am: c28a5c5d

Change-Id: Idd1d93beb393a9cd31bc2cf35b722920f9e31855

am: b9bd6708

Change-Id: Ie76de5da8e9a370e2f744d158ead93bbc1d0a508

am: 9c7a0d8c

Change-Id: I139d43838b74a8e7340d145d7c644efa090457db

am: 82696dd1

Change-Id: Ib04932a421523eb50c2e40bf24000ae58ac7a535

am: 8ee64187

Change-Id: I6c035c3e696531297ff8a3c09045acf6d2c98cd0

am: 462cf398

Change-Id: I12d310b90e6863a56c1fc269ce237e93864d88f8

am: 36e725e5

Change-Id: I920f2163d0ce225389c9c649061957d23006868c

am: ee97662f

Change-Id: I6e2eba3f0081494508b015f6bd785085638f1cee

darwin's getopt() doesn't like putting arguments
in the wrong order.

Test: Mac/Linux builds
Change-Id: If632e9077c1b5714f91c5adaa04afb4963d9b0f5

am: c7b645c8

Change-Id: I118f8f0390177ae8fdc8115fe502a10b1f3d6426

am: f497d0b7

Change-Id: I8b75d668cbc30b81731aed7421327a3f2f4b19a8

We should give appdomain the access to the /vendor/framework directory
since the jar in the directory is not dexopt-ed.AFAIK, jars which are
not in the bootclasspath are not dexopt-ed by default.

Bug: b/37129319
Test: built and confirmed that embms.apk not crashed

Change-Id: Ic2b1eef472f2fba53e26403dde8ad9ede8105a03

* changes:
  Allow 'su' domain access to vndbinder.
  Modify checkfc to check (vnd|hw)service_manager_type.

am: 8fc97616

Change-Id: I101d321fd855acf15c0cd4617da7b6961cab2a20

am: 77154b39

Change-Id: Ia6c653fcab261084d6dcbb3d3ec8e3311fdf4fca

am: 84b3879a

Change-Id: I64c0a4e8ae9978fe8b809e21ae8b3e9b0b3feb98

am: 04ef57bf

Change-Id: I906f85514efb4301ac0bafaf140deba7be76cdee

For example, for listing vndbinder services
using 'adb shell service -v list'

Test: adb shell service -v list
Bug: 36987120
Change-Id: Ibf3050710720ae4c920bc4807c9a90ba43717f3b

added checkfc options 'l' and 'v' to verify hwservice_manager_type
and vndservice_manager_type on service context files, respectively.

The checkfc call to verify the new hwservice_contexts files will
be added together with hwservicemanager ACL CLs later.

Bug: 34454312
Bug: 36052864
Test: device boots, works
Change-Id: Ie3b56da30be47c95a6b05d1bc5e5805acb809783

am: 870160d5

Change-Id: Ia54190a372be0ffb8ed573dab31cdce4c0ddbf7a

am: 42424f13

Change-Id: Id9375a6dc3688408e306bdc051fec4d8754d07eb

am: faea9dc2

Change-Id: Ia1ca45499e8ef960c2d23aa20494fa1884e2f7b6

am: 6c1362b2

Change-Id: Id4a437ec7acbf362cd82690fe0d850dd0951c104

am: c98b275e

Change-Id: I424909584152898fa81d8eacf664db851f47e37c

am: d4a96aac

Change-Id: I89f24a3ba1ca855aba0731f8320aeac93e7bcb66

am: ec5e26e4

Change-Id: Ie791b20d2ae2e2690846f18fa0bc74926990bdbc

am: ed3458c2

Change-Id: I47746d594572760d25b569fb877351c4f1ea1628

am: f79d1904

Change-Id: I7bda1cd1af603adc5fbf142c66bdf5b6b146ad7f

am: df679fdb

Change-Id: I4f0d343f42d8bc5c97b2a7c129c63c8e7c50cd3d

am: 9075699a

Change-Id: If3e3e246b7ef5ed0142bc7b180d4d7cfb559ea03

am: 1b5f81a2

Change-Id: Ic9e87837f68ac31cfedd735bd20a44cdf029c79e

* changes:
  sepolicy: fix comments around 'domain' access to search in /vendor
  sepolicy: remove redudant rule for symlinks in /vendor/app
  sepolicy: restrict access for /vendor/framework.
  sepolicy: restrict /vendor/overlay from most coredomains
  sepolicy: restrict /vendor/app from most coredomains

This is a necessary first step to finalizing the SELinux policy build
process.  The mapping_sepolicy.cil file is required to provide backward
compatibility with the indicated vendor-targeted version.

This still needs to be extended to provide N mapping files and corresponding
SHA256 outputs, one for each of the N previous platform versions with which
we're backward-compatible.

(cherry-pick of commit: 0e9c47c0)

Bug: 36783775
Test: boot device with matching sha256 and non-matching and verify that
device boots and uses either precompiled or compiled policy as needed. Also
verify that mapping_sepolicy.cil has moved.

Change-Id: I5692fb87c7ec0f3ae9ca611f76847ccff9182375

am: c01e5a13

Change-Id: I700030a34443305af955a6153921447024a90d4f

am: 38416182

Change-Id: I9e08b187ccad4f4263de54aae1248b1691aa7d08

Some of the same process HAL labeling was missing from Marlin.
These are identified by tracking library dependencies.

Bug: 37084733
Test: Build and boot sailfish. The change allows the labelled libraries
      to be opened by any domain. So, the boot test is sufficient.

Change-Id: Id55e834d6863ca644f912efdd690fccb71d3eaf3
Signed-off-by: Sandeep Patil <sspatil@google.com>