This reverts commit 3e307a4d.

Test: Builds - neverallow change only.
Bug: 62806062
Change-Id: Id3aa1b425cf48fc8586890c9850a74594584922d

am: e51e6131

Change-Id: I153a14af008e52fbe6677007e0e1ad4e472be3da

am: 11dcf197

Change-Id: I96b2af315b4c35ddd47315f3ca4a9b098eab1d59

am: 317c4171

Change-Id: I418cc929f8e0a698220e0b8b1c51314ef9ea52a8

am: 044d2072

Change-Id: Ia6f8a806adae230df50f8d06edcf4ba9d2ae4352

am: 3e307a4d

Change-Id: Ic144d924948d7b8e73939806d761d27337dbebef

am: 3e307a4d

Change-Id: I90e567c8138fa75bf792af181890d0af627b6f48

Same-process HALs are forbidden except for very specific HALs that have
been provided and whitelisted by AOSP.  As a result, a vendor extension
HAL may have a need to be accessed by untrusted_app.  This is still
discouraged, and the existing AOSP hwservices are still forbidden, but
remove the blanket prohibition.  Also indicate that this is temporary,
and that partners should expect to get exceptions to the rule into AOSP
in the future.

Bug: 62806062
Test: neverallow-only change builds.  Verify new attribute is in policy.
Change-Id: I6d3e659147d509a3503c2c9e0b6bb9016cc75832

am: 32fb7f59

Change-Id: I5d3e4657ce7b770f1a4731902d7f9cc6bab22742

am: cf698f1d

Change-Id: I20620832b99934d3e71e7f88deb50866c6fa8a1b

am: 492a53fe

Change-Id: Ic802fef5d53147e0ed2d2b588455ca8ad0843c4f

am: eb5542a1

Change-Id: I74cc45ee263121cece83ddb75133fbe2b0ff348d

am: 330d4477

Change-Id: Ice6c84f53d50b7fa987ea4e7259ecda4c64673aa

am: 330d4477

Change-Id: I6569c282114ceb09471d94cfa178535ab315c966

This is to Allow commands like `adb shell run-as ...`.

Bug: http://b/62358246
Test: run commands manually.
Change-Id: I7bb6c79a6e27ff1224a80c6ddeffb7f27f492bb2
(cherry picked from commit 1847a38b)

am: e786cbfc

Change-Id: I5978af4044cd59f853a82d2397bb700ebe907433

am: ed88246c

Change-Id: Id7a784cbe65961f876f4d2d167303dcf7854ae21

am: 6e46ccdf

Change-Id: I5241333ec9099c7db3154cfcdb41003c65e235a0

am: 3b7d9e49

Change-Id: I5f12ae2d4c00efe648d1eecbe8a322de93e6447d

run-as uses file descriptor created by adbd when running
`adb shell -t run-as xxx`. It produces audit warnings like below:

[ 2036.555371] c1    509 type=1400 audit(1497910817.864:238): avc: granted { use } for pid=4945 comm="run-as" path="/dev/pts/0" dev="devpts" ino=3 scontext=u:r:runas:s0 tcontext=u:r:adbd:s0 tclass=fd

Bug: http://b/62358246
Test: test manually that the warning disappears.
Change-Id: I19023ac876e03ce2afe18982fe753b07e4c876bb

am: ac178672

Change-Id: I1c7919c78b60997a5ead95e8efa604069cbc61d3

am: 0e6a3d87

Change-Id: I3af30f8f65918e273f634a9aa120c5cbeefd3a65

An earlier commit moved tracefs file labels from file_contexts to
tracefs.  But this requires a kernel patch that is not present on all
devices, so let's revert it until that is merged.

Bug: 62485981
Test: Built, flashed, and booted two devices.  Verified that the files
have the correct context.  Verified that traceur works.

Change-Id: I8ee3ea9864f73a92943cdbc550131d4a71b842ba

recovery exec /system/bin/{mke2fs,e2fsdroid} to format userdata

Bug: 35219933
Change-Id: I77e75c2dc55d4bea7984707f27bc215de186c4d1

More changes went into oc-dev after the freeze-date.  Reflect them.

Bug: 37896931
Test: prebuilts - none.
Change-Id: I3300751ea7362d5d96b327138544be65eb9fc483

In libprocessgroup, we want to only send signals once to processes,
particularly for SIGTERM.  We must send the signal both to all
processes within a POSIX process group and a cgroup.  To ensure that
we do not duplicate the signals being sent, we check the processes in
the cgroup to see if they're in the POSIX process groups that we're
killing.  If they are, we skip sending a second signal.  This requires
getpgid permissions, hence this SELinux change.

avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:untrusted_app_25:s0:c512,c768 tclass=process permissive=1
avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:untrusted_app_25:s0:c512,c768 tclass=process permissive=1
avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:system_app:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=797 comm="ActivityManager" scontext=u:r:system_server:s0 tcontext=u:r:system_app:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:zygote:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:zygote:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:system_server:s0 tclass=process permissive=1
avc: denied { getpgid } for pid=1 comm="init" scontext=u:r:init:s0 tcontext=u:r:system_server:s0 tclass=process permissive=1

Bug: 37853905
Bug: 62418791
Test: Boot, kill zygote, reboot
Change-Id: Ib6c265dbaac8833c47145ae28fb6594ca8545570
(cherry picked from commit c59eb4d8)

am: 3c7156b5

Change-Id: I20743966a8eedb8a5168356d6af3907234431e31

am: 581069bf

Change-Id: I58f7e0c44e68908101cb874789994885ed9a15e9

am: 77ea7ccb

Change-Id: I6ce8f52e97f0198cf712a60fd6af1e77090ec338

am: 1468f85f

Change-Id: Idd803017a8087ac9e9221c0ca6ac5893391db6de

am: 29713c8d

Change-Id: I7089b62f8c54e24af47263325e085f092231f29d

am: 39c4f76b

Change-Id: I54b821fa20f428eaad1c8ab934a7e479664a6038

am: 58d0d1e4

Change-Id: I1a2207be3509ec5bc7797b906e15da16099190ad

am: 58d0d1e4

Change-Id: Ia53beb365c39d501c9d6cd53a4cb72dec14b610b