Remove 28.0 compat support

Treble doesn't support U system + P vendor, so removing P (28.0)
prebuilts and compat files.

Bug: 267692547
Test: build
Change-Id: I3734a3d331ba8071d00cc196a2545773ae6a7a60

compat/Android.bp

@@ -23,13 +23,6 @@ package {
     default_applicable_licenses: ["system_sepolicy_license"],
 }
 
-se_build_files {
-    name: "28.0.board.compat.map",
-    srcs: [
-        "compat/28.0/28.0.cil",
-    ],
-}
-
 se_build_files {
     name: "29.0.board.compat.map",
     srcs: [
@@ -65,13 +58,6 @@ se_build_files {
     ],
 }
 
-se_build_files {
-    name: "28.0.board.compat.cil",
-    srcs: [
-        "compat/28.0/28.0.compat.cil",
-    ],
-}
-
 se_build_files {
     name: "29.0.board.compat.cil",
     srcs: [
@@ -107,13 +93,6 @@ se_build_files {
     ],
 }
 
-se_build_files {
-    name: "28.0.board.ignore.map",
-    srcs: [
-        "compat/28.0/28.0.ignore.cil",
-    ],
-}
-
 se_build_files {
     name: "29.0.board.ignore.map",
     srcs: [
@@ -149,13 +128,6 @@ se_build_files {
     ],
 }
 
-se_cil_compat_map {
-    name: "plat_28.0.cil",
-    stem: "28.0.cil",
-    bottom_half: [":28.0.board.compat.map{.plat_private}"],
-    top_half: "plat_29.0.cil",
-}
-
 se_cil_compat_map {
     name: "plat_29.0.cil",
     stem: "29.0.cil",
@@ -188,14 +160,7 @@ se_cil_compat_map {
     name: "plat_33.0.cil",
     stem: "33.0.cil",
     bottom_half: [":33.0.board.compat.map{.plat_private}"],
-}
+    top_half: "plat_34.0.cil",
-
-se_cil_compat_map {
-    name: "system_ext_28.0.cil",
-    stem: "28.0.cil",
-    bottom_half: [":28.0.board.compat.map{.system_ext_private}"],
-    top_half: "system_ext_29.0.cil",
-    system_ext_specific: true,
 }
 
 se_cil_compat_map {
@@ -235,14 +200,7 @@ se_cil_compat_map {
     stem: "33.0.cil",
     bottom_half: [":33.0.board.compat.map{.system_ext_private}"],
     system_ext_specific: true,
-}
+    top_half: "system_ext_34.0.cil",
-
-se_cil_compat_map {
-    name: "product_28.0.cil",
-    stem: "28.0.cil",
-    bottom_half: [":28.0.board.compat.map{.product_private}"],
-    top_half: "product_29.0.cil",
-    product_specific: true,
 }
 
 se_cil_compat_map {
@@ -282,12 +240,7 @@ se_cil_compat_map {
     stem: "33.0.cil",
     bottom_half: [":33.0.board.compat.map{.product_private}"],
     product_specific: true,
-}
+    top_half: "product_34.0.cil",
-
-se_cil_compat_map {
-    name: "28.0.ignore.cil",
-    bottom_half: [":28.0.board.ignore.map{.plat_private}"],
-    top_half: "29.0.ignore.cil",
 }
 
 se_cil_compat_map {
@@ -317,6 +270,7 @@ se_cil_compat_map {
 se_cil_compat_map {
     name: "33.0.ignore.cil",
     bottom_half: [":33.0.board.ignore.map{.plat_private}"],
+    top_half: "34.0.ignore.cil",
 }
 
 se_cil_compat_map {
@@ -344,6 +298,7 @@ se_cil_compat_map {
     name: "system_ext_33.0.ignore.cil",
     bottom_half: [":33.0.board.ignore.map{.system_ext_private}"],
     system_ext_specific: true,
+    top_half: "system_ext_34.0.ignore.cil",
 }
 
 se_cil_compat_map {
@@ -371,11 +326,7 @@ se_cil_compat_map {
     name: "product_33.0.ignore.cil",
     bottom_half: [":33.0.board.ignore.map{.product_private}"],
     product_specific: true,
-}
+    top_half: "product_34.0.ignore.cil",
-
-se_compat_cil {
-    name: "28.0.compat.cil",
-    srcs: [":28.0.board.compat.cil{.plat_private}"],
 }
 
 se_compat_cil {
@@ -403,13 +354,6 @@ se_compat_cil {
     srcs: [":33.0.board.compat.cil{.plat_private}"],
 }
 
-se_compat_cil {
-    name: "system_ext_28.0.compat.cil",
-    srcs: [":28.0.board.compat.cil{.system_ext_private}"],
-    stem: "28.0.compat.cil",
-    system_ext_specific: true,
-}
-
 se_compat_cil {
     name: "system_ext_29.0.compat.cil",
     srcs: [":29.0.board.compat.cil{.system_ext_private}"],
@@ -448,3 +392,69 @@ se_compat_cil {
 se_compat_test {
     name: "sepolicy_compat_test",
 }
+
+se_build_files {
+    name: "34.0.board.compat.map",
+    srcs: ["compat/34.0/34.0.cil"],
+}
+
+se_build_files {
+    name: "34.0.board.compat.cil",
+    srcs: ["compat/34.0/34.0.compat.cil"],
+}
+
+se_build_files {
+    name: "34.0.board.ignore.map",
+    srcs: ["compat/34.0/34.0.ignore.cil"],
+}
+
+se_cil_compat_map {
+    name: "plat_34.0.cil",
+    stem: "34.0.cil",
+    bottom_half: [":34.0.board.compat.map{.plat_private}"],
+}
+
+se_cil_compat_map {
+    name: "system_ext_34.0.cil",
+    stem: "34.0.cil",
+    bottom_half: [":34.0.board.compat.map{.system_ext_private}"],
+    system_ext_specific: true,
+}
+
+se_cil_compat_map {
+    name: "product_34.0.cil",
+    stem: "34.0.cil",
+    bottom_half: [":34.0.board.compat.map{.product_private}"],
+    product_specific: true,
+}
+
+se_cil_compat_map {
+    name: "34.0.ignore.cil",
+    bottom_half: [":34.0.board.ignore.map{.plat_private}"],
+}
+
+se_cil_compat_map {
+    name: "system_ext_34.0.ignore.cil",
+    stem: "34.0.ignore.cil",
+    bottom_half: [":34.0.board.ignore.map{.system_ext_private}"],
+    system_ext_specific: true,
+}
+
+se_cil_compat_map {
+    name: "product_34.0.ignore.cil",
+    stem: "34.0.ignore.cil",
+    bottom_half: [":34.0.board.ignore.map{.product_private}"],
+    product_specific: true,
+}
+
+se_compat_cil {
+    name: "34.0.compat.cil",
+    srcs: [":34.0.board.compat.cil{.plat_private}"],
+}
+
+se_compat_cil {
+    name: "system_ext_34.0.compat.cil",
+    stem: "34.0.compat.cil",
+    srcs: [":34.0.board.compat.cil{.system_ext_private}"],
+    system_ext_specific: true,
+}

prebuilts/api/28.0/private/access_vectors

@@ -1,726 +0,0 @@
-#
-# Define common prefixes for access vectors
-#
-# common common_name { permission_name ... }
-
-
-#
-# Define a common prefix for file access vectors.
-#
-
-common file
-{
-	ioctl
-	read
-	write
-	create
-	getattr
-	setattr
-	lock
-	relabelfrom
-	relabelto
-	append
-	map
-	unlink
-	link
-	rename
-	execute
-	quotaon
-	mounton
-}
-
-
-#
-# Define a common prefix for socket access vectors.
-#
-
-common socket
-{
-# inherited from file
-	ioctl
-	read
-	write
-	create
-	getattr
-	setattr
-	lock
-	relabelfrom
-	relabelto
-	append
-	map
-# socket-specific
-	bind
-	connect
-	listen
-	accept
-	getopt
-	setopt
-	shutdown
-	recvfrom
-	sendto
-	name_bind
-}
-
-#
-# Define a common prefix for ipc access vectors.
-#
-
-common ipc
-{
-	create
-	destroy
-	getattr
-	setattr
-	read
-	write
-	associate
-	unix_read
-	unix_write
-}
-
-#
-# Define a common for capability access vectors.
-#
-common cap
-{
-	# The capabilities are defined in include/linux/capability.h
-	# Capabilities >= 32 are defined in the cap2 common.
-	# Care should be taken to ensure that these are consistent with
-	# those definitions. (Order matters)
-
-	chown
-	dac_override
-	dac_read_search
-	fowner
-	fsetid
-	kill
-	setgid
-	setuid
-	setpcap
-	linux_immutable
-	net_bind_service
-	net_broadcast
-	net_admin
-	net_raw
-	ipc_lock
-	ipc_owner
-	sys_module
-	sys_rawio
-	sys_chroot
-	sys_ptrace
-	sys_pacct
-	sys_admin
-	sys_boot
-	sys_nice
-	sys_resource
-	sys_time
-	sys_tty_config
-	mknod
-	lease
-	audit_write
-	audit_control
-	setfcap
-}
-
-common cap2
-{
-	mac_override	# unused by SELinux
-	mac_admin	# unused by SELinux
-	syslog
-	wake_alarm
-	block_suspend
-	audit_read
-}
-
-#
-# Define the access vectors.
-#
-# class class_name [ inherits common_name ] { permission_name ... }
-
-
-#
-# Define the access vector interpretation for file-related objects.
-#
-
-class filesystem
-{
-	mount
-	remount
-	unmount
-	getattr
-	relabelfrom
-	relabelto
-	associate
-	quotamod
-	quotaget
-}
-
-class dir
-inherits file
-{
-	add_name
-	remove_name
-	reparent
-	search
-	rmdir
-	open
-	audit_access
-	execmod
-}
-
-class file
-inherits file
-{
-	execute_no_trans
-	entrypoint
-	execmod
-	open
-	audit_access
-}
-
-class lnk_file
-inherits file
-{
-	open
-	audit_access
-	execmod
-}
-
-class chr_file
-inherits file
-{
-	execute_no_trans
-	entrypoint
-	execmod
-	open
-	audit_access
-}
-
-class blk_file
-inherits file
-{
-	open
-	audit_access
-	execmod
-}
-
-class sock_file
-inherits file
-{
-	open
-	audit_access
-	execmod
-}
-
-class fifo_file
-inherits file
-{
-	open
-	audit_access
-	execmod
-}
-
-class fd
-{
-	use
-}
-
-
-#
-# Define the access vector interpretation for network-related objects.
-#
-
-class socket
-inherits socket
-
-class tcp_socket
-inherits socket
-{
-	node_bind
-	name_connect
-}
-
-class udp_socket
-inherits socket
-{
-	node_bind
-}
-
-class rawip_socket
-inherits socket
-{
-	node_bind
-}
-
-class node
-{
-	recvfrom
-	sendto
-}
-
-class netif
-{
-	ingress
-	egress
-}
-
-class netlink_socket
-inherits socket
-
-class packet_socket
-inherits socket
-
-class key_socket
-inherits socket
-
-class unix_stream_socket
-inherits socket
-{
-	connectto
-}
-
-class unix_dgram_socket
-inherits socket
-
-class bpf
-{
-	map_create
-	map_read
-	map_write
-	prog_load
-	prog_run
-}
-
-#
-# Define the access vector interpretation for process-related objects
-#
-
-class process
-{
-	fork
-	transition
-	sigchld # commonly granted from child to parent
-	sigkill # cannot be caught or ignored
-	sigstop # cannot be caught or ignored
-	signull # for kill(pid, 0)
-	signal  # all other signals
-	ptrace
-	getsched
-	setsched
-	getsession
-	getpgid
-	setpgid
-	getcap
-	setcap
-	share
-	getattr
-	setexec
-	setfscreate
-	noatsecure
-	siginh
-	setrlimit
-	rlimitinh
-	dyntransition
-	setcurrent
-	execmem
-	execstack
-	execheap
-	setkeycreate
-	setsockcreate
-	getrlimit
-}
-
-
-#
-# Define the access vector interpretation for ipc-related objects
-#
-
-class ipc
-inherits ipc
-
-class sem
-inherits ipc
-
-class msgq
-inherits ipc
-{
-	enqueue
-}
-
-class msg
-{
-	send
-	receive
-}
-
-class shm
-inherits ipc
-{
-	lock
-}
-
-
-#
-# Define the access vector interpretation for the security server.
-#
-
-class security
-{
-	compute_av
-	compute_create
-	compute_member
-	check_context
-	load_policy
-	compute_relabel
-	compute_user
-	setenforce     # was avc_toggle in system class
-	setbool
-	setsecparam
-	setcheckreqprot
-	read_policy
-	validate_trans
-}
-
-
-#
-# Define the access vector interpretation for system operations.
-#
-
-class system
-{
-	ipc_info
-	syslog_read
-	syslog_mod
-	syslog_console
-	module_request
-	module_load
-}
-
-#
-# Define the access vector interpretation for controlling capabilities
-#
-
-class capability
-inherits cap
-
-class capability2
-inherits cap2
-
-#
-# Extended Netlink classes
-#
-class netlink_route_socket
-inherits socket
-{
-	nlmsg_read
-	nlmsg_write
-}
-
-class netlink_tcpdiag_socket
-inherits socket
-{
-	nlmsg_read
-	nlmsg_write
-}
-
-class netlink_nflog_socket
-inherits socket
-
-class netlink_xfrm_socket
-inherits socket
-{
-	nlmsg_read
-	nlmsg_write
-}
-
-class netlink_selinux_socket
-inherits socket
-
-class netlink_audit_socket
-inherits socket
-{
-	nlmsg_read
-	nlmsg_write
-	nlmsg_relay
-	nlmsg_readpriv
-	nlmsg_tty_audit
-}
-
-class netlink_dnrt_socket
-inherits socket
-
-# Define the access vector interpretation for controlling
-# access to IPSec network data by association
-#
-class association
-{
-	sendto
-	recvfrom
-	setcontext
-	polmatch
-}
-
-# Updated Netlink class for KOBJECT_UEVENT family.
-class netlink_kobject_uevent_socket
-inherits socket
-
-class appletalk_socket
-inherits socket
-
-class packet
-{
-	send
-	recv
-	relabelto
-	flow_in		# deprecated
-	flow_out	# deprecated
-	forward_in
-	forward_out
-}
-
-class key
-{
-	view
-	read
-	write
-	search
-	link
-	setattr
-	create
-}
-
-class dccp_socket
-inherits socket
-{
-	node_bind
-	name_connect
-}
-
-class memprotect
-{
-	mmap_zero
-}
-
-# network peer labels
-class peer
-{
-	recv
-}
-
-class kernel_service
-{
-	use_as_override
-	create_files_as
-}
-
-class tun_socket
-inherits socket
-{
-	attach_queue
-}
-
-class binder
-{
-	impersonate
-	call
-	set_context_mgr
-	transfer
-}
-
-class netlink_iscsi_socket
-inherits socket
-
-class netlink_fib_lookup_socket
-inherits socket
-
-class netlink_connector_socket
-inherits socket
-
-class netlink_netfilter_socket
-inherits socket
-
-class netlink_generic_socket
-inherits socket
-
-class netlink_scsitransport_socket
-inherits socket
-
-class netlink_rdma_socket
-inherits socket
-
-class netlink_crypto_socket
-inherits socket
-
-#
-# Define the access vector interpretation for controlling capabilities
-# in user namespaces
-#
-
-class cap_userns
-inherits cap
-
-class cap2_userns
-inherits cap2
-
-
-#
-# Define the access vector interpretation for the new socket classes
-# enabled by the extended_socket_class policy capability.
-#
-
-#
-# The next two classes were previously mapped to rawip_socket and therefore
-# have the same definition as rawip_socket (until further permissions
-# are defined).
-#
-class sctp_socket
-inherits socket
-{
-	node_bind
-}
-
-class icmp_socket
-inherits socket
-{
-	node_bind
-}
-
-#
-# The remaining network socket classes were previously
-# mapped to the socket class and therefore have the
-# same definition as socket.
-#
-
-class ax25_socket
-inherits socket
-
-class ipx_socket
-inherits socket
-
-class netrom_socket
-inherits socket
-
-class atmpvc_socket
-inherits socket
-
-class x25_socket
-inherits socket
-
-class rose_socket
-inherits socket
-
-class decnet_socket
-inherits socket
-
-class atmsvc_socket
-inherits socket
-
-class rds_socket
-inherits socket
-
-class irda_socket
-inherits socket
-
-class pppox_socket
-inherits socket
-
-class llc_socket
-inherits socket
-
-class can_socket
-inherits socket
-
-class tipc_socket
-inherits socket
-
-class bluetooth_socket
-inherits socket
-
-class iucv_socket
-inherits socket
-
-class rxrpc_socket
-inherits socket
-
-class isdn_socket
-inherits socket
-
-class phonet_socket
-inherits socket
-
-class ieee802154_socket
-inherits socket
-
-class caif_socket
-inherits socket
-
-class alg_socket
-inherits socket
-
-class nfc_socket
-inherits socket
-
-class vsock_socket
-inherits socket
-
-class kcm_socket
-inherits socket
-
-class qipcrtr_socket
-inherits socket
-
-class smc_socket
-inherits socket
-
-class property_service
-{
-	set
-}
-
-class service_manager
-{
-	add
-	find
-	list
-}
-
-class hwservice_manager
-{
-	add
-	find
-	list
-}
-
-class keystore_key
-{
-	get_state
-	get
-	insert
-	delete
-	exist
-	list
-	reset
-	password
-	lock
-	unlock
-	is_empty
-	sign
-	verify
-	grant
-	duplicate
-	clear_uid
-	add_auth
-	user_changed
-	gen_unique_id
-}
-
-class drmservice {
-	consumeRights
-	setPlaybackStatus
-	openDecryptSession
-	closeDecryptSession
-	initializeDecryptUnit
-	decrypt
-	finalizeDecryptUnit
-	pread
-}

prebuilts/api/28.0/private/adbd.te

@@ -1,148 +0,0 @@
-### ADB daemon
-
-typeattribute adbd coredomain;
-typeattribute adbd mlstrustedsubject;
-
-init_daemon_domain(adbd)
-
-domain_auto_trans(adbd, shell_exec, shell)
-
-userdebug_or_eng(`
-  allow adbd self:process setcurrent;
-  allow adbd su:process dyntransition;
-')
-
-# Do not sanitize the environment or open fds of the shell. Allow signaling
-# created processes.
-allow adbd shell:process { noatsecure signal };
-
-# Set UID and GID to shell.  Set supplementary groups.
-allow adbd self:global_capability_class_set { setuid setgid };
-
-# Drop capabilities from bounding set on user builds.
-allow adbd self:global_capability_class_set setpcap;
-
-# Create and use network sockets.
-net_domain(adbd)
-
-# Access /dev/usb-ffs/adb/ep0
-allow adbd functionfs:dir search;
-allow adbd functionfs:file rw_file_perms;
-
-# Use a pseudo tty.
-allow adbd devpts:chr_file rw_file_perms;
-
-# adb push/pull /data/local/tmp.
-allow adbd shell_data_file:dir create_dir_perms;
-allow adbd shell_data_file:file create_file_perms;
-
-# adb pull /data/local/traces/*
-allow adbd trace_data_file:dir r_dir_perms;
-allow adbd trace_data_file:file r_file_perms;
-
-# adb pull /data/misc/profman.
-allow adbd profman_dump_data_file:dir r_dir_perms;
-allow adbd profman_dump_data_file:file r_file_perms;
-
-# adb push/pull sdcard.
-allow adbd tmpfs:dir search;
-allow adbd rootfs:lnk_file r_file_perms;  # /sdcard symlink
-allow adbd tmpfs:lnk_file r_file_perms;   # /mnt/sdcard symlink
-allow adbd sdcard_type:dir create_dir_perms;
-allow adbd sdcard_type:file create_file_perms;
-
-# adb pull /data/anr/traces.txt
-allow adbd anr_data_file:dir r_dir_perms;
-allow adbd anr_data_file:file r_file_perms;
-
-# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
-set_prop(adbd, shell_prop)
-set_prop(adbd, powerctl_prop)
-set_prop(adbd, ffs_prop)
-set_prop(adbd, exported_ffs_prop)
-
-# Access device logging gating property
-get_prop(adbd, device_logging_prop)
-
-# Read device's serial number from system properties
-get_prop(adbd, serialno_prop)
-
-# Run /system/bin/bu
-allow adbd system_file:file rx_file_perms;
-
-# Perform binder IPC to surfaceflinger (screencap)
-# XXX Run screencap in a separate domain?
-binder_use(adbd)
-binder_call(adbd, surfaceflinger)
-# b/13188914
-allow adbd gpu_device:chr_file rw_file_perms;
-allow adbd ion_device:chr_file rw_file_perms;
-r_dir_file(adbd, system_file)
-
-# Needed for various screenshots
-hal_client_domain(adbd, hal_graphics_allocator)
-
-# Read /data/misc/adb/adb_keys.
-allow adbd adb_keys_file:dir search;
-allow adbd adb_keys_file:file r_file_perms;
-
-userdebug_or_eng(`
-  # Write debugging information to /data/adb
-  # when persist.adb.trace_mask is set
-  # https://code.google.com/p/android/issues/detail?id=72895
-  allow adbd adb_data_file:dir rw_dir_perms;
-  allow adbd adb_data_file:file create_file_perms;
-')
-
-# ndk-gdb invokes adb forward to forward the gdbserver socket.
-allow adbd app_data_file:dir search;
-allow adbd app_data_file:sock_file write;
-allow adbd appdomain:unix_stream_socket connectto;
-
-# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
-allow adbd zygote_exec:file r_file_perms;
-allow adbd system_file:file r_file_perms;
-
-# Allow pulling the SELinux policy for CTS purposes
-allow adbd selinuxfs:dir r_dir_perms;
-allow adbd selinuxfs:file r_file_perms;
-allow adbd kernel:security read_policy;
-allow adbd service_contexts_file:file r_file_perms;
-allow adbd file_contexts_file:file r_file_perms;
-allow adbd seapp_contexts_file:file r_file_perms;
-allow adbd property_contexts_file:file r_file_perms;
-allow adbd sepolicy_file:file r_file_perms;
-
-# Allow pulling config.gz for CTS purposes
-allow adbd config_gz:file r_file_perms;
-
-allow adbd surfaceflinger_service:service_manager find;
-allow adbd bootchart_data_file:dir search;
-allow adbd bootchart_data_file:file r_file_perms;
-
-# Allow access to external storage; we have several visible mount points under /storage
-# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
-allow adbd storage_file:dir r_dir_perms;
-allow adbd storage_file:lnk_file r_file_perms;
-allow adbd mnt_user_file:dir r_dir_perms;
-allow adbd mnt_user_file:lnk_file r_file_perms;
-
-# Access to /data/media.
-# This should be removed if sdcardfs is modified to alter the secontext for its
-# accesses to the underlying FS.
-allow adbd media_rw_data_file:dir create_dir_perms;
-allow adbd media_rw_data_file:file create_file_perms;
-
-r_dir_file(adbd, apk_data_file)
-
-allow adbd rootfs:dir r_dir_perms;
-
-###
-### Neverallow rules
-###
-
-# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
-# transitions to the shell domain (except when it crashes). In particular, we
-# never want to see a transition from adbd to su (aka "adb root")
-neverallow adbd { domain -crash_dump -shell }:process transition;
-neverallow adbd { domain userdebug_or_eng(`-su') }:process dyntransition;

