am: 1531e72e

Change-Id: Ic1f5e2815740222e35011738a6f391b5d2222019

am: 985cb4a9

Change-Id: I2bcf90ed02d7d209656e2395ef61a1a0c07f6ba4

am: 5f49b8dc

Change-Id: I198489f0a93e278b187f8708922cb5bdda9a2e15

am: 9b9c7879

Change-Id: I8aeb126fe62f13d3dccba3b6bb8d1547ab2bc814

am: fb15c9f1

Change-Id: I43acccc8658c9fade28fe3513f48627d765450d3

This cherry-pick exists to update stage-aosp-master sepolicy
files to look like the ones in master and aosp. It looks like
it was an overlook this patch was merged with DO NOT MERGE
instead of only Merged-In.

Bug: 111276913
Test: manual verification

Merged-In: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
Change-Id: If76dc7bfdad87789a58fc94e0fd280deae1a41ab
(cherry picked from commit 73e7fa88)

Add the required permissions for the InputClassifier HAL.

Bug: 62940136
Test: no selinux denials in logcat when HAL is used inside input flinger.
Change-Id: Ibc9b115a83719421d56ecb4bca2fd196ec71fd76

Bug: b/122620633
Test: m
Change-Id: I36fe66fc22a1664f9ef25c66f933a2613a6f346b

When recording hour-long traces, logcat messages help
to interpret the trace, giving human readable context on what
is happening on the system.
Furthermore this is particularly helpful for startup
debugging thanks to activity manager instrumentation events
(am_on_create_called, am_on_start, ...).
This is only allowed on userdebug/eng builds.

Bug: 122243384
Change-Id: I4dfaebf21107e9853b0bf42403fbab6c3b4d5141

Bug: 116512211
Test: Builds, boots, including upcoming changes needing this
Change-Id: I6f119368c5a4f7ac6c0325915dff60124c5a6399

am: 0fa0d1e5

Change-Id: Ie1d550d4dcb0123db423f1625d4489e16befe580

am: b1ab8c6f

Change-Id: I7f1ba386bc168b0f5607308d3cc180f43146a3df

The way we build and run CTS expects full_treble_only and
compatible_property_only macros to be applied to whole rules and not be
nested inside other rules.

Fixes: 122601363
Test: corresponding neverallow rule in auto-generated
SELinuxNeverallowRulesTest.java is parsed correctly.
Change-Id: Ibf5187cedca72510fe74c6dc55a75a54a86c02ff

bug: 111407413
Change-Id: Ica209ad9476b0597a206bf53823a1928643c8256

am: cd1c24f3

Change-Id: I11c6f1d25977837b5388de34a3796b7cadcf5ea8

am: a7397469

Change-Id: Iddcc2231c391c512b03dfa9779661518ffec141b

am: 7813cf42

Change-Id: I5bba542852de7b2bebc5777b0452519453db5cdc

runas_app domain is used by lldb/ndk-gdb/simpleperf to debug/profile
debuggable apps. But it misses permissions to ptrace app processes and
read /proc/<app_pid> directory.

Bug: none
Test: build and boot marlin.
Test: run lldb and simpleperf on apps with target sdk version 24-29.
Change-Id: I9e6f940ec81a8285eae8db3b77fb1251a25dedd0

In order to use the bionic libs and the dynamic linker from the runtime
APEX for all processes that are started after the APEX is activated, the
paths /system/lib/{libc.so|libm.so|libdl.so} and /system/bin/linker are
bind-mounted to the corresponding bionic libs and the dynamic linker
in the runtime APEX.

This bind mount allows us to keep other part of the platform and the
tests having implicit assumption that bionic libs are located at
/system/lib and loaded from the default linker namespace.

Bug: 120266448
Test: device boots

Change-Id: Ied611b267d187ee3d75a139c378ee12242d5b8d8

am: 39b0b80c

Change-Id: Iff335fa5d47c7d745625f5c56540b724818ac020

am: b4eef1ae

Change-Id: I105c5e66c53f4785419d18436b5d7fb7b42196e3

am: 35650d50

Change-Id: I222870431b122babc913fe0dd78920632f5bd8bc

am: 6ac0896b

Change-Id: Ia4e14801bdea9078ea20bf9477ba3d61d29d9177

am: 3507678d

Change-Id: Ie68e48ed83afa9cf8b55bf17befd19524d964fa3

am: 5da72005

Change-Id: I2f54927fb8c7e6a73c9bdb31cfd79186bcd3d12a

am: ade74163

Change-Id: I3283f121a7dfae31fcd9c831be4c51165f4b6d12

Bug: 33308258
Test: atest CtsSelinuxTargetSdk25TestCases
Change-Id: Ifeceecec7b2f38ebd38b6693712b8f65ee24dc5d

Recent change in netd and bpfloader switched the creater of bpf maps
from netd to bpfloader. Change the rules related to it to make sure it
doesn't fail.

Test: dumpsys netd trafficcontroller
Bug: 112334572
Change-Id: I016ff68b58ef7b12bdfdebc2fd178be1d0206a62

Bug: 119305624
Test: normal/recovery boot aosp_taimen

Change-Id: I46da995886ce421bb87e741d577f659426ff79c4

Bug: 119305624
Test: normal/recovery boot aosp_taimen
Change-Id: I15aa275fa658b58f5a5d3e651d164f9fcd87c0af