GitLab

* commit '50e37b93':
  Move domains into per-domain permissive mode.

* commit 'b77b3aff':
  Add the selinux policy version number.

Bug: 4070557
Change-Id: I027f76cff6df90e9909711cb81fbd17db95233c1

Bug: 8841348
Change-Id: I1acf355b8e700500eeb0ddcbb8203a4769bde3bc

* commit '92f35dcc':
  Revert "Add a policy version."

* commit 'c25023e1':
  SELinux policy: let vold write to device:dir.

Faugh. Typo.

This reverts commit adb481dd

Change-Id: Id1ccc0a59cc79b8ad7171fcb6b3d8cb3aaf29bee

* commit 'bd77ab31':
  Add a policy version.

Bug: 8841348
Change-Id: I83497c9b5346ba3b35e4e288190fc217a26be505

* commit '1adb7ca3':
  SELinux policy: let vold create /data/tmp_mnt

* commit '3b9fd5ff':
  SELinux policy: let adbd drop Linux capabilities.

Change-Id: I40f3ccd9813e0a337ced0a44e686ab489277d78b

Change-Id: Id41891b89c7b067919cbda06ab97d5eff2ad044f

I have no idea what vold is doing when this operation is attempted
(when a full-disk encrypted device is booting up). Thus, I don't know
if there is a better way of restricting the policy.

Change-Id: I537b70b1abb73c36e5abf0357b766292f625e1af

Change-Id: Ia9f34580a35d3f5ff7ea0ac9a3784d2650e61b6a

klog_write/init create /dev/__kmsg__ backed by a kernel character
device, keep the file descriptor, and then immediately unlink the
file.

Change-Id: I729d224347a003eaca29299d216a53c99cc3197c

* commit '5d54d483':
  SELinux policy: let vold setsched of kernel processes.

Change-Id: I2b7bf3037c94de4fecf3c3081497e0ac1dfef8a9

* commit '5a745c89':
  Add rules for asec containers.

Change-Id: I91f6965dafad54e98e2f7deda956e86acf7d0c96

* commit '84beb00a':
  SELinux policy granting vold the capability to reboot.

vold reboots needs to reboot the system when it succeeds or fails to
encrypt partitions.

Change-Id: Ibb1a5378228be60215162ae248e6c1049a16b830

* commit '2cb928ba':
  Remove special rules for interacting with sockets from init.

Change-Id: I544c0c1bbe84834970958a65fcef1d10e7e29047

* commit 'fb076f8b':
  Add temporary policy for wpa_supplicant.

This allows wpa_supplicant to interact with the sockets created
for it by init. Eventually we'll want those to be properly
labelled, but allow until then.

Change-Id: I33fcd22173a8d47bbc4ada8d6aa62b4d159cbb15

* commit '59e40a04':
  SELinux policy that separates "init_shell" from "shell".

* commit 'c65b2ba3':
  Update wpa_supplicant policy

"init_shell" is used for shell processes spawned by init.

Change-Id: I9e35d485bac91f3d0e4f3704acdbb9af7d617173

Change-Id: I9b05f0f2ce6c6c52b4207cac3120f06565b7da30

* commit '3123b1ee':
  SELinux policy for Bluetooth properties.

Properties under bluetooth. and persist.service.bdroid. are
considered Bluetooth-related properties.

Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7