prebuilts/api/28.0/private/app.te

@@ -1,7 +0,0 @@
-# TODO: deal with tmpfs_domain pub/priv split properly
-# Read system properties managed by zygote.
-allow appdomain zygote_tmpfs:file read;
-
-neverallow appdomain system_server:udp_socket {
-        accept append bind create ioctl listen lock name_bind
-        relabelfrom relabelto setattr shutdown };

prebuilts/api/28.0/private/app_neverallows.te

@@ -1,262 +0,0 @@
-###
-### neverallow rules for untrusted app domains
-###
-
-define(`all_untrusted_apps',`{
-  ephemeral_app
-  isolated_app
-  mediaprovider
-  untrusted_app
-  untrusted_app_25
-  untrusted_app_27
-  untrusted_app_all
-  untrusted_v2_app
-}')
-# Receive or send uevent messages.
-neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
-
-# Receive or send generic netlink messages
-neverallow all_untrusted_apps domain:netlink_socket *;
-
-# Too much leaky information in debugfs. It's a security
-# best practice to ensure these files aren't readable.
-neverallow all_untrusted_apps debugfs_type:file read;
-
-# Do not allow untrusted apps to register services.
-# Only trusted components of Android should be registering
-# services.
-neverallow all_untrusted_apps service_manager_type:service_manager add;
-
-# Do not allow untrusted apps to use VendorBinder
-neverallow all_untrusted_apps vndbinder_device:chr_file *;
-neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
-
-# Do not allow untrusted apps to connect to the property service
-# or set properties. b/10243159
-neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
-neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
-neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
-
-# net.dns properties are not a public API. Temporarily exempt pre-Oreo apps,
-# but otherwise disallow untrusted apps from reading this property.
-neverallow { all_untrusted_apps -untrusted_app_25 } net_dns_prop:file read;
-
-# Do not allow untrusted apps to be assigned mlstrustedsubject.
-# This would undermine the per-user isolation model being
-# enforced via levelFrom=user in seapp_contexts and the mls
-# constraints.  As there is no direct way to specify a neverallow
-# on attribute assignment, this relies on the fact that fork
-# permission only makes sense within a domain (hence should
-# never be granted to any other domain within mlstrustedsubject)
-# and an untrusted app is allowed fork permission to itself.
-neverallow all_untrusted_apps mlstrustedsubject:process fork;
-
-# Do not allow untrusted apps to hard link to any files.
-# In particular, if an untrusted app links to other app data
-# files, installd will not be able to guarantee the deletion
-# of the linked to file. Hard links also contribute to security
-# bugs, so we want to ensure untrusted apps never have this
-# capability.
-neverallow all_untrusted_apps file_type:file link;
-
-# Do not allow untrusted apps to access network MAC address file
-neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
-
-# Do not allow any write access to files in /sys
-neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
-
-# Apps may never access the default sysfs label.
-neverallow all_untrusted_apps sysfs:file no_rw_file_perms;
-
-# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
-# ioctl permission, or 3. disallow the socket class.
-neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
-neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
-neverallow all_untrusted_apps *:{
-  socket netlink_socket packet_socket key_socket appletalk_socket
-  netlink_tcpdiag_socket netlink_nflog_socket
-  netlink_xfrm_socket netlink_audit_socket
-  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
-  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
-  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
-  netlink_rdma_socket netlink_crypto_socket
-} *;
-
-# Do not allow untrusted apps access to /cache
-neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
-neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
-
-# Do not allow untrusted apps to create/unlink files outside of its sandbox,
-# internal storage or sdcard.
-# World accessible data locations allow application to fill the device
-# with unaccounted for data. This data will not get removed during
-# application un-installation.
-neverallow { all_untrusted_apps -mediaprovider } {
-  fs_type
-  -sdcard_type
-  file_type
-  -app_data_file            # The apps sandbox itself
-  -media_rw_data_file       # Internal storage. Known that apps can
-                            # leave artfacts here after uninstall.
-  -user_profile_data_file   # Access to profile files
-  userdebug_or_eng(`
-    -method_trace_data_file # only on ro.debuggable=1
-    -coredump_file          # userdebug/eng only
-  ')
-}:dir_file_class_set { create unlink };
-
-# No untrusted component should be touching /dev/fuse
-neverallow all_untrusted_apps fuse_device:chr_file *;
-
-# Do not allow untrusted apps to directly open tun_device
-neverallow all_untrusted_apps tun_device:chr_file open;
-
-# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
-neverallow all_untrusted_apps anr_data_file:file ~{ open append };
-neverallow all_untrusted_apps anr_data_file:dir ~search;
-
-# Avoid reads from generically labeled /proc files
-# Create a more specific label if needed
-neverallow all_untrusted_apps {
-  proc
-  proc_asound
-  proc_filesystems
-  proc_kmsg
-  proc_loadavg
-  proc_mounts
-  proc_pagetypeinfo
-  proc_stat
-  proc_swaps
-  proc_uptime
-  proc_version
-  proc_vmallocinfo
-  proc_vmstat
-}:file { no_rw_file_perms no_x_file_perms };
-
-# Avoid all access to kernel configuration
-neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
-
-# Do not allow untrusted apps access to preloads data files
-neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
-
-# Locking of files on /system could lead to denial of service attacks
-# against privileged system components
-neverallow all_untrusted_apps system_file:file lock;
-
-# Do not permit untrusted apps to perform actions on HwBinder service_manager
-# other than find actions for services listed below
-neverallow all_untrusted_apps *:hwservice_manager ~find;
-
-# Do not permit access from apps which host arbitrary code to HwBinder services,
-# except those considered sufficiently safe for access from such apps.
-# The two main reasons for this are:
-# 1. HwBinder servers do not perform client authentication because HIDL
-#    currently does not expose caller UID information and, even if it did, many
-#    HwBinder services either operate at a level below that of apps (e.g., HALs)
-#    or must not rely on app identity for authorization. Thus, to be safe, the
-#    default assumption is that every HwBinder service treats all its clients as
-#    equally authorized to perform operations offered by the service.
-# 2. HAL servers (a subset of HwBinder services) contain code with higher
-#    incidence rate of security issues than system/core components and have
-#    access to lower layes of the stack (all the way down to hardware) thus
-#    increasing opportunities for bypassing the Android security model.
-#
-# Safe services include:
-# - same process services: because they by definition run in the process
-#   of the client and thus have the same access as the client domain in which
-#   the process runs
-# - coredomain_hwservice: are considered safe because they do not pose risks
-#   associated with reason #2 above.
-# - hal_configstore_ISurfaceFlingerConfigs:  becuase it has specifically been
-#   designed for use by any domain.
-# - hal_graphics_allocator_hwservice: because these operations are also offered
-#   by surfaceflinger Binder service, which apps are permitted to access
-# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
-#   Binder service which apps were permitted to access.
-# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
-neverallow all_untrusted_apps {
-  hwservice_manager_type
-  -same_process_hwservice
-  -coredomain_hwservice
-  -hal_codec2_hwservice
-  -hal_configstore_ISurfaceFlingerConfigs
-  -hal_graphics_allocator_hwservice
-  -hal_omx_hwservice
-  -hal_cas_hwservice
-  -hal_neuralnetworks_hwservice
-  -untrusted_app_visible_hwservice
-}:hwservice_manager find;
-
-# Make sure that the following services are never accessible by untrusted_apps
-neverallow all_untrusted_apps {
-  default_android_hwservice
-  hal_audio_hwservice
-  hal_authsecret_hwservice
-  hal_bluetooth_hwservice
-  hal_bootctl_hwservice
-  hal_camera_hwservice
-  hal_confirmationui_hwservice
-  hal_contexthub_hwservice
-  hal_drm_hwservice
-  hal_dumpstate_hwservice
-  hal_fingerprint_hwservice
-  hal_gatekeeper_hwservice
-  hal_gnss_hwservice
-  hal_graphics_composer_hwservice
-  hal_health_hwservice
-  hal_ir_hwservice
-  hal_keymaster_hwservice
-  hal_light_hwservice
-  hal_memtrack_hwservice
-  hal_nfc_hwservice
-  hal_oemlock_hwservice
-  hal_power_hwservice
-  hal_secure_element_hwservice
-  hal_sensors_hwservice
-  hal_telephony_hwservice
-  hal_thermal_hwservice
-  hal_tv_cec_hwservice
-  hal_tv_input_hwservice
-  hal_usb_hwservice
-  hal_vibrator_hwservice
-  hal_vr_hwservice
-  hal_weaver_hwservice
-  hal_wifi_hwservice
-  hal_wifi_offload_hwservice
-  hal_wifi_supplicant_hwservice
-  hidl_base_hwservice
-  system_net_netd_hwservice
-  thermalcallback_hwservice
-}:hwservice_manager find;
-# HwBinder services offered by core components (as opposed to vendor components)
-# are considered somewhat safer due to point #2 above.
-neverallow all_untrusted_apps {
-  coredomain_hwservice
-  -same_process_hwservice
-  -hidl_allocator_hwservice # Designed for use by any domain
-  -hidl_manager_hwservice # Designed for use by any domain
-  -hidl_memory_hwservice # Designed for use by any domain
-  -hidl_token_hwservice # Designed for use by any domain
-}:hwservice_manager find;
-
-# SELinux is not an API for untrusted apps to use
-neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
-
-# Restrict *Binder access from apps to HAL domains. We can only do this on full
-# Treble devices where *Binder communications between apps and HALs are tightly
-# restricted.
-full_treble_only(`
-  neverallow all_untrusted_apps {
-    halserverdomain
-    -coredomain
-    -hal_configstore_server
-    -hal_graphics_allocator_server
-    -hal_cas_server
-    -hal_neuralnetworks_server
-    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-    -untrusted_app_visible_halserver
-  }:binder { call transfer };
-')
-
-# Untrusted apps are not allowed to find mediaextractor update service.
-neverallow all_untrusted_apps mediaextractor_update_service:service_manager find;

prebuilts/api/28.0/private/asan_extract.te

@@ -1,8 +0,0 @@
-# type_transition must be private policy the domain_trans rules could stay
-# public, but conceptually should go with this
-# Technically not a daemon but we do want the transition from init domain to
-# asan_extract to occur.
-with_asan(`
-typeattribute asan_extract coredomain;
-init_daemon_domain(asan_extract)
-')

prebuilts/api/28.0/private/atrace.te

@@ -1,46 +0,0 @@
-# Domain for atrace process.
-# It is spawned either by traced_probes or by init for the boottrace service.
-
-type atrace, domain, coredomain;
-type atrace_exec, exec_type, file_type;
-
-# boottrace services uses /data/misc/boottrace/categories
-allow atrace boottrace_data_file:dir search;
-allow atrace boottrace_data_file:file r_file_perms;
-
-# Allow atrace to access tracefs.
-allow atrace debugfs_tracing:dir r_dir_perms;
-allow atrace debugfs_tracing:file rw_file_perms;
-allow atrace debugfs_trace_marker:file getattr;
-
-# atrace sets debug.atrace.* properties
-set_prop(atrace, debug_prop)
-
-# atrace pokes all the binder-enabled processes at startup with a
-# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
-
-binder_use(atrace)
-allow atrace healthd:binder call;
-allow atrace surfaceflinger:binder call;
-get_prop(atrace, hwservicemanager_prop)
-
-allow atrace {
-  service_manager_type
-  -incident_service
-  -netd_service
-  -stats_service
-  -dumpstate_service
-  -installd_service
-  -vold_service
-}:service_manager { find };
-allow atrace servicemanager:service_manager list;
-
-userdebug_or_eng(`
-  # atrace is generally invoked as a standalone binary from shell or perf
-  # daemons like Perfetto traced_probes. However, in userdebug builds, there is
-  # a further option to run atrace as an init daemon for boot tracing.
-  init_daemon_domain(atrace)
-
-  allow atrace debugfs_tracing_debug:dir r_dir_perms;
-  allow atrace debugfs_tracing_debug:file rw_file_perms;
-')

prebuilts/api/28.0/private/audioserver.te

@@ -1,88 +0,0 @@
-# audioserver - audio services daemon
-
-typeattribute audioserver coredomain;
-
-type audioserver_exec, exec_type, file_type;
-init_daemon_domain(audioserver)
-
-r_dir_file(audioserver, sdcard_type)
-
-binder_use(audioserver)
-binder_call(audioserver, binderservicedomain)
-binder_call(audioserver, appdomain)
-binder_service(audioserver)
-
-hal_client_domain(audioserver, hal_allocator)
-# /system/lib64/hw for always-passthrough Allocator HAL ashmem / mapper .so
-r_dir_file(audioserver, system_file)
-
-hal_client_domain(audioserver, hal_audio)
-
-userdebug_or_eng(`
-  # used for TEE sink - pcm capture for debug.
-  allow audioserver media_data_file:dir create_dir_perms;
-  allow audioserver audioserver_data_file:dir create_dir_perms;
-  allow audioserver audioserver_data_file:file create_file_perms;
-
-  # ptrace to processes in the same domain for memory leak detection
-  allow audioserver self:process ptrace;
-')
-
-add_service(audioserver, audioserver_service)
-allow audioserver activity_service:service_manager find;
-allow audioserver appops_service:service_manager find;
-allow audioserver batterystats_service:service_manager find;
-allow audioserver permission_service:service_manager find;
-allow audioserver power_service:service_manager find;
-allow audioserver scheduling_policy_service:service_manager find;
-allow audioserver mediametrics_service:service_manager find;
-
-# Allow read/write access to bluetooth-specific properties
-set_prop(audioserver, bluetooth_a2dp_offload_prop)
-set_prop(audioserver, bluetooth_prop)
-set_prop(audioserver, exported_bluetooth_prop)
-
-# Grant access to audio files to audioserver
-allow audioserver audio_data_file:dir ra_dir_perms;
-allow audioserver audio_data_file:file create_file_perms;
-
-# allow access to ALSA MMAP FDs for AAudio API
-allow audioserver audio_device:chr_file { read write };
-
-not_full_treble(`allow audioserver audio_device:dir r_dir_perms;')
-not_full_treble(`allow audioserver audio_device:chr_file rw_file_perms;')
-
-# For A2DP bridge which is loaded directly into audioserver
-unix_socket_connect(audioserver, bluetooth, bluetooth)
-
-# Allow shell commands from ADB and shell for CTS testing/dumping
-allow audioserver adbd:fd use;
-allow audioserver adbd:unix_stream_socket { read write };
-allow audioserver shell:fifo_file { read write };
-
-# Allow shell commands from ADB for CTS testing/dumping
-userdebug_or_eng(`
-  allow audioserver su:fd use;
-  allow audioserver su:fifo_file { read write };
-  allow audioserver su:unix_stream_socket { read write };
-')
-
-###
-### neverallow rules
-###
-
-# audioserver should never execute any executable without a
-# domain transition
-neverallow audioserver { file_type fs_type }:file execute_no_trans;
-
-# The goal of the mediaserver split is to place media processing code into
-# restrictive sandboxes with limited responsibilities and thus limited
-# permissions. Example: Audioserver is only responsible for controlling audio
-# hardware and processing audio content. Cameraserver does the same for camera
-# hardware/content. Etc.
-#
-# Media processing code is inherently risky and thus should have limited
-# permissions and be isolated from the rest of the system and network.
-# Lengthier explanation here:
-# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
-neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;

prebuilts/api/28.0/private/binder_in_vendor_violators.te

@@ -1 +0,0 @@
-allow binder_in_vendor_violators binder_device:chr_file rw_file_perms;

prebuilts/api/28.0/private/binderservicedomain.te

@@ -1,22 +0,0 @@
-# Rules common to all binder service domains
-
-# Allow dumpstate and incidentd to collect information from binder services
-allow binderservicedomain { dumpstate incidentd }:fd use;
-allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr };
-allow binderservicedomain { dumpstate incidentd }:fifo_file  { getattr write };
-allow binderservicedomain shell_data_file:file { getattr write };
-
-# Allow dumpsys to work from adb shell or the serial console
-allow binderservicedomain devpts:chr_file rw_file_perms;
-allow binderservicedomain console_device:chr_file rw_file_perms;
-
-# Receive and write to a pipe received over Binder from an app.
-allow binderservicedomain appdomain:fd use;
-allow binderservicedomain appdomain:fifo_file write;
-
-# allow all services to run permission checks
-allow binderservicedomain permission_service:service_manager find;
-
-allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify };
-
-use_keystore(binderservicedomain)

prebuilts/api/28.0/private/blank_screen.te

@@ -1,6 +0,0 @@
-type blank_screen, domain, coredomain;
-type blank_screen_exec, exec_type, file_type;
-
-init_daemon_domain(blank_screen)
-
-hal_client_domain(blank_screen, hal_light)

prebuilts/api/28.0/private/blkid.te

@@ -1,22 +0,0 @@
-# blkid called from vold
-
-typeattribute blkid coredomain;
-
-type blkid_exec, exec_type, file_type;
-
-# Allowed read-only access to encrypted devices to extract UUID/label
-allow blkid block_device:dir search;
-allow blkid userdata_block_device:blk_file r_file_perms;
-allow blkid dm_device:blk_file r_file_perms;
-
-# Allow stdin/out back to vold
-allow blkid vold:fd use;
-allow blkid vold:fifo_file { read write getattr };
-
-# For blkid launched through popen()
-allow blkid blkid_exec:file rx_file_perms;
-
-# Only allow entry from vold
-neverallow { domain -vold } blkid:process transition;
-neverallow * blkid:process dyntransition;
-neverallow blkid { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;

prebuilts/api/28.0/private/blkid_untrusted.te

@@ -1,37 +0,0 @@
-# blkid for untrusted block devices
-
-typeattribute blkid_untrusted coredomain;
-
-# Allowed read-only access to vold block devices to extract UUID/label
-allow blkid_untrusted block_device:dir search;
-allow blkid_untrusted vold_device:blk_file r_file_perms;
-
-# Allow stdin/out back to vold
-allow blkid_untrusted vold:fd use;
-allow blkid_untrusted vold:fifo_file { read write getattr };
-
-# For blkid launched through popen()
-allow blkid_untrusted blkid_exec:file rx_file_perms;
-
-###
-### neverallow rules
-###
-
-# Untrusted blkid should never be run on block devices holding sensitive data
-neverallow blkid_untrusted {
-  boot_block_device
-  frp_block_device
-  metadata_block_device
-  recovery_block_device
-  root_block_device
-  swap_block_device
-  system_block_device
-  userdata_block_device
-  cache_block_device
-  dm_device
-}:blk_file no_rw_file_perms;
-
-# Only allow entry from vold via blkid binary
-neverallow { domain -vold } blkid_untrusted:process transition;
-neverallow * blkid_untrusted:process dyntransition;
-neverallow blkid_untrusted { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;

prebuilts/api/28.0/private/bluetooth.te

@@ -1,80 +0,0 @@
-# bluetooth app
-
-typeattribute bluetooth coredomain;
-
-app_domain(bluetooth)
-net_domain(bluetooth)
-
-# Socket creation under /data/misc/bluedroid.
-type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
-
-# Allow access to net_admin ioctls
-allowxperm bluetooth self:udp_socket ioctl priv_sock_ioctls;
-
-wakelock_use(bluetooth);
-
-# Data file accesses.
-allow bluetooth bluetooth_data_file:dir create_dir_perms;
-allow bluetooth bluetooth_data_file:notdevfile_class_set create_file_perms;
-allow bluetooth bluetooth_logs_data_file:dir rw_dir_perms;
-allow bluetooth bluetooth_logs_data_file:file create_file_perms;
-
-# Socket creation under /data/misc/bluedroid.
-allow bluetooth bluetooth_socket:sock_file create_file_perms;
-
-allow bluetooth self:global_capability_class_set net_admin;
-allow bluetooth self:global_capability2_class_set wake_alarm;
-
-# tethering
-allow bluetooth self:packet_socket create_socket_perms_no_ioctl;
-allow bluetooth self:global_capability_class_set { net_admin net_raw net_bind_service };
-allow bluetooth self:tun_socket create_socket_perms_no_ioctl;
-allow bluetooth tun_device:chr_file rw_file_perms;
-allow bluetooth efs_file:dir search;
-
-# allow Bluetooth to access uhid device for HID profile
-allow bluetooth uhid_device:chr_file rw_file_perms;
-
-# proc access.
-allow bluetooth proc_bluetooth_writable:file rw_file_perms;
-
-# Allow write access to bluetooth specific properties
-set_prop(bluetooth, bluetooth_a2dp_offload_prop)
-set_prop(bluetooth, bluetooth_prop)
-set_prop(bluetooth, exported_bluetooth_prop)
-set_prop(bluetooth, pan_result_prop)
-
-allow bluetooth audioserver_service:service_manager find;
-allow bluetooth bluetooth_service:service_manager find;
-allow bluetooth drmserver_service:service_manager find;
-allow bluetooth mediaserver_service:service_manager find;
-allow bluetooth radio_service:service_manager find;
-allow bluetooth app_api_service:service_manager find;
-allow bluetooth system_api_service:service_manager find;
-
-# already open bugreport file descriptors may be shared with
-# the bluetooth process, from a file in
-# /data/data/com.android.shell/files/bugreports/bugreport-*.
-allow bluetooth shell_data_file:file read;
-
-# Bluetooth audio needs RT scheduling to meet deadlines, allow sys_nice
-allow bluetooth self:global_capability_class_set sys_nice;
-
-hal_client_domain(bluetooth, hal_bluetooth)
-hal_client_domain(bluetooth, hal_telephony)
-
-# Bluetooth A2DP offload requires binding with audio HAL
-hal_client_domain(bluetooth, hal_audio)
-
-read_runtime_log_tags(bluetooth)
-
-###
-### Neverallow rules
-###
-### These are things that the bluetooth app should NEVER be able to do
-###
-
-# Superuser capabilities.
-# Bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend and sys_nice.
-neverallow bluetooth self:global_capability_class_set ~{ net_admin net_raw net_bind_service sys_nice};
-neverallow bluetooth self:global_capability2_class_set ~{ wake_alarm block_suspend };

