am: bddd1893

Change-Id: I9c312bd8203cb859bb5bc6f2604d17bbc812a1a6

Bug:  37713584
Test: With GtsMediaTestCases.apk installed, try:
      adb shell am instrument -w
      -e class 'com.google.android.media.gts.MediaPlayerTest#testLLAMA_H264_BASELINE_240P_800_DOWNLOADED_V0_SYNC'
      'com.google.android.media.gts/android.support.test.runner.AndroidJUnitRunner'

Change-Id: Icc2066e9d9bbc5c020b6d694e9627487771ef35e

The linker now requires getattr rights for the filesystem. Otherwise
linking otapreopt and patchoat/dex2oat will fail.

Bug: 37776530
Test: m
Test: manual OTA
Change-Id: I1351fbfa101beca4ba80f84b0dd9dbcabe2c9d39

Test: Manual use of Camera app
Test: lshal shows IOmxStore

Bug: 37657124
Bug: 37726880
Change-Id: I5459d992c2feb14bd26765673864e583d48e3ba4

Fixes `adb shell cmd gpu vkjson`, which was previously failing due to
surfaceflinger not being able to use the socket passed to it by adbd.

Bug: b/37157136
Test: run above command, verified on marlin + bullhead
Change-Id: I57fa7e99d5c3dc7bc7d033b83f8ce6032162d7d3

The typical use case is where vendor apps which run as untrusted apps
use libraries that are packaged withing the apk

Bug: 37753883
Test: Tested by runnig pre-installed app that packages a library from
      /vendor/app

Change-Id: I445144e37e49e531f4f43b13f34d6f2e78d7a3cf
Signed-off-by: Sandeep Patil <sspatil@google.com>

Adding the default label/mapping is important because:
1.  Lookups of services without an selinux label should generate
    a denial.
2.  In permissive mode, lookups of a service without a label should be
    be allowed, without the default label service manager disallows
    access.
3.  We can neverallow use of the default label.

Bug: 37762790
Test: Build and flash policy onto Marlin with unlabeled vendor services.
    Add/find of unlabeled vendor services generate a denial.

Change-Id: I66531deedc3f9b79616f5d0681c87ed66aca5b80
(cherry picked from commit 639a2b84)

Test: Play Music over BT headset
Bug: 37640821
Change-Id: I1fe6c9a289315dc0118888e19250cd64aee9a0d5