For input experiments that are enabled at boot time, allow system_server
to read and write the device config flags.

Bug: 120794829
Test: presubmit
Change-Id: I0f075a7579c593d4e07c3e31be529e34554068a6

* changes:
  Split mapping file into system and product parts
  Rename plat_pub_policy -> pub_policy
  Remove obsolete mapping build rules.

Test: m -j & manually on device
Change-Id: I3f5ddeb26ddf1bf280ef5e7b3e62b4b892b83a3c

avc: denied { read } for comm="init" name="verity" dev="sysfs" ino=44746
scontext=u:r:init:s0 tcontext=u:object_r:sysfs_fs_ext4_features:s0 tclass=file
permissive=0

Bug: 117437571
Test: bootable for phone projects
Change-Id: I4c53e03ec55c2064f1b23c0cbd0302de3f8aa38e

The application zygote is a new sort of zygote process that is a
child of the regular zygote. Each application zygote is tied to the
application for which it's launched. Once it's started, it will
pre-load some of the code for that specific application, much like
the regular zygote does for framework code.

Once the application zygote is up and running, it can spawn
isolated service processes that run in the isolated_app domain. These
services can then benefit from already having the relevant
application code and data pre-loaded.

The policy is largely the same as the webview_zygote domain,
however there are a few crucial points where the policy is different.

1) The app_zygote runs under the UID of the application that spawned
   it.
2) During app_zygote launch, it will call a callback that is
   controlled by the application, that allows the application to
   pre-load code and data that it thinks is relevant.

Especially point 2 is imporant: it means that untrusted code can run
in the app_zygote context. This context is severely limited, and the
main concern is around the setgid/setuid capabilities. Those conerns
are mitigated by installing a seccomp filter that only allows
setgid/setuid to be called in a safe range.

Bug: 111434506
Test: app_zygote can start and fork children without denials.
Change-Id: I1cc49ee0042d41e5ac6eb81d8f8a10ba448d4832

Both mapping files need to be included when building sepolicy at boot
time.

Bug: 119305624
Test: boot taimen
Test: "cnd" type is declared in /vendor; "dataservice_app" type is
declared in /product. This permission is preserved
"allow cnd dataservice_app:binder { transfer call };"
Change-Id: I138f34208ea05e170defd2b4ef4700ffa81f9573

Public policy that is available to vendor (and odm) sepolicy is a
combination of system and product public sepolicy. Since "plat_" prefix
implies a pure system sepolicy component, drop "plat_" prefix from
"plat_pub_policy" to be consistent with naming in this file.

Bug: 119305624
Test: m selinux_policy
Change-Id: Iaf094702556ce97371fa1c58c01d707103d7f7d6

Mapping files for previous releases are unconditionally packaged on the
device. No need to account for case when BOARD_SEPOLICY_VERS and
PLATFORM_SEPOLICY_VERSION are different.

Bug: 119305624
Test: m selinux_policy
Change-Id: I36c3c43f96870d9a71adf91c8fb8926587c5a50e

We will generate precompiled layouts as part of the package install or upgrade
process. This means installd needs to be able to invoke viewcompiler. This
change gives installd and viewcompiler the minimal set of permissions needed for
this to work.

Bug: 111895153
Test: manual
Change-Id: Ic1fe60bd264c497b5f79d9e1d77c2da4e092377b

This line always prints when building master branch, it's not
particularly useful.

system/sepolicy/Android.mk:77: warning: BOARD_SEPOLICY_VERS not
specified, assuming current platform version

Test: build
Change-Id: I52f8dc2a77966bc0c21168b1339f3029185e5339

Test: build
Change-Id: I2ea39c767264339e300fceeb23c506883d23a14c

This patch adds the necessary SELinux contexts for the blastula pool
sockets.

Topic: zygote-prefork
Test: make & flash & check log for message
Bug: 68253328
Change-Id: I46d62e5ab8c573cb7704feec2b1d42d91a990fd9

The testharness service will manage Test Harness Mode and provide a
command-line interface for users to enable Test Harness Mode; however it
does not directly provide a public API.

Bug: 80137798
Test: make
Test: flash crosshatch
Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e

IAllocator and IMappaer are being rev'd to 3.0. Update sepolicy to
allow them to be used.

Test: compile with allocator/mapper patches add boot the device
Bug: 120493579
Change-Id: Id241c6bd79c02ec93d8dd415539f90a18f733d03

iorapd needs to access these events on-device
through perfetto.

Bug: 122606712
Bug: 72170747
Change-Id: I819dc9b79e85c3e261859d125c680a50737351da

Used to capture and restore app data snapshots as implemented in change
I3e4d36c11e52fb885b585b1946e215cf986206fd.

Test: make, manual
Bug: 112431924

Change-Id: I1cd1ec3f9c93c4af65b662a5ada582299b595a8f

Getting rid of the feature in aosp/874979.
See other CL and bug for context.

Bug: 122987614
Bug: 122987614
Test: run dumpstate before and after patch,
      file sizes are comparable,
      observed no tracing-related errors.
Change-Id: Ifcde8dcbb99ce53d226b50ddd3178adaaa4322bd

The backup system service will move its storage location to per-user CE
directories to support multiple users. Add additional iterations on the
existing rules to support the new location.

/data/backup -> /data/system_ce/[user id]/backup
Previously covered by rule backup_data_file

/cache/backup -> /data/system_ce/[user id]/backup_stage
Previously covered by rule cache_backup_file

Also add support for vold to create and perform restorecon on the new
locations.

Example denials and detailed proposal in the doc on the linked bug.

Bug: 121197420
Test: 1) Boot device; check dirs created with correct label; run backup
successfully on system user
2) Create secondary user; check dirs created with correct label; run
backup successfully

Change-Id: I47faa69cd2a6ac55fb762edbf366a86d3b06ca77

BUG:111441001
Test: boots
Change-Id: I71a54e8335c5ce7f9d97af3dbbd62e663bb66d33

This allows fs_mgr in init to build loopback device and its control.

Bug: 74582279
Change-Id: I039cd57d4638870a59dd38c952d3ab9b671be545
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>

These are APEX files in /data/staging, and will be accessed by the loop
driver in the kernel.

Bug: 118865310
Test: no denials on emulator
Change-Id: I5c849b6677566cb00d28011352b9dc6b787a0bc4

These dontaudit rules were in place to suppress SELinux denials due to
file descriptor leakage. The file descriptor leakage has been fixed, so
these rules are no longer necessary. Delete.

Fixes: 120983106
Test: cts-tradefed run cts-dev -m CtsRenderscriptTestCases
Change-Id: I5cad79c3526583bd2b65bd089fee9c490f6beb5e

Define a rollback_data_file label and apply it to the snapshots
directory. This change contains just enough detail to allow
vold_prepare_subdirs to prepare these directories correctly.

A follow up change will flesh out the access policy on these
directories in more detail.

Test: make, manual
Bug: 112431924

Change-Id: I4fa7187d9558697016af4918df6e34aac1957176

config sepolicy to allow netd to write to statsd.

Test: run runtests.sh, make sure no missing test and get all pass
      run /out/host/linux-x86/bin/statsd_testdrive 82
      Got following metric data dump:pass for local test
Bug: 119862317

Change-Id: Ieff5ca55de46715d54ef57c4a6d144fd7d03e4b7