prebuilts/api/28.0/private/bluetoothdomain.te

@@ -1,2 +0,0 @@
-# Allow clients to use a socket provided by the bluetooth app.
-allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read write ioctl shutdown };

prebuilts/api/28.0/private/bootanim.te

@@ -1,6 +0,0 @@
-typeattribute bootanim coredomain;
-
-init_daemon_domain(bootanim)
-
-# b/68864350
-dontaudit bootanim unlabeled:dir search;

prebuilts/api/28.0/private/bootstat.te

@@ -1,3 +0,0 @@
-typeattribute bootstat coredomain;
-
-init_daemon_domain(bootstat)

prebuilts/api/28.0/private/bpfloader.te

@@ -1,30 +0,0 @@
-# bpf program loader
-type bpfloader, domain;
-type bpfloader_exec, exec_type, file_type;
-typeattribute bpfloader coredomain;
-
-# Process need CAP_NET_ADMIN to run bpf programs as cgroup filter
-allow bpfloader self:global_capability_class_set net_admin;
-
-r_dir_file(bpfloader, cgroup_bpf)
-
-# These permission is required for pin bpf program for netd.
-allow bpfloader fs_bpf:dir  create_dir_perms;
-allow bpfloader fs_bpf:file create_file_perms;
-allow bpfloader devpts:chr_file { read write };
-
-allow bpfloader netd:fd use;
-
-# Use pinned bpf map files from netd.
-allow bpfloader netd:bpf { map_read map_write };
-allow bpfloader self:bpf { prog_load prog_run };
-
-# Neverallow rules
-neverallow { domain -bpfloader } *:bpf prog_load;
-neverallow { domain -bpfloader -netd -netutils_wrapper} *:bpf prog_run;
-neverallow { domain -netd -bpfloader } bpfloader_exec:file { execute execute_no_trans };
-neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
-# only system_server, netd and bpfloader can read/write the bpf maps
-neverallow { domain -system_server -netd -bpfloader} netd:bpf { map_read map_write };
-
-dontaudit bpfloader self:capability sys_admin;

prebuilts/api/28.0/private/bufferhubd.te

@@ -1,3 +0,0 @@
-typeattribute bufferhubd coredomain;
-
-init_daemon_domain(bufferhubd)

prebuilts/api/28.0/private/bug_map

@@ -1,45 +0,0 @@
-cppreopts cppreopts capability 79414024
-dexoptanalyzer apk_data_file file 77853712
-dexoptanalyzer app_data_file file 77853712
-dexoptanalyzer app_data_file lnk_file 77853712
-dexoptanalyzer system_data_file lnk_file 77853712
-dnsmasq netd fifo_file 77868789
-dnsmasq netd unix_stream_socket 77868789
-init app_data_file file 77873135
-init cache_file blk_file 77873135
-init logpersist file 77873135
-init nativetest_data_file dir 77873135
-init pstorefs dir 77873135
-init shell_data_file dir 77873135
-init shell_data_file file 77873135
-init shell_data_file lnk_file 77873135
-init shell_data_file sock_file 77873135
-init system_data_file chr_file 77873135
-mediaextractor app_data_file file 77923736
-mediaextractor radio_data_file file 77923736
-mediaprovider cache_file blk_file 77925342
-mediaprovider mnt_media_rw_file dir 77925342
-mediaprovider shell_data_file dir 77925342
-netd priv_app unix_stream_socket 77870037
-netd untrusted_app unix_stream_socket 77870037
-netd untrusted_app_25 unix_stream_socket 77870037
-netd untrusted_app_27 unix_stream_socket 77870037
-otapreopt_chroot postinstall_file lnk_file 75287236
-platform_app nfc_data_file dir 74331887
-postinstall postinstall capability 77958490
-postinstall_dexopt postinstall_dexopt capability 77958490
-postinstall_dexopt user_profile_data_file file 77958490
-priv_app system_data_file dir 72811052
-profman apk_data_file dir 77922323
-radio statsdw_socket sock_file 78456764
-statsd hal_health_default binder 77919007
-storaged storaged capability 77634061
-surfaceflinger mediacodec binder 77924251
-system_server crash_dump process 73128755
-system_server logd_socket sock_file 64734187
-system_server sdcardfs file 77856826
-system_server zygote process 77856826
-untrusted_app_25 system_data_file dir 72550646
-untrusted_app_27 system_data_file dir 72550646
-usbd usbd capability 72472544
-zygote untrusted_app_25 process 77925912

prebuilts/api/28.0/private/cameraserver.te

@@ -1,3 +0,0 @@
-typeattribute cameraserver coredomain;
-
-init_daemon_domain(cameraserver)

prebuilts/api/28.0/private/charger.te

@@ -1 +0,0 @@
-typeattribute charger coredomain;

prebuilts/api/28.0/private/clatd.te

@@ -1 +0,0 @@
-typeattribute clatd coredomain;

prebuilts/api/28.0/private/coredomain.te

@@ -1,15 +0,0 @@
-get_prop(coredomain, pm_prop)
-get_prop(coredomain, exported_pm_prop)
-
-full_treble_only(`
-neverallow {
-    coredomain
-
-    # for chowning
-    -init
-
-    # generic access to sysfs_type
-    -ueventd
-    -vold
-} sysfs_leds:file *;
-')

prebuilts/api/28.0/private/cppreopts.te

@@ -1,6 +0,0 @@
-typeattribute cppreopts coredomain;
-
-# Technically not a daemon but we do want the transition from init domain to
-# cppreopts to occur.
-init_daemon_domain(cppreopts)
-domain_auto_trans(cppreopts, preopt2cachename_exec, preopt2cachename);

prebuilts/api/28.0/private/crash_dump.te

@@ -1,14 +0,0 @@
-typeattribute crash_dump coredomain;
-
-allow crash_dump {
-  domain
-  -bpfloader
-  -crash_dump
-  -init
-  -kernel
-  -keystore
-  -logd
-  -ueventd
-  -vendor_init
-  -vold
-}:process { ptrace signal sigchld sigstop sigkill };

prebuilts/api/28.0/private/dex2oat.te

@@ -1 +0,0 @@
-typeattribute dex2oat coredomain;

prebuilts/api/28.0/private/dexoptanalyzer.te

@@ -1,30 +0,0 @@
-# dexoptanalyzer
-type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
-type dexoptanalyzer_exec, exec_type, file_type;
-
-# Reading an APK opens a ZipArchive, which unpack to tmpfs.
-# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
-# own label, which differs from other labels created by other processes.
-# This allows to distinguish in policy files created by dexoptanalyzer vs other
-#processes.
-tmpfs_domain(dexoptanalyzer)
-
-# Read symlinks in /data/dalvik-cache. This is required for PIC mode boot
-# app_data_file the oat file is symlinked to the original file in /system.
-allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
-allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
-allow dexoptanalyzer dalvikcache_data_file:lnk_file read;
-
-allow dexoptanalyzer installd:fd use;
-
-# Allow reading secondary dex files that were reported by the app to the
-# package manager.
-allow dexoptanalyzer app_data_file:dir { getattr search };
-allow dexoptanalyzer app_data_file:file { getattr read };
-# dexoptanalyzer calls access(2) with W_OK flag on app data. We can use the
-# "dontaudit...audit_access" policy line to suppress the audit access without
-# suppressing denial on actual access.
-dontaudit dexoptanalyzer app_data_file:dir audit_access;
-
-# Allow testing /data/user/0 which symlinks to /data/data
-allow dexoptanalyzer system_data_file:lnk_file { getattr };

prebuilts/api/28.0/private/dhcp.te

@@ -1,4 +0,0 @@
-typeattribute dhcp coredomain;
-
-init_daemon_domain(dhcp)
-type_transition dhcp system_data_file:{ dir file } dhcp_data_file;

prebuilts/api/28.0/private/dnsmasq.te

@@ -1 +0,0 @@
-typeattribute dnsmasq coredomain;

prebuilts/api/28.0/private/domain.te

@@ -1,118 +0,0 @@
-# Transition to crash_dump when /system/bin/crash_dump* is executed.
-# This occurs when the process crashes.
-domain_auto_trans(domain, crash_dump_exec, crash_dump);
-allow domain crash_dump:process sigchld;
-
-# Limit ability to ptrace or read sensitive /proc/pid files of processes
-# with other UIDs to these allowlisted domains.
-neverallow {
-  domain
-  -vold
-  -dumpstate
-  userdebug_or_eng(`-incidentd')
-  -storaged
-  -system_server
-  userdebug_or_eng(`-perfprofd')
-} self:global_capability_class_set sys_ptrace;
-
-# Limit ability to generate hardware unique device ID attestations to priv_apps
-neverallow { domain -priv_app } *:keystore_key gen_unique_id;
-
-neverallow {
-  domain
-  -init
-  -vendor_init
-  userdebug_or_eng(`-domain')
-} debugfs_tracing_debug:file no_rw_file_perms;
-
-# Core domains are not permitted to use kernel interfaces which are not
-# explicitly labeled.
-# TODO(b/65643247): Apply these neverallow rules to all coredomain.
-full_treble_only(`
-  # /proc
-  neverallow {
-    coredomain
-    -vold
-  } proc:file no_rw_file_perms;
-
-  # /sys
-  neverallow {
-    coredomain
-    -init
-    -ueventd
-    -vold
-  } sysfs:file no_rw_file_perms;
-
-  # /dev
-  neverallow {
-    coredomain
-    -fsck
-    -init
-    -ueventd
-  } device:{ blk_file file } no_rw_file_perms;
-
-  # debugfs
-  neverallow {
-    coredomain
-    -dumpstate
-    -init
-    -system_server
-  } debugfs:file no_rw_file_perms;
-
-  # tracefs
-  neverallow {
-    coredomain
-    -atrace
-    -dumpstate
-    -init
-    userdebug_or_eng(`-perfprofd')
-    -traced_probes
-    -shell
-    -traceur_app
-  } debugfs_tracing:file no_rw_file_perms;
-
-  # inotifyfs
-  neverallow {
-    coredomain
-    -init
-  } inotify:file no_rw_file_perms;
-
-  # pstorefs
-  neverallow {
-    coredomain
-    -bootstat
-    -charger
-    -dumpstate
-    -healthd
-    userdebug_or_eng(`-incidentd')
-    -init
-    -logd
-    -logpersist
-    -recovery_persist
-    -recovery_refresh
-    -shell
-    -system_server
-  } pstorefs:file no_rw_file_perms;
-
-  # configfs
-  neverallow {
-    coredomain
-    -init
-    -system_server
-  } configfs:file no_rw_file_perms;
-
-  # functionfs
-  neverallow {
-    coredomain
-    -adbd
-    -init
-    -mediaprovider
-    -system_server
-  } functionfs:file no_rw_file_perms;
-
-  # usbfs and binfmt_miscfs
-  neverallow {
-    coredomain
-    -init
-  }{ usbfs binfmt_miscfs }:file no_rw_file_perms;
-')

prebuilts/api/28.0/private/drmserver.te

@@ -1,7 +0,0 @@
-typeattribute drmserver coredomain;
-
-init_daemon_domain(drmserver)
-
-type_transition drmserver apk_data_file:sock_file drmserver_socket;
-
-typeattribute drmserver_socket coredomain_socket;

prebuilts/api/28.0/private/dumpstate.te

@@ -1,47 +0,0 @@
-typeattribute dumpstate coredomain;
-
-init_daemon_domain(dumpstate)
-
-# Execute and transition to the vdc domain
-domain_auto_trans(dumpstate, vdc_exec, vdc)
-
-# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables
-allow dumpstate system_file:file lock;
-
-# TODO: deal with tmpfs_domain pub/priv split properly
-allow dumpstate dumpstate_tmpfs:file execute;
-
-# systrace support - allow atrace to run
-allow dumpstate debugfs_tracing:dir r_dir_perms;
-allow dumpstate debugfs_tracing:file rw_file_perms;
-allow dumpstate debugfs_tracing_debug:dir r_dir_perms;
-allow dumpstate debugfs_trace_marker:file getattr;
-allow dumpstate atrace_exec:file rx_file_perms;
-allow dumpstate storaged_exec:file rx_file_perms;
-
-# /data/misc/wmtrace for wm traces
-userdebug_or_eng(`
-  allow dumpstate wm_trace_data_file:dir r_dir_perms;
-  allow dumpstate wm_trace_data_file:file r_file_perms;
-')
-
-# Allow dumpstate to make binder calls to storaged service
-binder_call(dumpstate, storaged)
-
-# Allow dumpstate to make binder calls to statsd
-binder_call(dumpstate, statsd)
-
-# Collect metrics on boot time created by init
-get_prop(dumpstate, boottime_prop)
-
-# Signal native processes to dump their stack.
-allow dumpstate {
-  statsd
-}:process signal;
-
-# For collecting bugreports.
-allow dumpstate debugfs_wakeup_sources:file r_file_perms;
-allow dumpstate dev_type:blk_file getattr;
-allow dumpstate webview_zygote:process signal;
-dontaudit dumpstate perfprofd:binder call;
-dontaudit dumpstate update_engine:binder call;

prebuilts/api/28.0/private/ephemeral_app.te

@@ -1,81 +0,0 @@
-###
-### Ephemeral apps.
-###
-### This file defines the security policy for apps with the ephemeral
-### feature.
-###
-### The ephemeral_app domain is a reduced permissions sandbox allowing
-### ephemeral applications to be safely installed and run. Non ephemeral
-### applications may also opt-in to ephemeral to take advantage of the
-### additional security features.
-###
-### PackageManager flags an app as ephemeral at install time.
-
-typeattribute ephemeral_app coredomain;
-
-net_domain(ephemeral_app)
-app_domain(ephemeral_app)
-
-# Allow ephemeral apps to read/write files in visible storage if provided fds
-allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
-
-# Some apps ship with shared libraries and binaries that they write out
-# to their sandbox directory and then execute.
-allow ephemeral_app app_data_file:file {r_file_perms execute};
-
-# services
-allow ephemeral_app audioserver_service:service_manager find;
-allow ephemeral_app cameraserver_service:service_manager find;
-allow ephemeral_app mediaserver_service:service_manager find;
-allow ephemeral_app mediaextractor_service:service_manager find;
-allow ephemeral_app mediacodec_service:service_manager find;
-allow ephemeral_app mediametrics_service:service_manager find;
-allow ephemeral_app mediadrmserver_service:service_manager find;
-allow ephemeral_app drmserver_service:service_manager find;
-allow ephemeral_app radio_service:service_manager find;
-allow ephemeral_app ephemeral_app_api_service:service_manager find;
-
-# Write app-specific trace data to the Perfetto traced damon. This requires
-# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow ephemeral_app traced:fd use;
-allow ephemeral_app traced_tmpfs:file { read write getattr map };
-unix_socket_connect(ephemeral_app, traced_producer, traced)
-
-# allow ephemeral apps to use UDP sockets provided by the system server but not
-# modify them other than to connect
-allow ephemeral_app system_server:udp_socket {
-        connect getattr read recvfrom sendto write getopt setopt };
-
-###
-### neverallow rules
-###
-
-neverallow ephemeral_app app_data_file:file execute_no_trans;
-
-# Receive or send uevent messages.
-neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
-
-# Receive or send generic netlink messages
-neverallow ephemeral_app domain:netlink_socket *;
-
-# Too much leaky information in debugfs. It's a security
-# best practice to ensure these files aren't readable.
-neverallow ephemeral_app debugfs:file read;
-
-# execute gpu_device
-neverallow ephemeral_app gpu_device:chr_file execute;
-
-# access files in /sys with the default sysfs label
-neverallow ephemeral_app sysfs:file *;
-
-# Avoid reads from generically labeled /proc files
-# Create a more specific label if needed
-neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
-
-# Directly access external storage
-neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create};
-neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search;
-
-# Avoid reads to proc_net, it contains too much device wide information about
-# ongoing connections.
-neverallow ephemeral_app proc_net:file no_rw_file_perms;

prebuilts/api/28.0/private/file.te

@@ -1,16 +0,0 @@
-# /proc/config.gz
-type config_gz, fs_type, proc_type;
-
-# /data/misc/stats-data, /data/misc/stats-service
-type stats_data_file, file_type, data_file_type, core_data_file_type;
-
-type statsdw_socket, file_type, coredomain_socket, mlstrustedobject;
-
-# /data/misc/storaged
-type storaged_data_file, file_type, data_file_type, core_data_file_type;
-
-# /data/misc/wmtrace for wm traces
-type wm_trace_data_file, file_type, data_file_type, core_data_file_type;
-
-# /data/misc/perfetto-traces for perfetto traces
-type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;

prebuilts/api/28.0/private/file_contexts

@@ -1,541 +0,0 @@
-###########################################
-# Root
-/                   u:object_r:rootfs:s0
-
-# Data files
-/adb_keys           u:object_r:adb_keys_file:s0
-/build\.prop        u:object_r:rootfs:s0
-/default\.prop      u:object_r:rootfs:s0
-/fstab\..*          u:object_r:rootfs:s0
-/init\..*           u:object_r:rootfs:s0
-/res(/.*)?          u:object_r:rootfs:s0
-/selinux_version    u:object_r:rootfs:s0
-/ueventd\..*        u:object_r:rootfs:s0
-/verity_key         u:object_r:rootfs:s0
-
-# Executables
-/charger            u:object_r:rootfs:s0
-/init               u:object_r:init_exec:s0
-/sbin(/.*)?         u:object_r:rootfs:s0
-
-# For kernel modules
-/lib(/.*)?          u:object_r:rootfs:s0
-
-# Empty directories
-/lost\+found        u:object_r:rootfs:s0
-/acct               u:object_r:cgroup:s0
-/config             u:object_r:rootfs:s0
-/mnt                u:object_r:tmpfs:s0
-/postinstall        u:object_r:postinstall_mnt_dir:s0
-/proc               u:object_r:rootfs:s0
-/sys                u:object_r:sysfs:s0
-
-# Symlinks
-/bin                u:object_r:rootfs:s0
-/bugreports         u:object_r:rootfs:s0
-/d                  u:object_r:rootfs:s0
-/etc                u:object_r:rootfs:s0
-/sdcard             u:object_r:rootfs:s0
-
-# SELinux policy files
-/vendor_file_contexts   u:object_r:file_contexts_file:s0
-/nonplat_file_contexts  u:object_r:file_contexts_file:s0
-/plat_file_contexts     u:object_r:file_contexts_file:s0
-/mapping_sepolicy\.cil   u:object_r:sepolicy_file:s0
-/nonplat_sepolicy\.cil   u:object_r:sepolicy_file:s0
-/plat_sepolicy\.cil      u:object_r:sepolicy_file:s0
-/plat_property_contexts  u:object_r:property_contexts_file:s0
-/nonplat_property_contexts  u:object_r:property_contexts_file:s0
-/vendor_property_contexts   u:object_r:property_contexts_file:s0
-/seapp_contexts     u:object_r:seapp_contexts_file:s0
-/nonplat_seapp_contexts     u:object_r:seapp_contexts_file:s0
-/vendor_seapp_contexts      u:object_r:seapp_contexts_file:s0
-/plat_seapp_contexts     u:object_r:seapp_contexts_file:s0
-/sepolicy           u:object_r:sepolicy_file:s0
-/plat_service_contexts   u:object_r:service_contexts_file:s0
-/plat_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
-/nonplat_service_contexts   u:object_r:nonplat_service_contexts_file:s0
-# Use nonplat_service_contexts_file to allow servicemanager to read it
-# on non full-treble devices.
-/vendor_service_contexts    u:object_r:nonplat_service_contexts_file:s0
-/nonplat_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
-/vendor_hwservice_contexts    u:object_r:hwservice_contexts_file:s0
-/vndservice_contexts   u:object_r:vndservice_contexts_file:s0
-
-##########################
-# Devices
-#
-/dev(/.*)?		u:object_r:device:s0
-/dev/akm8973.*		u:object_r:sensors_device:s0
-/dev/accelerometer	u:object_r:sensors_device:s0
-/dev/adf[0-9]*		u:object_r:graphics_device:s0
-/dev/adf-interface[0-9]*\.[0-9]*	u:object_r:graphics_device:s0
-/dev/adf-overlay-engine[0-9]*\.[0-9]*	u:object_r:graphics_device:s0
-/dev/alarm		u:object_r:alarm_device:s0
-/dev/ashmem		u:object_r:ashmem_device:s0
-/dev/audio.*		u:object_r:audio_device:s0
-/dev/binder		u:object_r:binder_device:s0
-/dev/block(/.*)?	u:object_r:block_device:s0
-/dev/block/dm-[0-9]+	u:object_r:dm_device:s0
-/dev/block/loop[0-9]*	u:object_r:loop_device:s0
-/dev/block/vold/.+	u:object_r:vold_device:s0
-/dev/block/ram[0-9]*	u:object_r:ram_device:s0
-/dev/block/zram[0-9]*	u:object_r:ram_device:s0
-/dev/bus/usb(.*)?       u:object_r:usb_device:s0
-/dev/cam		u:object_r:camera_device:s0
-/dev/console		u:object_r:console_device:s0
-/dev/cpuctl(/.*)?	u:object_r:cpuctl_device:s0
-/dev/memcg(/.*)?        u:object_r:cgroup:s0
-/dev/device-mapper	u:object_r:dm_device:s0
-/dev/eac		u:object_r:audio_device:s0
-/dev/event-log-tags     u:object_r:runtime_event_log_tags_file:s0
-/dev/fscklogs(/.*)?	u:object_r:fscklogs:s0
-/dev/full		u:object_r:full_device:s0
-/dev/fuse		u:object_r:fuse_device:s0
-/dev/graphics(/.*)?	u:object_r:graphics_device:s0
-/dev/hw_random		u:object_r:hw_random_device:s0
-/dev/hwbinder		u:object_r:hwbinder_device:s0
-/dev/i2c-[0-9]+		u:object_r:i2c_device:s0
-/dev/input(/.*)?	u:object_r:input_device:s0
-/dev/iio:device[0-9]+   u:object_r:iio_device:s0
-/dev/ion		u:object_r:ion_device:s0
-/dev/keychord   u:object_r:keychord_device:s0
-/dev/kmem		u:object_r:kmem_device:s0
-/dev/loop-control	u:object_r:loop_control_device:s0
-/dev/mem		u:object_r:kmem_device:s0
-/dev/modem.*		u:object_r:radio_device:s0
-/dev/mtd(/.*)?		u:object_r:mtd_device:s0
-/dev/mtp_usb		u:object_r:mtp_device:s0
-/dev/pmsg0		u:object_r:pmsg_device:s0
-/dev/pn544		u:object_r:nfc_device:s0
-/dev/port		u:object_r:port_device:s0
-/dev/ppp		u:object_r:ppp_device:s0
-/dev/ptmx		u:object_r:ptmx_device:s0
-/dev/pvrsrvkm		u:object_r:gpu_device:s0
-/dev/kmsg		u:object_r:kmsg_device:s0
-/dev/kmsg_debug	u:object_r:kmsg_debug_device:s0
-/dev/null		u:object_r:null_device:s0
-/dev/nvhdcp1		u:object_r:video_device:s0
-/dev/random		u:object_r:random_device:s0
-/dev/rpmsg-omx[0-9]	u:object_r:rpmsg_device:s0
-/dev/rproc_user	u:object_r:rpmsg_device:s0
-/dev/rtc[0-9]      u:object_r:rtc_device:s0
-/dev/snd(/.*)?		u:object_r:audio_device:s0
-/dev/snd/audio_timer_device	u:object_r:audio_timer_device:s0
-/dev/snd/audio_seq_device	u:object_r:audio_seq_device:s0
-/dev/socket(/.*)?	u:object_r:socket_device:s0
-/dev/socket/adbd	u:object_r:adbd_socket:s0
-/dev/socket/dnsproxyd	u:object_r:dnsproxyd_socket:s0
-/dev/socket/dumpstate	u:object_r:dumpstate_socket:s0
-/dev/socket/fwmarkd	u:object_r:fwmarkd_socket:s0
-/dev/socket/lmkd        u:object_r:lmkd_socket:s0
-/dev/socket/logd	u:object_r:logd_socket:s0
-/dev/socket/logdr	u:object_r:logdr_socket:s0
-/dev/socket/logdw	u:object_r:logdw_socket:s0
-/dev/socket/statsdw	u:object_r:statsdw_socket:s0
-/dev/socket/mdns	u:object_r:mdns_socket:s0
-/dev/socket/mdnsd	u:object_r:mdnsd_socket:s0
-/dev/socket/mtpd	u:object_r:mtpd_socket:s0
-/dev/socket/netd	u:object_r:netd_socket:s0
-/dev/socket/pdx/system/buffer_hub	u:object_r:pdx_bufferhub_dir:s0
-/dev/socket/pdx/system/buffer_hub/client	u:object_r:pdx_bufferhub_client_endpoint_socket:s0
-/dev/socket/pdx/system/performance	u:object_r:pdx_performance_dir:s0
-/dev/socket/pdx/system/performance/client	u:object_r:pdx_performance_client_endpoint_socket:s0
-/dev/socket/pdx/system/vr/display	u:object_r:pdx_display_dir:s0
-/dev/socket/pdx/system/vr/display/client	u:object_r:pdx_display_client_endpoint_socket:s0
-/dev/socket/pdx/system/vr/display/manager	u:object_r:pdx_display_manager_endpoint_socket:s0
-/dev/socket/pdx/system/vr/display/screenshot	u:object_r:pdx_display_screenshot_endpoint_socket:s0
-/dev/socket/pdx/system/vr/display/vsync	u:object_r:pdx_display_vsync_endpoint_socket:s0
-/dev/socket/property_service	u:object_r:property_socket:s0
-/dev/socket/racoon	u:object_r:racoon_socket:s0
-/dev/socket/rild	u:object_r:rild_socket:s0
-/dev/socket/rild-debug	u:object_r:rild_debug_socket:s0
-/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
-/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
-/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
-/dev/socket/traced_producer	u:object_r:traced_producer_socket:s0
-/dev/socket/traced_consumer	u:object_r:traced_consumer_socket:s0
-/dev/socket/uncrypt	u:object_r:uncrypt_socket:s0
-/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
-/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
-/dev/socket/zygote	u:object_r:zygote_socket:s0
-/dev/socket/zygote_secondary	u:object_r:zygote_socket:s0
-/dev/spdif_out.*	u:object_r:audio_device:s0
-/dev/tegra.*		u:object_r:video_device:s0
-/dev/tty		u:object_r:owntty_device:s0
-/dev/tty[0-9]*		u:object_r:tty_device:s0
-/dev/ttyS[0-9]*		u:object_r:serial_device:s0
-/dev/tun		u:object_r:tun_device:s0
-/dev/uhid		u:object_r:uhid_device:s0
-/dev/uinput		u:object_r:uhid_device:s0
-/dev/uio[0-9]*		u:object_r:uio_device:s0
-/dev/urandom		u:object_r:random_device:s0
-/dev/usb_accessory	u:object_r:usbaccessory_device:s0
-/dev/v4l-touch[0-9]*	u:object_r:input_device:s0
-/dev/vcs[0-9a-z]*	u:object_r:vcs_device:s0
-/dev/video[0-9]*	u:object_r:video_device:s0
-/dev/vndbinder		u:object_r:vndbinder_device:s0
-/dev/watchdog		u:object_r:watchdog_device:s0
-/dev/xt_qtaguid	u:object_r:qtaguid_device:s0
-/dev/zero		u:object_r:zero_device:s0
-/dev/__properties__ u:object_r:properties_device:s0
-/dev/__properties__/property_info   u:object_r:property_info:s0
-#############################
-# System files
-#
-/system(/.*)?		u:object_r:system_file:s0
-/system/bin/atrace	u:object_r:atrace_exec:s0
-/system/bin/blank_screen	u:object_r:blank_screen_exec:s0
-/system/bin/e2fsdroid		u:object_r:e2fs_exec:s0
-/system/bin/mke2fs		u:object_r:e2fs_exec:s0
-/system/bin/e2fsck	--	u:object_r:fsck_exec:s0
-/system/bin/fsck\.f2fs	--	u:object_r:fsck_exec:s0
-/system/bin/sload_f2fs	--	u:object_r:e2fs_exec:s0
-/system/bin/make_f2fs	--	u:object_r:e2fs_exec:s0
-/system/bin/fsck_msdos	--	u:object_r:fsck_exec:s0
-/system/bin/tune2fs	--	u:object_r:fsck_exec:s0
-/system/bin/toolbox	--	u:object_r:toolbox_exec:s0
-/system/bin/toybox	--	u:object_r:toolbox_exec:s0
-/system/bin/logcat	--	u:object_r:logcat_exec:s0
-/system/bin/logcatd	--	u:object_r:logcat_exec:s0
-/system/bin/sh		--	u:object_r:shell_exec:s0
-/system/bin/run-as	--	u:object_r:runas_exec:s0
-/system/bin/bootanimation u:object_r:bootanim_exec:s0
-/system/bin/bootstat		u:object_r:bootstat_exec:s0
-/system/bin/app_process32	u:object_r:zygote_exec:s0
-/system/bin/app_process64	u:object_r:zygote_exec:s0
-/system/bin/servicemanager	u:object_r:servicemanager_exec:s0
-/system/bin/hwservicemanager	u:object_r:hwservicemanager_exec:s0
-/system/bin/surfaceflinger	u:object_r:surfaceflinger_exec:s0
-/system/bin/bufferhubd	u:object_r:bufferhubd_exec:s0
-/system/bin/performanced	u:object_r:performanced_exec:s0
-/system/bin/drmserver	u:object_r:drmserver_exec:s0
-/system/bin/dumpstate   u:object_r:dumpstate_exec:s0
-/system/bin/incident   u:object_r:incident_exec:s0
-/system/bin/incidentd   u:object_r:incidentd_exec:s0
-/system/bin/incident_helper  u:object_r:incident_helper_exec:s0
-/system/bin/netutils-wrapper-1\.0    u:object_r:netutils_wrapper_exec:s0
-/system/bin/vold	u:object_r:vold_exec:s0
-/system/bin/netd	u:object_r:netd_exec:s0
-/system/bin/wificond	u:object_r:wificond_exec:s0
-/system/bin/audioserver	u:object_r:audioserver_exec:s0
-/system/bin/mediadrmserver	u:object_r:mediadrmserver_exec:s0
-/system/bin/mediaserver	u:object_r:mediaserver_exec:s0
-/system/bin/mediametrics	u:object_r:mediametrics_exec:s0
-/system/bin/cameraserver	u:object_r:cameraserver_exec:s0
-/system/bin/mediaextractor	u:object_r:mediaextractor_exec:s0
-/system/bin/mdnsd	u:object_r:mdnsd_exec:s0
-/system/bin/installd	u:object_r:installd_exec:s0
-/system/bin/otapreopt_chroot   u:object_r:otapreopt_chroot_exec:s0
-/system/bin/otapreopt_slot   u:object_r:otapreopt_slot_exec:s0
-/system/bin/keystore	u:object_r:keystore_exec:s0
-/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
-/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
-/system/bin/crash_dump32 u:object_r:crash_dump_exec:s0
-/system/bin/crash_dump64 u:object_r:crash_dump_exec:s0
-/system/bin/tombstoned u:object_r:tombstoned_exec:s0
-/system/bin/recovery-persist     u:object_r:recovery_persist_exec:s0
-/system/bin/recovery-refresh     u:object_r:recovery_refresh_exec:s0
-/system/bin/sdcard      u:object_r:sdcardd_exec:s0
-/system/bin/dhcpcd      u:object_r:dhcp_exec:s0
-/system/bin/dhcpcd-6.8.2	u:object_r:dhcp_exec:s0
-/system/bin/mtpd	u:object_r:mtp_exec:s0
-/system/bin/pppd	u:object_r:ppp_exec:s0
-/system/bin/racoon	u:object_r:racoon_exec:s0
-/system/xbin/su		u:object_r:su_exec:s0
-/system/bin/perfprofd  u:object_r:perfprofd_exec:s0
-/system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
-/system/bin/healthd     u:object_r:healthd_exec:s0
-/system/bin/clatd	u:object_r:clatd_exec:s0
-/system/bin/lmkd        u:object_r:lmkd_exec:s0
-/system/bin/usbd   u:object_r:usbd_exec:s0
-/system/bin/inputflinger u:object_r:inputflinger_exec:s0
-/system/bin/logd        u:object_r:logd_exec:s0
-/system/bin/perfetto        u:object_r:perfetto_exec:s0
-/system/bin/traced        u:object_r:traced_exec:s0
-/system/bin/traced_probes        u:object_r:traced_probes_exec:s0
-/system/bin/uncrypt     u:object_r:uncrypt_exec:s0
-/system/bin/update_verifier u:object_r:update_verifier_exec:s0
-/system/bin/logwrapper  u:object_r:system_file:s0
-/system/bin/vdc         u:object_r:vdc_exec:s0
-/system/bin/cppreopts.sh   u:object_r:cppreopts_exec:s0
-/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
-/system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
-/system/bin/dex2oat(d)?     u:object_r:dex2oat_exec:s0
-/system/bin/dexoptanalyzer(d)?     u:object_r:dexoptanalyzer_exec:s0
-# patchoat executable has (essentially) the same requirements as dex2oat.
-/system/bin/patchoat(d)?    u:object_r:dex2oat_exec:s0
-/system/bin/profman(d)?     u:object_r:profman_exec:s0
-/system/bin/sgdisk      u:object_r:sgdisk_exec:s0
-/system/bin/blkid       u:object_r:blkid_exec:s0
-/system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
-/system/bin/idmap u:object_r:idmap_exec:s0
-/system/bin/update_engine        u:object_r:update_engine_exec:s0
-/system/bin/bspatch              u:object_r:update_engine_exec:s0
-/system/bin/storaged             u:object_r:storaged_exec:s0
-/system/bin/thermalserviced      u:object_r:thermalserviced_exec:s0
-/system/bin/wpantund             u:object_r:wpantund_exec:s0
-/system/bin/virtual_touchpad     u:object_r:virtual_touchpad_exec:s0
-/system/bin/hw/android\.hidl\.allocator@1\.0-service          u:object_r:hal_allocator_default_exec:s0
-/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil       u:object_r:sepolicy_file:s0
-/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
-/system/etc/selinux/plat_property_contexts  u:object_r:property_contexts_file:s0
-/system/etc/selinux/plat_service_contexts  u:object_r:service_contexts_file:s0
-/system/etc/selinux/plat_hwservice_contexts  u:object_r:hwservice_contexts_file:s0
-/system/etc/selinux/plat_file_contexts  u:object_r:file_contexts_file:s0
-/system/etc/selinux/plat_seapp_contexts  u:object_r:seapp_contexts_file:s0
-/system/etc/selinux/plat_sepolicy.cil       u:object_r:sepolicy_file:s0
-/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
-/system/bin/vr_hwc               u:object_r:vr_hwc_exec:s0
-/system/bin/adbd                 u:object_r:adbd_exec:s0
-/system/bin/vold_prepare_subdirs u:object_r:vold_prepare_subdirs_exec:s0
-/system/bin/stats                u:object_r:stats_exec:s0
-/system/bin/statsd               u:object_r:statsd_exec:s0
-/system/bin/bpfloader            u:object_r:bpfloader_exec:s0
-/system/bin/wait_for_keymaster   u:object_r:wait_for_keymaster_exec:s0
-
-#############################
-# Vendor files
-#
-/(vendor|system/vendor)(/.*)?                  u:object_r:vendor_file:s0
-/(vendor|system/vendor)/bin/sh                 u:object_r:vendor_shell_exec:s0
-/(vendor|system/vendor)/bin/toybox_vendor      u:object_r:vendor_toolbox_exec:s0
-/(vendor|system/vendor)/bin/toolbox            u:object_r:vendor_toolbox_exec:s0
-/(vendor|system/vendor)/etc(/.*)?              u:object_r:vendor_configs_file:s0
-
-/(vendor|system/vendor)/lib(64)?/egl(/.*)?     u:object_r:same_process_hal_file:s0
-
-/(vendor|system/vendor)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
-
-/(vendor|system/vendor)/manifest.xml           u:object_r:vendor_configs_file:s0
-/(vendor|system/vendor)/compatibility_matrix.xml u:object_r:vendor_configs_file:s0
-/(vendor|system/vendor)/etc/vintf(/.*)?        u:object_r:vendor_configs_file:s0
-/(vendor|system/vendor)/app(/.*)?              u:object_r:vendor_app_file:s0
-/(vendor|system/vendor)/priv-app(/.*)?         u:object_r:vendor_app_file:s0
-/(vendor|system/vendor)/overlay(/.*)?          u:object_r:vendor_overlay_file:s0
-/(vendor|system/vendor)/framework(/.*)?        u:object_r:vendor_framework_file:s0
-
-# HAL location
-/(vendor|system/vendor)/lib(64)?/hw            u:object_r:vendor_hal_file:s0
-
-#############################
-# OEM and ODM files
-#
-/(odm|vendor/odm)(/.*)?                       u:object_r:vendor_file:s0
-/(odm|vendor/odm)/lib(64)?/egl(/.*)?          u:object_r:same_process_hal_file:s0
-/(odm|vendor/odm)/lib(64)?/hw                 u:object_r:vendor_hal_file:s0
-/(odm|vendor/odm)/lib(64)?/vndk-sp(/.*)?      u:object_r:vndk_sp_file:s0
-/(odm|vendor/odm)/bin/sh                      u:object_r:vendor_shell_exec:s0
-/(odm|vendor/odm)/etc(/.*)?                   u:object_r:vendor_configs_file:s0
-/(odm|vendor/odm)/app(/.*)?                   u:object_r:vendor_app_file:s0
-/(odm|vendor/odm)/priv-app(/.*)?              u:object_r:vendor_app_file:s0
-/(odm|vendor/odm)/overlay(/.*)?               u:object_r:vendor_overlay_file:s0
-/(odm|vendor/odm)/framework(/.*)?             u:object_r:vendor_framework_file:s0
-
-/oem(/.*)?              u:object_r:oemfs:s0
-
-# The precompiled monolithic sepolicy will be under /odm only when
-# BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
-/odm/etc/selinux/precompiled_sepolicy                           u:object_r:sepolicy_file:s0
-/odm/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
-
-/(odm|vendor/odm)/etc/selinux/odm_sepolicy.cil                  u:object_r:sepolicy_file:s0
-/(odm|vendor/odm)/etc/selinux/odm_file_contexts                 u:object_r:file_contexts_file:s0
-/(odm|vendor/odm)/etc/selinux/odm_seapp_contexts                u:object_r:seapp_contexts_file:s0
-/(odm|vendor/odm)/etc/selinux/odm_property_contexts             u:object_r:property_contexts_file:s0
-/(odm|vendor/odm)/etc/selinux/odm_hwservice_contexts            u:object_r:hwservice_contexts_file:s0
-/(odm|vendor/odm)/etc/selinux/odm_mac_permissions.xml           u:object_r:mac_perms_file:s0
-
-#############################
-# Product files
-#
-/(product|system/product)(/.*)?               u:object_r:system_file:s0
-
-#############################
-# Data files
-#
-# NOTE: When modifying existing label rules, changes may also need to
-# propagate to the "Expanded data files" section.
-#
-/data(/.*)?		u:object_r:system_data_file:s0
-/data/.layout_version		u:object_r:install_data_file:s0
-/data/unencrypted(/.*)?         u:object_r:unencrypted_data_file:s0
-/data/backup(/.*)?		u:object_r:backup_data_file:s0
-/data/secure/backup(/.*)?	u:object_r:backup_data_file:s0
-/data/system/ndebugsocket	u:object_r:system_ndebug_socket:s0
-/data/drm(/.*)?		u:object_r:drm_data_file:s0
-/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
-/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
-/data/ota(/.*)? u:object_r:ota_data_file:s0
-/data/ota_package(/.*)? u:object_r:ota_package_file:s0
-/data/adb(/.*)?		u:object_r:adb_data_file:s0
-/data/anr(/.*)?		u:object_r:anr_data_file:s0
-/data/app(/.*)?                       u:object_r:apk_data_file:s0
-/data/app/[^/]+/oat(/.*)?                u:object_r:dalvikcache_data_file:s0
-/data/app/vmdl[^/]+\.tmp(/.*)?           u:object_r:apk_tmp_file:s0
-/data/app/vmdl[^/]+\.tmp/oat(/.*)?           u:object_r:dalvikcache_data_file:s0
-/data/app-private(/.*)?               u:object_r:apk_private_data_file:s0
-/data/app-private/vmdl.*\.tmp(/.*)?   u:object_r:apk_private_tmp_file:s0
-/data/tombstones(/.*)?	u:object_r:tombstone_data_file:s0
-/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
-/data/local/tmp(/.*)?	u:object_r:shell_data_file:s0
-/data/local/tmp/ltp(/.*)?   u:object_r:nativetest_data_file:s0
-/data/local/traces(/.*)?	u:object_r:trace_data_file:s0
-/data/media(/.*)?	u:object_r:media_rw_data_file:s0
-/data/mediadrm(/.*)?	u:object_r:media_data_file:s0
-/data/nativetest(/.*)?	u:object_r:nativetest_data_file:s0
-/data/nativetest64(/.*)?	u:object_r:nativetest_data_file:s0
-/data/property(/.*)?	u:object_r:property_data_file:s0
-/data/preloads(/.*)?	u:object_r:preloads_data_file:s0
-/data/preloads/media(/.*)?	u:object_r:preloads_media_file:s0
-/data/preloads/demo(/.*)?	u:object_r:preloads_media_file:s0
-
-# Misc data
-/data/misc/adb(/.*)?            u:object_r:adb_keys_file:s0
-/data/misc/apns(/.*)?           u:object_r:radio_data_file:s0
-/data/misc/audio(/.*)?          u:object_r:audio_data_file:s0
-/data/misc/audioserver(/.*)?    u:object_r:audioserver_data_file:s0
-/data/misc/audiohal(/.*)?       u:object_r:audiohal_data_file:s0
-/data/misc/bootstat(/.*)?       u:object_r:bootstat_data_file:s0
-/data/misc/boottrace(/.*)?      u:object_r:boottrace_data_file:s0
-/data/misc/bluetooth(/.*)?      u:object_r:bluetooth_data_file:s0
-/data/misc/bluetooth/logs(/.*)? u:object_r:bluetooth_logs_data_file:s0
-/data/misc/bluedroid(/.*)?      u:object_r:bluetooth_data_file:s0
-/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
-/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
-/data/misc/camera(/.*)?         u:object_r:camera_data_file:s0
-/data/misc/carrierid(/.*)?      u:object_r:radio_data_file:s0
-/data/misc/dhcp(/.*)?           u:object_r:dhcp_data_file:s0
-/data/misc/dhcp-6.8.2(/.*)?     u:object_r:dhcp_data_file:s0
-/data/misc/gatekeeper(/.*)?     u:object_r:gatekeeper_data_file:s0
-/data/misc/incidents(/.*)?	    u:object_r:incident_data_file:s0
-/data/misc/keychain(/.*)?       u:object_r:keychain_data_file:s0
-/data/misc/keystore(/.*)?       u:object_r:keystore_data_file:s0
-/data/misc/logd(/.*)?           u:object_r:misc_logd_file:s0
-/data/misc/media(/.*)?          u:object_r:media_data_file:s0
-/data/misc/net(/.*)?            u:object_r:net_data_file:s0
-/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
-/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
-/data/misc/recovery(/.*)?       u:object_r:recovery_data_file:s0
-/data/misc/shared_relro(/.*)?   u:object_r:shared_relro_file:s0
-/data/misc/sms(/.*)?            u:object_r:radio_data_file:s0
-/data/misc/stats-data(/.*)?     u:object_r:stats_data_file:s0
-/data/misc/stats-service(/.*)?  u:object_r:stats_data_file:s0
-/data/misc/systemkeys(/.*)?     u:object_r:systemkeys_data_file:s0
-/data/misc/textclassifier(/.*)?       u:object_r:textclassifier_data_file:s0
-/data/misc/user(/.*)?           u:object_r:misc_user_data_file:s0
-/data/misc/vpn(/.*)?            u:object_r:vpn_data_file:s0
-/data/misc/wifi(/.*)?           u:object_r:wifi_data_file:s0
-/data/misc/wifi/sockets(/.*)?   u:object_r:wpa_socket:s0
-/data/misc/wifi/sockets/wpa_ctrl.*   u:object_r:system_wpa_socket:s0
-/data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
-/data/misc/vold(/.*)?           u:object_r:vold_data_file:s0
-/data/misc/perfprofd(/.*)?      u:object_r:perfprofd_data_file:s0
-/data/misc/update_engine(/.*)?  u:object_r:update_engine_data_file:s0
-/data/misc/update_engine_log(/.*)?  u:object_r:update_engine_log_data_file:s0
-/data/system/heapdump(/.*)?     u:object_r:heapdump_data_file:s0
-/data/misc/trace(/.*)?          u:object_r:method_trace_data_file:s0
-/data/misc/wmtrace(/.*)?        u:object_r:wm_trace_data_file:s0
-# TODO(calin) label profile reference differently so that only
-# profman run as a special user can write to them
-/data/misc/profiles/cur(/.*)?       u:object_r:user_profile_data_file:s0
-/data/misc/profiles/ref(/.*)?       u:object_r:user_profile_data_file:s0
-/data/misc/profman(/.*)?        u:object_r:profman_dump_data_file:s0
-/data/vendor(/.*)?              u:object_r:vendor_data_file:s0
-/data/vendor_ce(/.*)?           u:object_r:vendor_data_file:s0
-/data/vendor_de(/.*)?           u:object_r:vendor_data_file:s0
-
-# storaged proto files
-/data/misc_de/[0-9]+/storaged(/.*)?       u:object_r:storaged_data_file:s0
-/data/misc_ce/[0-9]+/storaged(/.*)?       u:object_r:storaged_data_file:s0
-
-# Fingerprint data
-/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
-
-# Fingerprint vendor data file
-/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
-
-# Bootchart data
-/data/bootchart(/.*)?		u:object_r:bootchart_data_file:s0
-
-#############################
-# Expanded data files
-#
-/mnt/expand(/.*)?                                   u:object_r:mnt_expand_file:s0
-/mnt/expand/[^/]+(/.*)?                             u:object_r:system_data_file:s0
-/mnt/expand/[^/]+/app(/.*)?                         u:object_r:apk_data_file:s0
-/mnt/expand/[^/]+/app/[^/]+/oat(/.*)?               u:object_r:dalvikcache_data_file:s0
-/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)?          u:object_r:apk_tmp_file:s0
-/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)?      u:object_r:dalvikcache_data_file:s0
-/mnt/expand/[^/]+/local/tmp(/.*)?                   u:object_r:shell_data_file:s0
-/mnt/expand/[^/]+/media(/.*)?                       u:object_r:media_rw_data_file:s0
-/mnt/expand/[^/]+/misc/vold(/.*)?                   u:object_r:vold_data_file:s0
-
-# coredump directory for userdebug/eng devices
-/cores(/.*)?                    u:object_r:coredump_file:s0
-
-# Wallpaper files
-/data/system/users/[0-9]+/wallpaper_lock_orig	u:object_r:wallpaper_file:s0
-/data/system/users/[0-9]+/wallpaper_lock	u:object_r:wallpaper_file:s0
-/data/system/users/[0-9]+/wallpaper_orig	u:object_r:wallpaper_file:s0
-/data/system/users/[0-9]+/wallpaper		u:object_r:wallpaper_file:s0
-
-# Ringtone files
-/data/system_de/[0-9]+/ringtones(/.*)?          u:object_r:ringtone_file:s0
-
-# ShortcutManager icons, e.g.
-#   /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
-/data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
-
-# User icon files
-/data/system/users/[0-9]+/photo.png             u:object_r:icon_file:s0
-
-# vold per-user data
-/data/misc_de/[0-9]+/vold(/.*)?           u:object_r:vold_data_file:s0
-/data/misc_ce/[0-9]+/vold(/.*)?           u:object_r:vold_data_file:s0
-
-#############################
-# efs files
-#
-/efs(/.*)?		u:object_r:efs_file:s0
-
-#############################
-# Cache files
-#
-/cache(/.*)?		u:object_r:cache_file:s0
-/cache/recovery(/.*)?	u:object_r:cache_recovery_file:s0
-# General backup/restore interchange with apps
-/cache/backup_stage(/.*)?	u:object_r:cache_backup_file:s0
-# LocalTransport (backup) uses this subtree
-/cache/backup(/.*)?		u:object_r:cache_private_backup_file:s0
-
-/data/cache(/.*)?		u:object_r:cache_file:s0
-/data/cache/recovery(/.*)?	u:object_r:cache_recovery_file:s0
-# General backup/restore interchange with apps
-/data/cache/backup_stage(/.*)?	u:object_r:cache_backup_file:s0
-# LocalTransport (backup) uses this subtree
-/data/cache/backup(/.*)?	u:object_r:cache_private_backup_file:s0
-
-#############################
-# Metadata files
-#
-/metadata(/.*)?           u:object_r:metadata_file:s0
-/metadata/vold(/.*)?      u:object_r:vold_metadata_file:s0
-
-#############################
-# asec containers
-/mnt/asec(/.*)?             u:object_r:asec_apk_file:s0
-/mnt/asec/[^/]+/[^/]+\.zip  u:object_r:asec_public_file:s0
-/mnt/asec/[^/]+/lib(/.*)?   u:object_r:asec_public_file:s0
-/data/app-asec(/.*)?        u:object_r:asec_image_file:s0
-
-#############################
-# external storage
-/mnt/media_rw(/.*)?         u:object_r:mnt_media_rw_file:s0
-/mnt/user(/.*)?             u:object_r:mnt_user_file:s0
-/mnt/runtime(/.*)?          u:object_r:storage_file:s0
-/storage(/.*)?              u:object_r:storage_file:s0
-
-#############################
-# mount point for read-write vendor partitions
-/mnt/vendor(/.*)?          u:object_r:mnt_vendor_file:s0

prebuilts/api/28.0/private/file_contexts_asan

@@ -1,11 +0,0 @@
-/data/asan/system/lib(/.*)?                u:object_r:system_file:s0
-/data/asan/system/lib64(/.*)?              u:object_r:system_file:s0
-/data/asan/vendor/lib(/.*)?                u:object_r:system_file:s0
-/data/asan/vendor/lib64(/.*)?              u:object_r:system_file:s0
-/data/asan/odm/lib(/.*)?                   u:object_r:system_file:s0
-/data/asan/odm/lib64(/.*)?                 u:object_r:system_file:s0
-/system/bin/asan_extract       u:object_r:asan_extract_exec:s0
-/system/bin/asanwrapper        u:object_r:asanwrapper_exec:s0
-/system/bin/asan/app_process   u:object_r:zygote_exec:s0
-/system/bin/asan/app_process32 u:object_r:zygote_exec:s0
-/system/bin/asan/app_process64 u:object_r:zygote_exec:s0

prebuilts/api/28.0/private/fingerprintd.te

@@ -1,3 +0,0 @@
-typeattribute fingerprintd coredomain;
-
-init_daemon_domain(fingerprintd)

prebuilts/api/28.0/private/fs_use

@@ -1,23 +0,0 @@
-# Label inodes via getxattr.
-fs_use_xattr yaffs2 u:object_r:labeledfs:s0;
-fs_use_xattr jffs2 u:object_r:labeledfs:s0;
-fs_use_xattr ext2 u:object_r:labeledfs:s0;
-fs_use_xattr ext3 u:object_r:labeledfs:s0;
-fs_use_xattr ext4 u:object_r:labeledfs:s0;
-fs_use_xattr xfs u:object_r:labeledfs:s0;
-fs_use_xattr btrfs u:object_r:labeledfs:s0;
-fs_use_xattr f2fs u:object_r:labeledfs:s0;
-fs_use_xattr squashfs u:object_r:labeledfs:s0;
-
-# Label inodes from task label.
-fs_use_task pipefs u:object_r:pipefs:s0;
-fs_use_task sockfs u:object_r:sockfs:s0;
-
-# Label inodes from combination of task label and fs label.
-# Define type_transition rules if you want per-domain types.
-fs_use_trans devpts u:object_r:devpts:s0;
-fs_use_trans tmpfs u:object_r:tmpfs:s0;
-fs_use_trans devtmpfs u:object_r:device:s0;
-fs_use_trans shm u:object_r:shm:s0;
-fs_use_trans mqueue u:object_r:mqueue:s0;
-

prebuilts/api/28.0/private/fsck.te

@@ -1,5 +0,0 @@
-typeattribute fsck coredomain;
-
-init_daemon_domain(fsck)
-
-allow fsck metadata_block_device:blk_file rw_file_perms;

prebuilts/api/28.0/private/fsck_untrusted.te

@@ -1 +0,0 @@
-typeattribute fsck_untrusted coredomain;

prebuilts/api/28.0/private/gatekeeperd.te

@@ -1,3 +0,0 @@
-typeattribute gatekeeperd coredomain;
-
-init_daemon_domain(gatekeeperd)

prebuilts/api/28.0/private/genfs_contexts

@@ -1,244 +0,0 @@
-# Label inodes with the fs label.
-genfscon rootfs / u:object_r:rootfs:s0
-# proc labeling can be further refined (longest matching prefix).
-genfscon proc / u:object_r:proc:s0
-genfscon proc /asound u:object_r:proc_asound:s0
-genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
-genfscon proc /cmdline u:object_r:proc_cmdline:s0
-genfscon proc /config.gz u:object_r:config_gz:s0
-genfscon proc /diskstats u:object_r:proc_diskstats:s0
-genfscon proc /filesystems u:object_r:proc_filesystems:s0
-genfscon proc /interrupts u:object_r:proc_interrupts:s0
-genfscon proc /iomem u:object_r:proc_iomem:s0
-genfscon proc /kmsg u:object_r:proc_kmsg:s0
-genfscon proc /loadavg u:object_r:proc_loadavg:s0
-genfscon proc /meminfo u:object_r:proc_meminfo:s0
-genfscon proc /misc u:object_r:proc_misc:s0
-genfscon proc /modules u:object_r:proc_modules:s0
-genfscon proc /mounts u:object_r:proc_mounts:s0
-genfscon proc /net u:object_r:proc_net:s0
-genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid_proc:s0
-genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
-genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
-genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
-genfscon proc /softirqs u:object_r:proc_timer:s0
-genfscon proc /stat u:object_r:proc_stat:s0
-genfscon proc /swaps u:object_r:proc_swaps:s0
-genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
-genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
-genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
-genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
-genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0
-genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0
-genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0
-genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0
-genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0
-genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0
-genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0
-genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0
-genfscon proc /sys/kernel/hung_task_timeout_secs u:object_r:proc_hung_task:s0
-genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
-genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
-genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
-genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0
-genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
-genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0
-genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0
-genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
-genfscon proc /sys/kernel/random u:object_r:proc_random:s0
-genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
-genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0
-genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0
-genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
-genfscon proc /sys/net u:object_r:proc_net:s0
-genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
-genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
-genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0
-genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0
-genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
-genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
-genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
-genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0
-genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
-genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
-genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
-genfscon proc /timer_list u:object_r:proc_timer:s0
-genfscon proc /timer_stats u:object_r:proc_timer:s0
-genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
-genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0
-genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
-genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
-genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
-genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
-genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0
-genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0
-genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0
-genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0
-genfscon proc /uptime u:object_r:proc_uptime:s0
-genfscon proc /version u:object_r:proc_version:s0
-genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
-genfscon proc /vmstat u:object_r:proc_vmstat:s0
-genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
-
-# selinuxfs booleans can be individually labeled.
-genfscon selinuxfs / u:object_r:selinuxfs:s0
-genfscon cgroup / u:object_r:cgroup:s0
-genfscon cgroup2 / u:object_r:cgroup_bpf:s0
-# sysfs labels can be set by userspace.
-genfscon sysfs / u:object_r:sysfs:s0
-genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
-genfscon sysfs /class/android_usb                 u:object_r:sysfs_android_usb:s0
-genfscon sysfs /class/leds                        u:object_r:sysfs_leds:s0
-genfscon sysfs /class/net                         u:object_r:sysfs_net:s0
-genfscon sysfs /class/rtc                         u:object_r:sysfs_rtc:s0
-genfscon sysfs /class/switch                      u:object_r:sysfs_switch:s0
-genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
-genfscon sysfs /devices/virtual/android_usb     u:object_r:sysfs_android_usb:s0
-genfscon sysfs /devices/virtual/block/dm-       u:object_r:sysfs_dm:s0
-genfscon sysfs /devices/virtual/block/zram0     u:object_r:sysfs_zram:s0
-genfscon sysfs /devices/virtual/block/zram1     u:object_r:sysfs_zram:s0
-genfscon sysfs /devices/virtual/block/zram0/uevent    u:object_r:sysfs_zram_uevent:s0
-genfscon sysfs /devices/virtual/block/zram1/uevent    u:object_r:sysfs_zram_uevent:s0
-genfscon sysfs /devices/virtual/misc/hw_random    u:object_r:sysfs_hwrandom:s0
-genfscon sysfs /devices/virtual/switch          u:object_r:sysfs_switch:s0
-genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
-genfscon sysfs /fs/ext4/features                  u:object_r:sysfs_fs_ext4_features:s0
-genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
-genfscon sysfs /power/state u:object_r:sysfs_power:s0
-genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
-genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
-genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
-genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
-genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
-genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
-genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
-genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
-genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
-genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
-genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
-
-genfscon debugfs /mmc0                                u:object_r:debugfs_mmc:s0
-genfscon debugfs /tracing                             u:object_r:debugfs_tracing_debug:s0
-genfscon tracefs /                                    u:object_r:debugfs_tracing_debug:s0
-genfscon debugfs /tracing/tracing_on                  u:object_r:debugfs_tracing:s0
-genfscon tracefs /tracing_on                          u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/trace                       u:object_r:debugfs_tracing:s0
-genfscon tracefs /trace                               u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/per_cpu/cpu                 u:object_r:debugfs_tracing:s0
-genfscon tracefs /per_cpu/cpu                         u:object_r:debugfs_tracing:s0
-
-genfscon debugfs /tracing/instances                   u:object_r:debugfs_tracing_instances:s0
-genfscon tracefs /instances                           u:object_r:debugfs_tracing_instances:s0
-genfscon debugfs /tracing/instances/wifi              u:object_r:debugfs_wifi_tracing:s0
-genfscon tracefs /instances/wifi                      u:object_r:debugfs_wifi_tracing:s0
-genfscon debugfs /tracing/trace_marker                u:object_r:debugfs_trace_marker:s0
-genfscon tracefs /trace_marker                        u:object_r:debugfs_trace_marker:s0
-genfscon debugfs /wakeup_sources                      u:object_r:debugfs_wakeup_sources:s0
-
-genfscon debugfs /tracing/events/workqueue/                          u:object_r:debugfs_tracing_debug:s0
-genfscon debugfs /tracing/events/regulator/                          u:object_r:debugfs_tracing_debug:s0
-genfscon debugfs /tracing/events/pagecache/                          u:object_r:debugfs_tracing_debug:s0
-genfscon debugfs /tracing/events/irq/                                u:object_r:debugfs_tracing_debug:s0
-genfscon debugfs /tracing/events/ipi/                                u:object_r:debugfs_tracing_debug:s0
-genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_enter/          u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_exit/           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/f2fs/f2fs_write_begin/              u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/f2fs/f2fs_write_end/                u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/ext4/ext4_da_write_begin/           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/ext4/ext4_da_write_end/             u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/ext4/ext4_sync_file_enter/          u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/ext4/ext4_sync_file_exit/           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/block/block_rq_issue/               u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/block/block_rq_complete/            u:object_r:debugfs_tracing:s0
-
-genfscon tracefs /events/workqueue/                          u:object_r:debugfs_tracing_debug:s0
-genfscon tracefs /events/regulator/                          u:object_r:debugfs_tracing_debug:s0
-genfscon tracefs /events/pagecache/                          u:object_r:debugfs_tracing_debug:s0
-genfscon tracefs /events/irq/                                u:object_r:debugfs_tracing_debug:s0
-genfscon tracefs /events/ipi/                                u:object_r:debugfs_tracing_debug:s0
-genfscon tracefs /events/f2fs/f2fs_sync_file_enter/          u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/f2fs/f2fs_sync_file_exit/           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/f2fs/f2fs_write_begin/              u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/f2fs/f2fs_write_end/                u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/ext4/ext4_da_write_begin/           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/ext4/ext4_da_write_end/             u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/ext4/ext4_sync_file_enter/          u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/ext4/ext4_sync_file_exit/           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/block/block_rq_issue/               u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/block/block_rq_complete/            u:object_r:debugfs_tracing:s0
-
-genfscon tracefs /trace_clock                                            u:object_r:debugfs_tracing:s0
-genfscon tracefs /buffer_size_kb                                         u:object_r:debugfs_tracing:s0
-genfscon tracefs /options/overwrite                                      u:object_r:debugfs_tracing:s0
-genfscon tracefs /options/print-tgid                                     u:object_r:debugfs_tracing:s0
-genfscon tracefs /saved_cmdlines_size                                    u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/sched/sched_switch/                             u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/sched/sched_wakeup/                             u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/sched/sched_blocked_reason/                     u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/sched/sched_cpu_hotplug/                        u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/cgroup/                                         u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/power/cpu_frequency/                            u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/power/cpu_idle/                                 u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/power/clock_set_rate/                           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/power/cpu_frequency_limits/                     u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/cpufreq_interactive/                            u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/          u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/            u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/                   u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/                  u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/binder/binder_transaction/                      u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/binder/binder_transaction_received/             u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/binder/binder_lock/                             u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/binder/binder_locked/                           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/binder/binder_unlock/                           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/lowmemorykiller/                                u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/sync/                                           u:object_r:debugfs_tracing:s0
-genfscon tracefs /events/fence/                                          u:object_r:debugfs_tracing:s0
-
-genfscon debugfs /tracing/trace_clock                                            u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/buffer_size_kb                                         u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/options/overwrite                                      u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/options/print-tgid                                     u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/saved_cmdlines_size                                    u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/sched/sched_switch/                             u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/sched/sched_wakeup/                             u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/sched/sched_blocked_reason/                     u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/sched/sched_cpu_hotplug/                        u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/cgroup/                                         u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/power/cpu_frequency/                            u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/power/cpu_idle/                                 u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/power/clock_set_rate/                           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/power/cpu_frequency_limits/                     u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/cpufreq_interactive/                            u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/          u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_end/            u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_wake/                   u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_sleep/                  u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/binder/binder_transaction/                      u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/binder/binder_transaction_received/             u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/binder/binder_lock/                             u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/binder/binder_locked/                           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/binder/binder_unlock/                           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/lowmemorykiller/                                u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/sync/                                           u:object_r:debugfs_tracing:s0
-genfscon debugfs /tracing/events/fence/                                          u:object_r:debugfs_tracing:s0
-
-genfscon inotifyfs / u:object_r:inotify:s0
-genfscon vfat / u:object_r:vfat:s0
-genfscon exfat / u:object_r:exfat:s0
-genfscon debugfs / u:object_r:debugfs:s0
-genfscon fuse / u:object_r:fuse:s0
-genfscon configfs / u:object_r:configfs:s0
-genfscon sdcardfs / u:object_r:sdcardfs:s0
-genfscon esdfs / u:object_r:sdcardfs:s0
-genfscon pstore / u:object_r:pstorefs:s0
-genfscon functionfs / u:object_r:functionfs:s0
-genfscon usbfs / u:object_r:usbfs:s0
-genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
-genfscon bpf / u:object_r:fs_bpf:s0

prebuilts/api/28.0/private/hal_allocator_default.te

@@ -1,5 +0,0 @@
-type hal_allocator_default, domain, coredomain;
-hal_server_domain(hal_allocator_default, hal_allocator)
-
-type hal_allocator_default_exec, exec_type, file_type;
-init_daemon_domain(hal_allocator_default)

prebuilts/api/28.0/private/halclientdomain.te

@@ -1,13 +0,0 @@
-###
-### Rules for all domains which are clients of a HAL
-###
-
-# Find out whether a HAL in passthrough/in-process mode or
-# binderized/out-of-process mode
-hwbinder_use(halclientdomain)
-
-# Used to wait for hwservicemanager
-get_prop(halclientdomain, hwservicemanager_prop)
-
-# Wait for HAL server to be up (used by getService)
-allow halclientdomain hidl_manager_hwservice:hwservice_manager find;

prebuilts/api/28.0/private/halserverdomain.te

@@ -1,12 +0,0 @@
-###
-### Rules for all domains which offer a HAL service over HwBinder
-###
-
-# Register the HAL service with hwservicemanager
-hwbinder_use(halserverdomain)
-
-# Find HAL implementations
-allow halserverdomain system_file:dir r_dir_perms;
-
-# Used to wait for hwservicemanager
-get_prop(halserverdomain, hwservicemanager_prop)

prebuilts/api/28.0/private/healthd.te

@@ -1,6 +0,0 @@
-typeattribute healthd coredomain;
-
-init_daemon_domain(healthd)
-
-# Allow healthd to serve health HAL
-hal_server_domain(healthd, hal_health)

prebuilts/api/28.0/private/hwservice_contexts

@@ -1,71 +0,0 @@
-android.frameworks.displayservice::IDisplayService              u:object_r:fwk_display_hwservice:s0
-android.frameworks.schedulerservice::ISchedulingPolicyService   u:object_r:fwk_scheduler_hwservice:s0
-android.frameworks.sensorservice::ISensorManager                u:object_r:fwk_sensor_hwservice:s0
-android.hardware.audio.effect::IEffectsFactory                  u:object_r:hal_audio_hwservice:s0
-android.hardware.audio::IDevicesFactory                         u:object_r:hal_audio_hwservice:s0
-android.hardware.authsecret::IAuthSecret                        u:object_r:hal_authsecret_hwservice:s0
-android.hardware.automotive.audiocontrol::IAudioControl         u:object_r:hal_audiocontrol_hwservice:s0
-android.hardware.automotive.evs::IEvsEnumerator                 u:object_r:hal_evs_hwservice:s0
-android.hardware.automotive.vehicle::IVehicle                   u:object_r:hal_vehicle_hwservice:s0
-android.hardware.biometrics.fingerprint::IBiometricsFingerprint u:object_r:hal_fingerprint_hwservice:s0
-android.hardware.bluetooth::IBluetoothHci                       u:object_r:hal_bluetooth_hwservice:s0
-android.hardware.bluetooth.a2dp::IBluetoothAudioOffload         u:object_r:hal_audio_hwservice:s0
-android.hardware.boot::IBootControl                             u:object_r:hal_bootctl_hwservice:s0
-android.hardware.broadcastradio::IBroadcastRadio                u:object_r:hal_broadcastradio_hwservice:s0
-android.hardware.broadcastradio::IBroadcastRadioFactory         u:object_r:hal_broadcastradio_hwservice:s0
-android.hardware.camera.provider::ICameraProvider               u:object_r:hal_camera_hwservice:s0
-android.hardware.configstore::ISurfaceFlingerConfigs            u:object_r:hal_configstore_ISurfaceFlingerConfigs:s0
-android.hardware.confirmationui::IConfirmationUI                u:object_r:hal_confirmationui_hwservice:s0
-android.hardware.contexthub::IContexthub                        u:object_r:hal_contexthub_hwservice:s0
-android.hardware.cas::IMediaCasService                          u:object_r:hal_cas_hwservice:s0
-android.hardware.drm::ICryptoFactory                            u:object_r:hal_drm_hwservice:s0
-android.hardware.drm::IDrmFactory                               u:object_r:hal_drm_hwservice:s0
-android.hardware.dumpstate::IDumpstateDevice                    u:object_r:hal_dumpstate_hwservice:s0
-android.hardware.gatekeeper::IGatekeeper                        u:object_r:hal_gatekeeper_hwservice:s0
-android.hardware.gnss::IGnss                                    u:object_r:hal_gnss_hwservice:s0
-android.hardware.graphics.allocator::IAllocator                 u:object_r:hal_graphics_allocator_hwservice:s0
-android.hardware.graphics.composer::IComposer                   u:object_r:hal_graphics_composer_hwservice:s0
-android.hardware.graphics.mapper::IMapper                       u:object_r:hal_graphics_mapper_hwservice:s0
-android.hardware.health::IHealth                                u:object_r:hal_health_hwservice:s0
-android.hardware.ir::IConsumerIr                                u:object_r:hal_ir_hwservice:s0
-android.hardware.keymaster::IKeymasterDevice                    u:object_r:hal_keymaster_hwservice:s0
-android.hardware.light::ILight                                  u:object_r:hal_light_hwservice:s0
-android.hardware.lowpan::ILowpanDevice                          u:object_r:hal_lowpan_hwservice:s0
-android.hardware.media.omx::IOmx                                u:object_r:hal_omx_hwservice:s0
-android.hardware.media.omx::IOmxStore                           u:object_r:hal_omx_hwservice:s0
-android.hardware.memtrack::IMemtrack                            u:object_r:hal_memtrack_hwservice:s0
-android.hardware.neuralnetworks::IDevice                        u:object_r:hal_neuralnetworks_hwservice:s0
-android.hardware.nfc::INfc                                      u:object_r:hal_nfc_hwservice:s0
-android.hardware.oemlock::IOemLock                              u:object_r:hal_oemlock_hwservice:s0
-android.hardware.power::IPower                                  u:object_r:hal_power_hwservice:s0
-android.hardware.radio.config::IRadioConfig                     u:object_r:hal_telephony_hwservice:s0
-android.hardware.radio.deprecated::IOemHook                     u:object_r:hal_telephony_hwservice:s0
-android.hardware.radio::IRadio                                  u:object_r:hal_telephony_hwservice:s0
-android.hardware.radio::ISap                                    u:object_r:hal_telephony_hwservice:s0
-android.hardware.renderscript::IDevice                          u:object_r:hal_renderscript_hwservice:s0
-android.hardware.secure_element::ISecureElement                 u:object_r:hal_secure_element_hwservice:s0
-android.hardware.sensors::ISensors                              u:object_r:hal_sensors_hwservice:s0
-android.hardware.soundtrigger::ISoundTriggerHw                  u:object_r:hal_audio_hwservice:s0
-android.hardware.tetheroffload.config::IOffloadConfig           u:object_r:hal_tetheroffload_hwservice:s0
-android.hardware.tetheroffload.control::IOffloadControl         u:object_r:hal_tetheroffload_hwservice:s0
-android.hardware.thermal::IThermal                              u:object_r:hal_thermal_hwservice:s0
-android.hardware.thermal::IThermalCallback                      u:object_r:thermalcallback_hwservice:s0
-android.hardware.tv.cec::IHdmiCec                               u:object_r:hal_tv_cec_hwservice:s0
-android.hardware.tv.input::ITvInput                             u:object_r:hal_tv_input_hwservice:s0
-android.hardware.usb::IUsb                                      u:object_r:hal_usb_hwservice:s0
-android.hardware.usb.gadget::IUsbGadget                         u:object_r:hal_usb_gadget_hwservice:s0
-android.hardware.vibrator::IVibrator                            u:object_r:hal_vibrator_hwservice:s0
-android.hardware.vr::IVr                                        u:object_r:hal_vr_hwservice:s0
-android.hardware.weaver::IWeaver                                u:object_r:hal_weaver_hwservice:s0
-android.hardware.wifi::IWifi                                    u:object_r:hal_wifi_hwservice:s0
-android.hardware.wifi.hostapd::IHostapd                         u:object_r:hal_wifi_hostapd_hwservice:s0
-android.hardware.wifi.offload::IOffload                         u:object_r:hal_wifi_offload_hwservice:s0
-android.hardware.wifi.supplicant::ISupplicant                   u:object_r:hal_wifi_supplicant_hwservice:s0
-android.hidl.allocator::IAllocator                              u:object_r:hidl_allocator_hwservice:s0
-android.hidl.base::IBase                                        u:object_r:hidl_base_hwservice:s0
-android.hidl.manager::IServiceManager                           u:object_r:hidl_manager_hwservice:s0
-android.hidl.memory::IMapper                                    u:object_r:hidl_memory_hwservice:s0
-android.hidl.token::ITokenManager                               u:object_r:hidl_token_hwservice:s0
-android.system.net.netd::INetd                                  u:object_r:system_net_netd_hwservice:s0
-android.system.wifi.keystore::IKeystore                         u:object_r:system_wifi_keystore_hwservice:s0
-*                                                               u:object_r:default_android_hwservice:s0

prebuilts/api/28.0/private/hwservicemanager.te

@@ -1,8 +0,0 @@
-typeattribute hwservicemanager coredomain;
-
-init_daemon_domain(hwservicemanager)
-
-add_hwservice(hwservicemanager, hidl_manager_hwservice)
-add_hwservice(hwservicemanager, hidl_token_hwservice)
-
-set_prop(hwservicemanager, ctl_interface_start_prop)

prebuilts/api/28.0/private/idmap.te

@@ -1 +0,0 @@
-typeattribute idmap coredomain;

prebuilts/api/28.0/private/incident.te

@@ -1,30 +0,0 @@
-typeattribute incident coredomain;
-
-type incident_exec, exec_type, file_type;
-
-# switch to incident domain for incident command
-domain_auto_trans(shell, incident_exec, incident)
-
-# allow incident access to stdout from its parent shell.
-allow incident shell:fd use;
-
-# allow incident be able to output data for CTS to fetch.
-allow incident devpts:chr_file { read write };
-
-# allow incident to communicate use, read and write over the adb
-# connection.
-allow incident adbd:fd use;
-allow incident adbd:unix_stream_socket { read write };
-
-# allow adbd to reap incident
-allow incident adbd:process { sigchld };
-
-# Allow the incident command to talk to the incidentd over the binder, and get
-# back the incident report data from a ParcelFileDescriptor.
-binder_use(incident)
-allow incident incident_service:service_manager find;
-binder_call(incident, incidentd)
-allow incident incidentd:fifo_file write;
-
-# only allow incident being called by shell
-neverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };

prebuilts/api/28.0/private/incident_helper.te

@@ -1,14 +0,0 @@
-typeattribute incident_helper coredomain;
-
-type incident_helper_exec, exec_type, file_type;
-
-# switch to incident_helper domain for incident_helper command
-domain_auto_trans(incidentd, incident_helper_exec, incident_helper)
-
-# use pipe to transmit data from/to incidentd/incident_helper for parsing
-allow incident_helper { shell incident incidentd }:fd use;
-allow incident_helper { shell incident incidentd }:fifo_file { getattr read write };
-allow incident_helper incidentd:unix_stream_socket { read write };
-
-# only allow incidentd and shell to call incident_helper
-neverallow { domain -incidentd -incident_helper -shell } incident_helper_exec:file { execute execute_no_trans };

prebuilts/api/28.0/private/incidentd.te

@@ -1,166 +0,0 @@
-typeattribute incidentd coredomain;
-typeattribute incidentd mlstrustedsubject;
-
-init_daemon_domain(incidentd)
-type incidentd_exec, exec_type, file_type;
-binder_use(incidentd)
-wakelock_use(incidentd)
-
-# Allow incidentd to scan through /proc/pid for all processes
-r_dir_file(incidentd, domain)
-
-# Allow incidentd to kill incident_helper when timeout
-allow incidentd incident_helper:process sigkill;
-
-# Allow executing files on system, such as:
-#   /system/bin/toolbox
-#   /system/bin/logcat
-#   /system/bin/dumpsys
-allow incidentd system_file:file execute_no_trans;
-allow incidentd toolbox_exec:file rx_file_perms;
-
-# section id 2001, allow reading /proc/pagetypeinfo
-allow incidentd proc_pagetypeinfo:file r_file_perms;
-
-# section id 2002, allow reading /d/wakeup_sources
-allow incidentd debugfs_wakeup_sources:file r_file_perms;
-
-# section id 2003, allow executing top
-allow incidentd proc_meminfo:file { open read };
-
-# section id 2004, allow reading /sys/devices/system/cpu/cpufreq/all_time_in_state
-allow incidentd sysfs_devices_system_cpu:file r_file_perms;
-
-# section id 2005, allow reading ps dump in full
-allow incidentd domain:process getattr;
-
-# section id 2006, allow reading /sys/class/power_supply/bms/battery_type
-allow incidentd sysfs_batteryinfo:dir { search };
-allow incidentd sysfs_batteryinfo:file r_file_perms;
-
-# section id 2007, allow reading LAST_KMSG /sys/fs/pstore/console-ramoops
-userdebug_or_eng(`allow incidentd pstorefs:dir search');
-userdebug_or_eng(`allow incidentd pstorefs:file r_file_perms');
-
-# Create and write into /data/misc/incidents
-allow incidentd incident_data_file:dir rw_dir_perms;
-allow incidentd incident_data_file:file create_file_perms;
-
-# Enable incidentd to get stack traces.
-binder_use(incidentd)
-hwbinder_use(incidentd)
-allow incidentd hwservicemanager:hwservice_manager { list };
-get_prop(incidentd, hwservicemanager_prop)
-allow incidentd hidl_manager_hwservice:hwservice_manager { find };
-
-# Read files in /proc
-allow incidentd {
-  proc_cmdline
-  proc_pipe_conf
-  proc_stat
-}:file r_file_perms;
-
-# Signal java processes to dump their stack and get the results
-allow incidentd { appdomain ephemeral_app system_server }:process signal;
-
-# Signal native processes to dump their stack.
-# This list comes from native_processes_to_dump in incidentd/utils.c
-allow incidentd {
-  # This list comes from native_processes_to_dump in dumputils/dump_utils.cpp
-  audioserver
-  cameraserver
-  drmserver
-  inputflinger
-  mediadrmserver
-  mediaextractor
-  mediametrics
-  mediaserver
-  sdcardd
-  statsd
-  surfaceflinger
-
-  # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.cpp
-  hal_audio_server
-  hal_bluetooth_server
-  hal_camera_server
-  hal_graphics_composer_server
-  hal_sensors_server
-  hal_vr_server
-  mediacodec # TODO(b/36375899): hal_omx_server
-}:process signal;
-
-# Allow incidentd to make binder calls to any binder service
-binder_call(incidentd, system_server)
-binder_call(incidentd, appdomain)
-
-# Reading /proc/PID/maps of other processes
-userdebug_or_eng(`allow incidentd self:global_capability_class_set { sys_ptrace }');
-# incidentd has capability sys_ptrace, but should only use that capability for
-# accessing sensitive /proc/PID files, never for using ptrace attach.
-neverallow incidentd *:process ptrace;
-
-allow incidentd self:global_capability_class_set {
-    # Send signals to processes
-    kill
-};
-
-# Connect to tombstoned to intercept dumps.
-unix_socket_connect(incidentd, tombstoned_intercept, tombstoned)
-
-# Run a shell.
-allow incidentd shell_exec:file rx_file_perms;
-
-# logd access - work to be done is a PII safe log (possibly an event log?)
-userdebug_or_eng(`read_logd(incidentd)')
-# TODO control_logd(incidentd)
-
-# Allow incidentd to find these standard groups of services.
-# Others can be allowlisted individually.
-allow incidentd {
-  system_server_service
-  app_api_service
-  system_api_service
-}:service_manager find;
-
-# Only incidentd can publish the binder service
-add_service(incidentd, incident_service)
-
-# Allow pipes from (and only from) incident
-allow incidentd incident:fd use;
-allow incidentd incident:fifo_file write;
-
-# Allow incident to call back to incident with status updates.
-binder_call(incidentd, incident)
-
-###
-### neverallow rules
-###
-
-# only system_server, system_app and incident command can find the incident service
-neverallow {
-  domain
-  -incident
-  -incidentd
-  -statsd
-  -system_app
-  -system_server
-} incident_service:service_manager find;
-
-# only incidentd and the other root services in limited circumstances
-# can get to the files in /data/misc/incidents
-#
-# write, execute, append are forbidden almost everywhere
-neverallow { domain -incidentd -init -vold } incident_data_file:file {
-  w_file_perms
-  x_file_perms
-  create
-  rename
-  setattr
-  unlink
-  append
-};
-# read is also allowed by system_server, for when the file is handed to dropbox
-neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms;
-# limited access to the directory itself
-neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms;
-

prebuilts/api/28.0/private/init.te

@@ -1,22 +0,0 @@
-typeattribute init coredomain;
-
-tmpfs_domain(init)
-
-# Transitions to seclabel processes in init.rc
-domain_trans(init, rootfs, charger)
-domain_trans(init, rootfs, healthd)
-domain_trans(init, rootfs, slideshow)
-domain_auto_trans(init, e2fs_exec, e2fs)
-recovery_only(`
-  domain_trans(init, rootfs, adbd)
-  domain_trans(init, rootfs, recovery)
-')
-domain_trans(init, shell_exec, shell)
-domain_trans(init, init_exec, ueventd)
-domain_trans(init, init_exec, watchdogd)
-domain_trans(init, init_exec, vendor_init)
-domain_trans(init, { rootfs toolbox_exec }, modprobe)
-# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
-userdebug_or_eng(`
-  domain_auto_trans(init, logcat_exec, logpersist)
-')

prebuilts/api/28.0/private/initial_sid_contexts

@@ -1,27 +0,0 @@
-sid kernel u:r:kernel:s0
-sid security u:object_r:kernel:s0
-sid unlabeled u:object_r:unlabeled:s0
-sid fs u:object_r:labeledfs:s0
-sid file u:object_r:unlabeled:s0
-sid file_labels u:object_r:unlabeled:s0
-sid init u:object_r:unlabeled:s0
-sid any_socket u:object_r:unlabeled:s0
-sid port u:object_r:port:s0
-sid netif u:object_r:netif:s0
-sid netmsg u:object_r:unlabeled:s0
-sid node u:object_r:node:s0
-sid igmp_packet u:object_r:unlabeled:s0
-sid icmp_socket u:object_r:unlabeled:s0
-sid tcp_socket u:object_r:unlabeled:s0
-sid sysctl_modprobe u:object_r:unlabeled:s0
-sid sysctl u:object_r:proc:s0
-sid sysctl_fs u:object_r:unlabeled:s0
-sid sysctl_kernel u:object_r:unlabeled:s0
-sid sysctl_net u:object_r:unlabeled:s0
-sid sysctl_net_unix u:object_r:unlabeled:s0
-sid sysctl_vm u:object_r:unlabeled:s0
-sid sysctl_dev u:object_r:unlabeled:s0
-sid kmod u:object_r:unlabeled:s0
-sid policy u:object_r:unlabeled:s0
-sid scmp_packet u:object_r:unlabeled:s0
-sid devnull u:object_r:null_device:s0

prebuilts/api/28.0/private/initial_sids

@@ -1,35 +0,0 @@
-# FLASK
-
-#
-# Define initial security identifiers
-#
-
-sid kernel
-sid security
-sid unlabeled
-sid fs
-sid file
-sid file_labels
-sid init
-sid any_socket
-sid port
-sid netif
-sid netmsg
-sid node
-sid igmp_packet
-sid icmp_socket
-sid tcp_socket
-sid sysctl_modprobe
-sid sysctl
-sid sysctl_fs
-sid sysctl_kernel
-sid sysctl_net
-sid sysctl_net_unix
-sid sysctl_vm
-sid sysctl_dev
-sid kmod
-sid policy
-sid scmp_packet
-sid devnull
-
-# FLASK

prebuilts/api/28.0/private/inputflinger.te

@@ -1,3 +0,0 @@
-typeattribute inputflinger coredomain;
-
-init_daemon_domain(inputflinger)

prebuilts/api/28.0/private/install_recovery.te

@@ -1,3 +0,0 @@
-typeattribute install_recovery coredomain;
-
-init_daemon_domain(install_recovery)

prebuilts/api/28.0/private/installd.te

@@ -1,22 +0,0 @@
-typeattribute installd coredomain;
-
-init_daemon_domain(installd)
-
-# Run dex2oat in its own sandbox.
-domain_auto_trans(installd, dex2oat_exec, dex2oat)
-
-# Run dexoptanalyzer in its own sandbox.
-domain_auto_trans(installd, dexoptanalyzer_exec, dexoptanalyzer)
-
-# Run profman in its own sandbox.
-domain_auto_trans(installd, profman_exec, profman)
-
-# Run idmap in its own sandbox.
-domain_auto_trans(installd, idmap_exec, idmap)
-
-# Create /data/.layout_version.* file
-type_transition installd system_data_file:file install_data_file;
-
-# For collecting bugreports.
-allow installd dumpstate:fd use;
-allow installd dumpstate:fifo_file r_file_perms;

prebuilts/api/28.0/private/isolated_app.te

@@ -1,119 +0,0 @@
-###
-### Services with isolatedProcess=true in their manifest.
-###
-### This file defines the rules for isolated apps. An "isolated
-### app" is an APP with UID between AID_ISOLATED_START (99000)
-### and AID_ISOLATED_END (99999).
-###
-
-typeattribute isolated_app coredomain;
-
-app_domain(isolated_app)
-
-# Access already open app data files received over Binder or local socket IPC.
-allow isolated_app app_data_file:file { append read write getattr lock };
-
-allow isolated_app activity_service:service_manager find;
-allow isolated_app display_service:service_manager find;
-allow isolated_app webviewupdate_service:service_manager find;
-
-# Google Breakpad (crash reporter for Chrome) relies on ptrace
-# functionality. Without the ability to ptrace, the crash reporter
-# tool is broken.
-# b/20150694
-# https://code.google.com/p/chromium/issues/detail?id=475270
-allow isolated_app self:process ptrace;
-
-# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps
-# by other processes. Open should never be allowed, and is blocked by
-# neverallow rules below.
-# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs
-# is modified to change the secontext when accessing the lower filesystem.
-allow isolated_app { sdcard_type media_rw_data_file }:file { read write append getattr lock };
-
-# For webviews, isolated_app processes can be forked from the webview_zygote
-# in addition to the zygote. Allow access to resources inherited from the
-# webview_zygote process. These rules are specialized copies of the ones in app.te.
-# Inherit FDs from the webview_zygote.
-allow isolated_app webview_zygote:fd use;
-# Notify webview_zygote of child death.
-allow isolated_app webview_zygote:process sigchld;
-# Inherit logd write socket.
-allow isolated_app webview_zygote:unix_dgram_socket write;
-# Read system properties managed by webview_zygote.
-allow isolated_app webview_zygote_tmpfs:file read;
-
-# TODO (b/63631799) fix this access
-# suppress denials to /data/local/tmp
-dontaudit isolated_app shell_data_file:dir search;
-
-# Write app-specific trace data to the Perfetto traced damon. This requires
-# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow isolated_app traced:fd use;
-allow isolated_app traced_tmpfs:file { read write getattr map };
-unix_socket_connect(isolated_app, traced_producer, traced)
-
-#####
-##### Neverallow
-#####
-
-# Do not allow isolated_app to directly open tun_device
-neverallow isolated_app tun_device:chr_file open;
-
-# Isolated apps should not directly open app data files themselves.
-neverallow isolated_app app_data_file:file open;
-
-# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
-# TODO: are there situations where isolated_apps write to this file?
-# TODO: should we tighten these restrictions further?
-neverallow isolated_app anr_data_file:file ~{ open append };
-neverallow isolated_app anr_data_file:dir ~search;
-
-# Isolated apps must not be permitted to use HwBinder
-neverallow isolated_app hwbinder_device:chr_file *;
-neverallow isolated_app *:hwservice_manager *;
-
-# Isolated apps must not be permitted to use VndBinder
-neverallow isolated_app vndbinder_device:chr_file *;
-
-# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager
-# except the find actions for services allowlisted below.
-neverallow isolated_app *:service_manager ~find;
-
-# b/17487348
-# Isolated apps can only access three services,
-# activity_service, display_service and webviewupdate_service.
-neverallow isolated_app {
-    service_manager_type
-    -activity_service
-    -display_service
-    -webviewupdate_service
-}:service_manager find;
-
-# Isolated apps shouldn't be able to access the driver directly.
-neverallow isolated_app gpu_device:chr_file { rw_file_perms execute };
-
-# Do not allow isolated_app access to /cache
-neverallow isolated_app cache_file:dir ~{ r_dir_perms };
-neverallow isolated_app cache_file:file ~{ read getattr };
-
-# Do not allow isolated_app to access external storage, except for files passed
-# via file descriptors (b/32896414).
-neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr;
-neverallow isolated_app { storage_file mnt_user_file }:file_class_set *;
-neverallow isolated_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *;
-neverallow isolated_app sdcard_type:file ~{ read write append getattr lock };
-
-# Do not allow USB access
-neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;
-
-# Restrict the webview_zygote control socket.
-neverallow isolated_app webview_zygote:sock_file write;
-
-# Limit the /sys files which isolated_app can access. This is important
-# for controlling isolated_app attack surface.
-neverallow isolated_app {
-  sysfs_type
-  -sysfs_devices_system_cpu
-  -sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
-}:file no_rw_file_perms;

prebuilts/api/28.0/private/kernel.te

@@ -1,3 +0,0 @@
-typeattribute kernel coredomain;
-
-domain_auto_trans(kernel, init_exec, init)

prebuilts/api/28.0/private/keys.conf

@@ -1,25 +0,0 @@
-#
-# Maps an arbitrary tag [TAGNAME] with the string contents found in
-# TARGET_BUILD_VARIANT. Common convention is to start TAGNAME with an @ and
-# name it after the base file name of the pem file.
-#
-# Each tag (section) then allows one to specify any string found in
-# TARGET_BUILD_VARIANT. Typcially this is user, eng, and userdebug. Another
-# option is to use ALL which will match ANY TARGET_BUILD_VARIANT string.
-#
-
-[@PLATFORM]
-ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/platform.x509.pem
-
-[@MEDIA]
-ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem
-
-[@SHARED]
-ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem
-
-# Example of ALL TARGET_BUILD_VARIANTS
-[@RELEASE]
-ENG       : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
-USER      : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
-USERDEBUG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
-

prebuilts/api/28.0/private/keystore.te

@@ -1,19 +0,0 @@
-typeattribute keystore coredomain;
-
-init_daemon_domain(keystore)
-
-# talk to keymaster
-hal_client_domain(keystore, hal_keymaster)
-
-# talk to confirmationui
-hal_client_domain(keystore, hal_confirmationui)
-
-# This is used for the ConfirmationUI async callback.
-allow keystore platform_app:binder call;
-
-# Offer the Wifi Keystore HwBinder service
-typeattribute keystore wifi_keystore_service_server;
-add_hwservice(keystore, system_wifi_keystore_hwservice)
-
-# Allow to check whether security logging is enabled.
-get_prop(keystore, device_logging_prop)

prebuilts/api/28.0/private/lmkd.te

@@ -1,3 +0,0 @@
-typeattribute lmkd coredomain;
-
-init_daemon_domain(lmkd)

prebuilts/api/28.0/private/logd.te

@@ -1,39 +0,0 @@
-typeattribute logd coredomain;
-
-init_daemon_domain(logd)
-
-# logd is not allowed to write anywhere other than /data/misc/logd, and then
-# only on userdebug or eng builds
-# TODO: deal with tmpfs_domain pub/priv split properly
-neverallow logd {
-  file_type
-  -logd_tmpfs
-  -runtime_event_log_tags_file
-  userdebug_or_eng(`-coredump_file -misc_logd_file')
-}:file { create write append };
-
-# protect the event-log-tags file
-neverallow {
-  domain
-  -appdomain # covered below
-  -bootstat
-  -dumpstate
-  -init
-  -logd
-  userdebug_or_eng(`-logpersist')
-  -servicemanager
-  -system_server
-  -surfaceflinger
-  -zygote
-} runtime_event_log_tags_file:file no_rw_file_perms;
-
-neverallow {
-  appdomain
-  -bluetooth
-  -platform_app
-  -priv_app
-  -radio
-  -shell
-  userdebug_or_eng(`-su')
-  -system_app
-} runtime_event_log_tags_file:file no_rw_file_perms;

prebuilts/api/28.0/private/logpersist.te

@@ -1,24 +0,0 @@
-typeattribute logpersist coredomain;
-
-# android debug log storage in logpersist domains (eng and userdebug only)
-userdebug_or_eng(`
-
-  r_dir_file(logpersist, cgroup)
-
-  allow logpersist misc_logd_file:file create_file_perms;
-  allow logpersist misc_logd_file:dir rw_dir_perms;
-
-  allow logpersist self:global_capability_class_set sys_nice;
-  allow logpersist pstorefs:dir search;
-  allow logpersist pstorefs:file r_file_perms;
-
-  control_logd(logpersist)
-  unix_socket_connect(logpersist, logdr, logd)
-  read_runtime_log_tags(logpersist)
-
-')
-
-# logpersist is allowed to write to /data/misc/log for userdebug and eng builds
-neverallow logpersist { file_type userdebug_or_eng(`-misc_logd_file -coredump_file') }:file { create write append };
-neverallow { domain -init userdebug_or_eng(`-logpersist -logd -dumpstate') } misc_logd_file:file no_rw_file_perms;
-neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };

prebuilts/api/28.0/private/mac_permissions.xml

@@ -1,59 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<policy>
-
-<!--
-
-    * A signature is a hex encoded X.509 certificate or a tag defined in
-      keys.conf and is required for each signer tag. The signature can
-      either appear as a set of attached cert child tags or as an attribute.
-    * A signer tag must contain a seinfo tag XOR multiple package stanzas.
-    * Each signer/package tag is allowed to contain one seinfo tag. This tag
-      represents additional info that each app can use in setting a SELinux security
-      context on the eventual process as well as the apps data directory.
-    * seinfo assignments are made according to the following rules:
-      - Stanzas with package name refinements will be checked first.
-      - Stanzas w/o package name refinements will be checked second.
-      - The "default" seinfo label is automatically applied.
-
-    * valid stanzas can take one of the following forms:
-
-     // single cert protecting seinfo
-     <signer signature="@PLATFORM" >
-       <seinfo value="platform" />
-     </signer>
-
-     // multiple certs protecting seinfo (all contained certs must match)
-     <signer>
-       <cert signature="@PLATFORM1"/>
-       <cert signature="@PLATFORM2"/>
-       <seinfo value="platform" />
-     </signer>
-
-     // single cert protecting explicitly named app
-     <signer signature="@PLATFORM" >
-       <package name="com.android.foo">
-         <seinfo value="bar" />
-       </package>
-     </signer>
-
-     // multiple certs protecting explicitly named app (all certs must match)
-     <signer>
-       <cert signature="@PLATFORM1"/>
-       <cert signature="@PLATFORM2"/>
-       <package name="com.android.foo">
-         <seinfo value="bar" />
-       </package>
-     </signer>
--->
-
-    <!-- Platform dev key in AOSP -->
-    <signer signature="@PLATFORM" >
-      <seinfo value="platform" />
-    </signer>
-
-    <!-- Media key in AOSP -->
-    <signer signature="@MEDIA" >
-      <seinfo value="media" />
-    </signer>
-
-</policy>

prebuilts/api/28.0/private/mdnsd.te

@@ -1,12 +0,0 @@
-# mdns daemon
-
-typeattribute mdnsd coredomain;
-typeattribute mdnsd mlstrustedsubject;
-
-type mdnsd_exec, exec_type, file_type;
-init_daemon_domain(mdnsd)
-
-net_domain(mdnsd)
-
-# Read from /proc/net
-r_dir_file(mdnsd, proc_net)

prebuilts/api/28.0/private/mediadrmserver.te

@@ -1,8 +0,0 @@
-typeattribute mediadrmserver coredomain;
-
-init_daemon_domain(mediadrmserver)
-
-# allocate and use graphic buffers
-hal_client_domain(mediadrmserver, hal_graphics_allocator)
-auditallow mediadrmserver hal_graphics_allocator_server:binder call;
-

prebuilts/api/28.0/private/mediaextractor.te

@@ -1,3 +0,0 @@
-typeattribute mediaextractor coredomain;
-
-init_daemon_domain(mediaextractor)

prebuilts/api/28.0/private/mediametrics.te

@@ -1,3 +0,0 @@
-typeattribute mediametrics coredomain;
-
-init_daemon_domain(mediametrics)

prebuilts/api/28.0/private/mediaprovider.te

@@ -1,43 +0,0 @@
-###
-### A domain for android.process.media, which contains both
-### MediaProvider and DownloadProvider and associated services.
-###
-
-typeattribute mediaprovider coredomain;
-app_domain(mediaprovider)
-
-# DownloadProvider accesses the network.
-net_domain(mediaprovider)
-
-# DownloadProvider uses /cache.
-allow mediaprovider cache_file:dir create_dir_perms;
-allow mediaprovider cache_file:file create_file_perms;
-# /cache is a symlink to /data/cache on some devices. Allow reading the link.
-allow mediaprovider cache_file:lnk_file r_file_perms;
-# mediaprovider searches through /cache looking for orphans
-# Ignore denials to /cache/recovery and /cache/backup.
-dontaudit mediaprovider cache_private_backup_file:dir getattr;
-dontaudit mediaprovider cache_recovery_file:dir getattr;
-
-# Access external sdcards through /mnt/media_rw
-allow mediaprovider { mnt_media_rw_file }:dir search;
-
-allow mediaprovider app_api_service:service_manager find;
-allow mediaprovider audioserver_service:service_manager find;
-allow mediaprovider drmserver_service:service_manager find;
-allow mediaprovider mediaextractor_service:service_manager find;
-allow mediaprovider mediaserver_service:service_manager find;
-
-# Allow MediaProvider to read/write cached ringtones (opened by system).
-allow mediaprovider ringtone_file:file { getattr read write };
-
-# MtpServer uses /dev/mtp_usb
-allow mediaprovider mtp_device:chr_file rw_file_perms;
-
-# MtpServer uses /dev/usb-ffs/mtp
-allow mediaprovider functionfs:dir search;
-allow mediaprovider functionfs:file rw_file_perms;
-
-# MtpServer sets sys.usb.ffs.mtp.ready
-set_prop(mediaprovider, ffs_prop)
-set_prop(mediaprovider, exported_ffs_prop)

prebuilts/api/28.0/private/mediaserver.te

@@ -1,11 +0,0 @@
-typeattribute mediaserver coredomain;
-
-init_daemon_domain(mediaserver)
-
-# allocate and use graphic buffers
-hal_client_domain(mediaserver, hal_graphics_allocator)
-
-# TODO(b/36375899): Remove this once OMX HAL is attributized and mediaserver is marked as a client
-# of OMX HAL.
-allow mediaserver hal_codec2_hwservice:hwservice_manager find;
-allow mediaserver hal_omx_hwservice:hwservice_manager find;

prebuilts/api/28.0/private/mls

@@ -1,100 +0,0 @@
-#################################################
-# MLS policy constraints
-#
-
-#
-# Process constraints
-#
-
-# Process transition:  Require equivalence unless the subject is trusted.
-mlsconstrain process { transition dyntransition }
-	     ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
-
-# Process read operations: No read up unless trusted.
-mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
-	     (l1 dom l2 or t1 == mlstrustedsubject);
-
-# Process write operations:  Require equivalence unless trusted.
-mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share }
-	     (l1 eq l2 or t1 == mlstrustedsubject);
-
-#
-# Socket constraints
-#
-
-# Create/relabel operations:  Subject must be equivalent to object unless
-# the subject is trusted.  Sockets inherit the range of their creator.
-mlsconstrain socket_class_set { create relabelfrom relabelto }
-	     ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
-
-# Datagram send: Sender must be equivalent to the receiver unless one of them
-# is trusted.
-mlsconstrain unix_dgram_socket { sendto }
-	     (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
-
-# Stream connect:  Client must be equivalent to server unless one of them
-# is trusted.
-mlsconstrain unix_stream_socket { connectto }
-	     (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
-
-#
-# Directory/file constraints
-#
-
-# Create/relabel operations:  Subject must be equivalent to object unless
-# the subject is trusted. Also, files should always be single-level.
-# Do NOT exempt mlstrustedobject types from this constraint.
-mlsconstrain dir_file_class_set { create relabelfrom relabelto }
-	     (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject));
-
-#
-# Constraints for app data files only.
-#
-
-# Only constrain open, not read/write.
-# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc.
-# Subject must dominate object unless the subject is trusted.
-mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir }
-	     (t2 != app_data_file or l1 dom l2 or t1 == mlstrustedsubject);
-mlsconstrain { file lnk_file sock_file } { open setattr unlink link rename }
-	     (t2 != app_data_file or l1 dom l2 or t1 == mlstrustedsubject);
-
-#
-# Constraints for file types other than app data files.
-#
-
-# Read operations: Subject must dominate object unless the subject
-# or the object is trusted.
-mlsconstrain dir { read getattr search }
-	     (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
-
-mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute }
-	     (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
-
-# Write operations: Subject must be equivalent to the object unless the
-# subject or the object is trusted.
-mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir }
-	     (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
-
-mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename }
-	     (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
-
-# Special case for FIFOs.
-# These can be unnamed pipes, in which case they will be labeled with the
-# creating process' label. Thus we also have an exemption when the "object"
-# is a domain type, so that processes can communicate via unnamed pipes
-# passed by binder or local socket IPC.
-mlsconstrain fifo_file { read getattr }
-	     (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
-
-mlsconstrain fifo_file { write setattr append unlink link rename }
-	     (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
-
-#
-# Binder IPC constraints
-#
-# Presently commented out, as apps are expected to call one another.
-# This would only make sense if apps were assigned categories
-# based on allowable communications rather than per-app categories.
-#mlsconstrain binder call
-#	(l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);

prebuilts/api/28.0/private/mls_decl

@@ -1,10 +0,0 @@
-#########################################
-# MLS declarations
-#
-
-# Generate the desired number of sensitivities and categories.
-gen_sens(mls_num_sens)
-gen_cats(mls_num_cats)
-
-# Generate level definitions for each sensitivity and category.
-gen_levels(mls_num_sens,mls_num_cats)

prebuilts/api/28.0/private/mls_macros

@@ -1,54 +0,0 @@
-########################################
-#
-# gen_cats(N)
-#
-# declares categores c0 to c(N-1)
-#
-define(`decl_cats',`dnl
-category c$1;
-ifelse(`$1',`$2',,`decl_cats(incr($1),$2)')dnl
-')
-
-define(`gen_cats',`decl_cats(0,decr($1))')
-
-########################################
-#
-# gen_sens(N)
-#
-# declares sensitivites s0 to s(N-1) with dominance
-# in increasing numeric order with s0 lowest, s(N-1) highest
-#
-define(`decl_sens',`dnl
-sensitivity s$1;
-ifelse(`$1',`$2',,`decl_sens(incr($1),$2)')dnl
-')
-
-define(`gen_dominance',`s$1 ifelse(`$1',`$2',,`gen_dominance(incr($1),$2)')')
-
-define(`gen_sens',`
-# Each sensitivity has a name and zero or more aliases.
-decl_sens(0,decr($1))
-
-# Define the ordering of the sensitivity levels (least to greatest)
-dominance { gen_dominance(0,decr($1)) }
-')
-
-########################################
-#
-# gen_levels(N,M)
-#
-# levels from s0 to (N-1) with categories c0 to (M-1)
-#
-define(`decl_levels',`dnl
-level s$1:c0.c$3;
-ifelse(`$1',`$2',,`decl_levels(incr($1),$2,$3)')dnl
-')
-
-define(`gen_levels',`decl_levels(0,decr($1),decr($2))')
-
-########################################
-#
-# Basic level names for system low and high
-#
-define(`mls_systemlow',`s0')
-define(`mls_systemhigh',`s`'decr(mls_num_sens):c0.c`'decr(mls_num_cats)')

prebuilts/api/28.0/private/modprobe.te

@@ -1 +0,0 @@
-typeattribute modprobe coredomain;

prebuilts/api/28.0/private/mtp.te

@@ -1,3 +0,0 @@
-typeattribute mtp coredomain;
-
-init_daemon_domain(mtp)

prebuilts/api/28.0/private/net.te

@@ -1,24 +0,0 @@
-###
-### Domain with network access
-###
-
-# Use network sockets.
-allow netdomain self:tcp_socket create_stream_socket_perms;
-allow netdomain self:{ udp_socket rawip_socket } create_socket_perms;
-# Connect to ports.
-allow netdomain port_type:tcp_socket name_connect;
-# Bind to ports.
-allow {netdomain -ephemeral_app} node_type:{ tcp_socket udp_socket } node_bind;
-allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
-allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
-# See changes to the routing table.
-allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };
-
-# Talks to netd via dnsproxyd socket.
-unix_socket_connect(netdomain, dnsproxyd, netd)
-
-# Talks to netd via fwmarkd socket.
-unix_socket_connect(netdomain, fwmarkd, netd)
-
-# Connect to mdnsd via mdnsd socket.
-unix_socket_connect(netdomain, mdnsd, mdnsd)

prebuilts/api/28.0/private/netd.te

@@ -1,15 +0,0 @@
-typeattribute netd coredomain;
-
-init_daemon_domain(netd)
-
-# Allow netd to spawn dnsmasq in it's own domain
-domain_auto_trans(netd, dnsmasq_exec, dnsmasq)
-
-# Allow netd to start clatd in its own domain
-domain_auto_trans(netd, clatd_exec, clatd)
-
-# Allow netd to start bpfloader_exec in its own domain
-domain_auto_trans(netd, bpfloader_exec, bpfloader)
-
-# give netd permission to setup iptables rule with xt_bpf
-allow netd bpfloader:bpf prog_run;

prebuilts/api/28.0/private/netutils_wrapper.te

@@ -1,41 +0,0 @@
-typeattribute netutils_wrapper coredomain;
-
-r_dir_file(netutils_wrapper, system_file);
-
-# For netutils (ip, iptables, tc)
-allow netutils_wrapper self:global_capability_class_set net_raw;
-
-allow netutils_wrapper system_file:file { execute execute_no_trans };
-allow netutils_wrapper proc_net:file { open read getattr };
-allow netutils_wrapper self:rawip_socket create_socket_perms;
-allow netutils_wrapper self:udp_socket create_socket_perms;
-allow netutils_wrapper self:global_capability_class_set net_admin;
-# ip utils need everything but ioctl
-allow netutils_wrapper self:netlink_route_socket ~ioctl;
-allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
-
-# For netutils (ndc) to be able to talk to netd
-allow netutils_wrapper netd_socket:sock_file { open getattr read write append };
-allow netutils_wrapper netd:unix_stream_socket { read getattr connectto };
-
-# For vendor code that update the iptables rules at runtime. They need to reload
-# the whole chain including the xt_bpf rules. They need to access to the pinned
-# program when reloading the rule.
-allow netutils_wrapper fs_bpf:dir search;
-allow netutils_wrapper fs_bpf:file { read write };
-allow netutils_wrapper bpfloader:bpf prog_run;
-
-# For /data/misc/net access to ndc and ip
-r_dir_file(netutils_wrapper, net_data_file)
-
-domain_auto_trans({
-    domain
-    -coredomain
-    -appdomain
-}, netutils_wrapper_exec, netutils_wrapper)
-
-# suppress spurious denials
-dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
-
-# netutils wrapper may only use the following capabilities.
-neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };

prebuilts/api/28.0/private/nfc.te

@@ -1,34 +0,0 @@
-# nfc subsystem
-typeattribute nfc coredomain;
-app_domain(nfc)
-net_domain(nfc)
-
-binder_service(nfc)
-add_service(nfc, nfc_service)
-
-hal_client_domain(nfc, hal_nfc)
-
-# Data file accesses.
-allow nfc nfc_data_file:dir create_dir_perms;
-allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
-
-# SoundPool loading and playback
-allow nfc audioserver_service:service_manager find;
-allow nfc drmserver_service:service_manager find;
-allow nfc mediacodec_service:service_manager find;
-allow nfc mediametrics_service:service_manager find;
-allow nfc mediaextractor_service:service_manager find;
-allow nfc mediaserver_service:service_manager find;
-
-allow nfc radio_service:service_manager find;
-allow nfc app_api_service:service_manager find;
-allow nfc system_api_service:service_manager find;
-allow nfc vr_manager_service:service_manager find;
-allow nfc secure_element_service:service_manager find;
-
-set_prop(nfc, nfc_prop);
-
-# already open bugreport file descriptors may be shared with
-# the nfc process, from a file in
-# /data/data/com.android.shell/files/bugreports/bugreport-*.
-allow nfc shell_data_file:file read;

prebuilts/api/28.0/private/otapreopt_chroot.te

@@ -1,4 +0,0 @@
-typeattribute otapreopt_chroot coredomain;
-
-# Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
-domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)

prebuilts/api/28.0/private/otapreopt_slot.te

@@ -1,5 +0,0 @@
-typeattribute otapreopt_slot coredomain;
-
-# Technically not a daemon but we do want the transition from init domain to
-# cppreopts to occur.
-init_daemon_domain(otapreopt_slot)

prebuilts/api/28.0/private/perfetto.te

@@ -1,68 +0,0 @@
-# Perfetto command-line client. Can be used only from the domains that are
-# explicitly allowlisted with a domain_auto_trans(X, perfetto_exec, perfetto).
-# This command line client accesses the privileged socket of the traced
-# daemon.
-
-type perfetto, domain, coredomain;
-type perfetto_exec, exec_type, file_type;
-
-tmpfs_domain(perfetto);
-
-# Allow to access traced's privileged consumer socket.
-unix_socket_connect(perfetto, traced_consumer, traced)
-
-# Allow to write and unlink traces into /data/misc/perfetto-traces.
-allow perfetto perfetto_traces_data_file:dir rw_dir_perms;
-allow perfetto perfetto_traces_data_file:file create_file_perms;
-
-# Allow to access binder to pass the traces to Dropbox.
-binder_use(perfetto)
-binder_call(perfetto, system_server)
-allow perfetto dropbox_service:service_manager find;
-
-# Allow statsd and shell to pipe the trace config to perfetto on stdin and to
-# print out on stdout/stderr.
-allow perfetto statsd:fd use;
-allow perfetto statsd:fifo_file { getattr read write };
-allow perfetto shell:fd use;
-allow perfetto shell:fifo_file { getattr read write };
-
-# Allow to communicate use, read and write over the adb connection.
-allow perfetto adbd:fd use;
-allow perfetto adbd:unix_stream_socket { read write };
-
-# allow adbd to reap perfetto
-allow perfetto adbd:process { sigchld };
-
-# Allow to access /dev/pts when launched in an adb shell.
-allow perfetto devpts:chr_file rw_file_perms;
-
-###
-### Neverallow rules
-###
-### perfetto should NEVER do any of this
-
-# Disallow mapping executable memory (execstack and exec are already disallowed
-# globally in domain.te).
-neverallow perfetto self:process execmem;
-
-# Block device access.
-neverallow perfetto dev_type:blk_file { read write };
-
-# ptrace any other process
-neverallow perfetto domain:process ptrace;
-
-# Disallows access to other /data files.
-neverallow perfetto {
-  data_file_type
-  -system_data_file
-  # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
-  # neverallow. Currently only getattr and search are allowed.
-  -vendor_data_file
-  -zoneinfo_data_file
-  -perfetto_traces_data_file
-}:dir *;
-neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search };
-neverallow perfetto zoneinfo_data_file:dir ~r_dir_perms;
-neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:lnk_file *;
-neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:file ~write;

prebuilts/api/28.0/private/performanced.te

@@ -1,3 +0,0 @@
-typeattribute performanced coredomain;
-
-init_daemon_domain(performanced)

prebuilts/api/28.0/private/perfprofd.te

@@ -1,8 +0,0 @@
-userdebug_or_eng(`
-  typeattribute perfprofd coredomain;
-  init_daemon_domain(perfprofd)
-')
-
-# Only servicemanager, statsd, su and systemserver can communicate.
-neverallow { domain userdebug_or_eng(`-statsd') } perfprofd:binder call;
-neverallow perfprofd { domain userdebug_or_eng(`-servicemanager -statsd -su -system_server') }:binder call;

prebuilts/api/28.0/private/platform_app.te

@@ -1,85 +0,0 @@
-###
-### Apps signed with the platform key.
-###
-
-typeattribute platform_app coredomain;
-
-app_domain(platform_app)
-
-# Access the network.
-net_domain(platform_app)
-# Access bluetooth.
-bluetooth_domain(platform_app)
-# Read from /data/local/tmp or /data/data/com.android.shell.
-allow platform_app shell_data_file:dir search;
-allow platform_app shell_data_file:file { open getattr read };
-allow platform_app icon_file:file { open getattr read };
-# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
-# created by system server.
-allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
-allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
-allow platform_app apk_private_data_file:dir search;
-# ASEC
-allow platform_app asec_apk_file:dir create_dir_perms;
-allow platform_app asec_apk_file:file create_file_perms;
-
-# Access to /data/media.
-allow platform_app media_rw_data_file:dir create_dir_perms;
-allow platform_app media_rw_data_file:file create_file_perms;
-
-# Write to /cache.
-allow platform_app cache_file:dir create_dir_perms;
-allow platform_app cache_file:file create_file_perms;
-
-# Direct access to vold-mounted storage under /mnt/media_rw
-# This is a performance optimization that allows platform apps to bypass the FUSE layer
-allow platform_app mnt_media_rw_file:dir r_dir_perms;
-allow platform_app sdcard_type:dir create_dir_perms;
-allow platform_app sdcard_type:file create_file_perms;
-
-# com.android.systemui
-allow platform_app rootfs:dir getattr;
-
-# com.android.captiveportallogin reads /proc/vmstat
-allow platform_app {
-  proc_vmstat
-}:file r_file_perms;
-
-allow platform_app audioserver_service:service_manager find;
-allow platform_app cameraserver_service:service_manager find;
-allow platform_app drmserver_service:service_manager find;
-allow platform_app mediaserver_service:service_manager find;
-allow platform_app mediametrics_service:service_manager find;
-allow platform_app mediaextractor_service:service_manager find;
-allow platform_app mediacodec_service:service_manager find;
-allow platform_app mediadrmserver_service:service_manager find;
-allow platform_app persistent_data_block_service:service_manager find;
-allow platform_app radio_service:service_manager find;
-allow platform_app thermal_service:service_manager find;
-allow platform_app timezone_service:service_manager find;
-allow platform_app app_api_service:service_manager find;
-allow platform_app system_api_service:service_manager find;
-allow platform_app vr_manager_service:service_manager find;
-
-# Access to /data/preloads
-allow platform_app preloads_data_file:file r_file_perms;
-allow platform_app preloads_data_file:dir r_dir_perms;
-allow platform_app preloads_media_file:file r_file_perms;
-allow platform_app preloads_media_file:dir r_dir_perms;
-
-read_runtime_log_tags(platform_app)
-
-# allow platform apps to use UDP sockets provided by the system server but not
-# modify them other than to connect
-allow platform_app system_server:udp_socket {
-        connect getattr read recvfrom sendto write getopt setopt };
-
-# allow platform apps to connect to the property service
-set_prop(platform_app, test_boot_reason_prop)
-
-###
-### Neverallow rules
-###
-
-# app domains which access /dev/fuse should not run as platform_app
-neverallow platform_app fuse_device:chr_file *;

prebuilts/api/28.0/private/policy_capabilities

@@ -1,13 +0,0 @@
-# Enable new networking controls.
-policycap network_peer_controls;
-
-# Enable open permission check.
-policycap open_perms;
-
-# Enable separate security classes for
-# all network address families previously
-# mapped to the socket class and for
-# ICMP and SCTP sockets previously mapped
-# to the rawip_socket class.
-policycap extended_socket_class;
-

prebuilts/api/28.0/private/port_contexts

@@ -1,3 +0,0 @@
-# portcon statements go here, e.g.
-# portcon tcp 80 u:object_r:http_port:s0
-

prebuilts/api/28.0/private/postinstall.te

@@ -1,3 +0,0 @@
-typeattribute postinstall coredomain;
-
-domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)

prebuilts/api/28.0/private/postinstall_dexopt.te

@@ -1,5 +0,0 @@
-typeattribute postinstall_dexopt coredomain;
-
-# Run dex2oat/patchoat in its own sandbox.
-# We have to manually transition, as we don't have an entrypoint.
-domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)

prebuilts/api/28.0/private/ppp.te

@@ -1,3 +0,0 @@
-typeattribute ppp coredomain;
-
-domain_auto_trans(mtp, ppp_exec, ppp)

prebuilts/api/28.0/private/preopt2cachename.te

@@ -1 +0,0 @@
-typeattribute preopt2cachename coredomain;

prebuilts/api/28.0/private/priv_app.te

@@ -1,206 +0,0 @@
-###
-### A domain for further sandboxing privileged apps.
-###
-
-typeattribute priv_app coredomain;
-app_domain(priv_app)
-
-# Access the network.
-net_domain(priv_app)
-# Access bluetooth.
-bluetooth_domain(priv_app)
-
-# Allow the allocation and use of ptys
-# Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm
-create_pty(priv_app)
-
-# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
-allow priv_app self:process ptrace;
-
-# Some apps ship with shared libraries that they write out
-# to their sandbox directory and then dlopen().
-allow priv_app app_data_file:file execute;
-
-allow priv_app app_api_service:service_manager find;
-allow priv_app audioserver_service:service_manager find;
-allow priv_app cameraserver_service:service_manager find;
-allow priv_app drmserver_service:service_manager find;
-allow priv_app mediacodec_service:service_manager find;
-allow priv_app mediadrmserver_service:service_manager find;
-allow priv_app mediaextractor_service:service_manager find;
-allow priv_app mediametrics_service:service_manager find;
-allow priv_app mediaserver_service:service_manager find;
-allow priv_app network_watchlist_service:service_manager find;
-allow priv_app nfc_service:service_manager find;
-allow priv_app oem_lock_service:service_manager find;
-allow priv_app persistent_data_block_service:service_manager find;
-allow priv_app radio_service:service_manager find;
-allow priv_app recovery_service:service_manager find;
-allow priv_app stats_service:service_manager find;
-allow priv_app system_api_service:service_manager find;
-
-# Write to /cache.
-allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms;
-allow priv_app { cache_file cache_recovery_file }:file create_file_perms;
-# /cache is a symlink to /data/cache on some devices. Allow reading the link.
-allow priv_app cache_file:lnk_file r_file_perms;
-
-# Write to /data/ota_package for OTA packages.
-allow priv_app ota_package_file:dir rw_dir_perms;
-allow priv_app ota_package_file:file create_file_perms;
-
-# Access to /data/media.
-allow priv_app media_rw_data_file:dir create_dir_perms;
-allow priv_app media_rw_data_file:file create_file_perms;
-
-# Used by Finsky / Android "Verify Apps" functionality when
-# running "adb install foo.apk".
-allow priv_app shell_data_file:file r_file_perms;
-allow priv_app shell_data_file:dir r_dir_perms;
-
-# Allow traceur to pass file descriptors through a content provider to betterbug
-allow priv_app trace_data_file:file { getattr read };
-
-# Allow verifier to access staged apks.
-allow priv_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
-allow priv_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
-
-# b/18504118: Allow reads from /data/anr/traces.txt
-allow priv_app anr_data_file:file r_file_perms;
-
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
-  allow priv_app perfprofd_data_file:file r_file_perms;
-  allow priv_app perfprofd_data_file:dir r_dir_perms;
-')
-
-# For AppFuse.
-allow priv_app vold:fd use;
-allow priv_app fuse_device:chr_file { read write };
-
-# /proc access
-allow priv_app {
-  proc_vmstat
-}:file r_file_perms;
-
-allow priv_app sysfs_type:dir search;
-# Read access to /sys/class/net/wlan*/address
-r_dir_file(priv_app, sysfs_net)
-# Read access to /sys/block/zram*/mm_stat
-r_dir_file(priv_app, sysfs_zram)
-
-r_dir_file(priv_app, rootfs)
-
-# Allow GMS core to open kernel config for OTA matching through libvintf
-allow priv_app config_gz:file { open read getattr };
-
-# access the mac address
-allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
-
-# Allow GMS core to communicate with update_engine for A/B update.
-binder_call(priv_app, update_engine)
-allow priv_app update_engine_service:service_manager find;
-
-# Allow GMS core to communicate with dumpsys storaged.
-binder_call(priv_app, storaged)
-allow priv_app storaged_service:service_manager find;
-
-# Allow GMS core to access system_update_service (e.g. to publish pending
-# system update info).
-allow priv_app system_update_service:service_manager find;
-
-# Allow GMS core to communicate with statsd.
-binder_call(priv_app, statsd)
-
-# Allow Phone to read/write cached ringtones (opened by system).
-allow priv_app ringtone_file:file { getattr read write };
-
-# Access to /data/preloads
-allow priv_app preloads_data_file:file r_file_perms;
-allow priv_app preloads_data_file:dir r_dir_perms;
-allow priv_app preloads_media_file:file r_file_perms;
-allow priv_app preloads_media_file:dir r_dir_perms;
-
-# Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
-allow priv_app keystore:keystore_key gen_unique_id;
-
-# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
-allow priv_app selinuxfs:file r_file_perms;
-
-read_runtime_log_tags(priv_app)
-
-# Write app-specific trace data to the Perfetto traced damon. This requires
-# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow priv_app traced:fd use;
-allow priv_app traced_tmpfs:file { read write getattr map };
-unix_socket_connect(priv_app, traced_producer, traced)
-
-# suppress denials for non-API accesses.
-dontaudit priv_app exec_type:file getattr;
-dontaudit priv_app device:dir read;
-dontaudit priv_app fs_bpf:dir search;
-dontaudit priv_app net_dns_prop:file read;
-dontaudit priv_app proc:file read;
-dontaudit priv_app proc_interrupts:file read;
-dontaudit priv_app proc_modules:file read;
-dontaudit priv_app proc_stat:file read;
-dontaudit priv_app proc_version:file read;
-dontaudit priv_app sysfs:dir read;
-dontaudit priv_app sysfs_android_usb:file read;
-dontaudit priv_app wifi_prop:file read;
-dontaudit priv_app { wifi_prop exported_wifi_prop }:file read;
-
-# allow privileged apps to use UDP sockets provided by the system server but not
-# modify them other than to connect
-allow priv_app system_server:udp_socket {
-        connect getattr read recvfrom sendto write getopt setopt };
-
-###
-### neverallow rules
-###
-
-# Receive or send uevent messages.
-neverallow priv_app domain:netlink_kobject_uevent_socket *;
-
-# Receive or send generic netlink messages
-neverallow priv_app domain:netlink_socket *;
-
-# Too much leaky information in debugfs. It's a security
-# best practice to ensure these files aren't readable.
-neverallow priv_app debugfs:file read;
-
-# Do not allow privileged apps to register services.
-# Only trusted components of Android should be registering
-# services.
-neverallow priv_app service_manager_type:service_manager add;
-
-# Do not allow privileged apps to connect to the property service
-# or set properties. b/10243159
-neverallow priv_app property_socket:sock_file write;
-neverallow priv_app init:unix_stream_socket connectto;
-neverallow priv_app property_type:property_service set;
-
-# Do not allow priv_app to be assigned mlstrustedsubject.
-# This would undermine the per-user isolation model being
-# enforced via levelFrom=user in seapp_contexts and the mls
-# constraints.  As there is no direct way to specify a neverallow
-# on attribute assignment, this relies on the fact that fork
-# permission only makes sense within a domain (hence should
-# never be granted to any other domain within mlstrustedsubject)
-# and priv_app is allowed fork permission to itself.
-neverallow priv_app mlstrustedsubject:process fork;
-
-# Do not allow priv_app to hard link to any files.
-# In particular, if priv_app links to other app data
-# files, installd will not be able to guarantee the deletion
-# of the linked to file. Hard links also contribute to security
-# bugs, so we want to ensure priv_app never has this
-# capability.
-neverallow priv_app file_type:file link;
-
-# priv apps should not be able to open trace data files, they should depend
-# upon traceur to pass a file descriptor which they can then read
-neverallow priv_app trace_data_file:dir *;
-neverallow priv_app trace_data_file:file { no_w_file_perms open };

prebuilts/api/28.0/private/profman.te

@@ -1 +0,0 @@
-typeattribute profman coredomain;

prebuilts/api/28.0/private/property_contexts

@@ -1,147 +0,0 @@
-##########################
-# property service keys
-#
-#
-net.rmnet               u:object_r:net_radio_prop:s0
-net.gprs                u:object_r:net_radio_prop:s0
-net.ppp                 u:object_r:net_radio_prop:s0
-net.qmi                 u:object_r:net_radio_prop:s0
-net.lte                 u:object_r:net_radio_prop:s0
-net.cdma                u:object_r:net_radio_prop:s0
-net.dns                 u:object_r:net_dns_prop:s0
-sys.usb.config          u:object_r:system_radio_prop:s0
-ril.                    u:object_r:radio_prop:s0
-ro.ril.                 u:object_r:radio_prop:s0
-gsm.                    u:object_r:radio_prop:s0
-persist.radio           u:object_r:radio_prop:s0
-
-net.                    u:object_r:system_prop:s0
-dev.                    u:object_r:system_prop:s0
-ro.runtime.             u:object_r:system_prop:s0
-ro.runtime.firstboot    u:object_r:firstboot_prop:s0
-hw.                     u:object_r:system_prop:s0
-ro.hw.                  u:object_r:system_prop:s0
-sys.                    u:object_r:system_prop:s0
-sys.cppreopt            u:object_r:cppreopt_prop:s0
-sys.powerctl            u:object_r:powerctl_prop:s0
-sys.usb.ffs.            u:object_r:ffs_prop:s0
-service.                u:object_r:system_prop:s0
-dhcp.                   u:object_r:dhcp_prop:s0
-dhcp.bt-pan.result      u:object_r:pan_result_prop:s0
-bluetooth.              u:object_r:bluetooth_prop:s0
-
-debug.                  u:object_r:debug_prop:s0
-debug.db.               u:object_r:debuggerd_prop:s0
-dumpstate.              u:object_r:dumpstate_prop:s0
-dumpstate.options       u:object_r:dumpstate_options_prop:s0
-log.                    u:object_r:log_prop:s0
-log.tag                 u:object_r:log_tag_prop:s0
-log.tag.WifiHAL         u:object_r:wifi_log_prop:s0
-security.perf_harden    u:object_r:shell_prop:s0
-service.adb.root        u:object_r:shell_prop:s0
-service.adb.tcp.port    u:object_r:shell_prop:s0
-
-persist.audio.          u:object_r:audio_prop:s0
-persist.bluetooth.      u:object_r:bluetooth_prop:s0
-persist.debug.          u:object_r:persist_debug_prop:s0
-persist.logd.           u:object_r:logd_prop:s0
-ro.logd.                u:object_r:logd_prop:s0
-persist.logd.security   u:object_r:device_logging_prop:s0
-persist.logd.logpersistd        u:object_r:logpersistd_logging_prop:s0
-logd.logpersistd        u:object_r:logpersistd_logging_prop:s0
-persist.log.tag         u:object_r:log_tag_prop:s0
-persist.mmc.            u:object_r:mmc_prop:s0
-persist.netd.stable_secret      u:object_r:netd_stable_secret_prop:s0
-persist.sys.            u:object_r:system_prop:s0
-persist.sys.safemode    u:object_r:safemode_prop:s0
-ro.sys.safemode         u:object_r:safemode_prop:s0
-persist.sys.audit_safemode      u:object_r:safemode_prop:s0
-persist.service.        u:object_r:system_prop:s0
-persist.service.bdroid. u:object_r:bluetooth_prop:s0
-persist.security.       u:object_r:system_prop:s0
-persist.traced.enable   u:object_r:traced_enabled_prop:s0
-persist.vendor.overlay.  u:object_r:overlay_prop:s0
-ro.boot.vendor.overlay.  u:object_r:overlay_prop:s0
-ro.boottime.             u:object_r:boottime_prop:s0
-ro.serialno             u:object_r:serialno_prop:s0
-ro.boot.btmacaddr       u:object_r:bluetooth_prop:s0
-ro.boot.serialno        u:object_r:serialno_prop:s0
-ro.bt.                  u:object_r:bluetooth_prop:s0
-ro.boot.bootreason      u:object_r:bootloader_boot_reason_prop:s0
-persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
-sys.boot.reason         u:object_r:system_boot_reason_prop:s0
-pm.                     u:object_r:pm_prop:s0
-test.sys.boot.reason    u:object_r:test_boot_reason_prop:s0
-
-# Boolean property set by system server upon boot indicating
-# if device owner is provisioned.
-ro.device_owner         u:object_r:device_logging_prop:s0
-
-# selinux non-persistent properties
-selinux.restorecon_recursive   u:object_r:restorecon_prop:s0
-
-# default property context
-*                       u:object_r:default_prop:s0
-
-# data partition encryption properties
-vold.                   u:object_r:vold_prop:s0
-ro.crypto.              u:object_r:vold_prop:s0
-
-# ro.build.fingerprint is either set in /system/build.prop, or is
-# set at runtime by system_server.
-ro.build.fingerprint    u:object_r:fingerprint_prop:s0
-
-ro.persistent_properties.ready  u:object_r:persistent_properties_ready_prop:s0
-
-# ctl properties
-ctl.bootanim            u:object_r:ctl_bootanim_prop:s0
-ctl.android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
-ctl.dumpstate           u:object_r:ctl_dumpstate_prop:s0
-ctl.fuse_               u:object_r:ctl_fuse_prop:s0
-ctl.mdnsd               u:object_r:ctl_mdnsd_prop:s0
-ctl.ril-daemon          u:object_r:ctl_rildaemon_prop:s0
-ctl.bugreport           u:object_r:ctl_bugreport_prop:s0
-ctl.console             u:object_r:ctl_console_prop:s0
-ctl.                    u:object_r:ctl_default_prop:s0
-
-# Don't allow blind access to all services
-ctl.sigstop_on$         u:object_r:ctl_sigstop_prop:s0
-ctl.sigstop_off$        u:object_r:ctl_sigstop_prop:s0
-ctl.start$              u:object_r:ctl_start_prop:s0
-ctl.stop$               u:object_r:ctl_stop_prop:s0
-ctl.restart$            u:object_r:ctl_restart_prop:s0
-ctl.interface_start$    u:object_r:ctl_interface_start_prop:s0
-ctl.interface_stop$     u:object_r:ctl_interface_stop_prop:s0
-ctl.interface_restart$  u:object_r:ctl_interface_restart_prop:s0
-
-# NFC properties
-nfc.                    u:object_r:nfc_prop:s0
-
-# These properties are not normally set by processes other than init.
-# They are only distinguished here for setting by qemu-props on the
-# emulator/goldfish.
-config.                 u:object_r:config_prop:s0
-ro.config.              u:object_r:config_prop:s0
-dalvik.                 u:object_r:dalvik_prop:s0
-ro.dalvik.              u:object_r:dalvik_prop:s0
-
-# Shared between system server and wificond
-wlan.                   u:object_r:wifi_prop:s0
-
-# Lowpan properties
-lowpan.                 u:object_r:lowpan_prop:s0
-ro.lowpan.              u:object_r:lowpan_prop:s0
-
-# hwservicemanager properties
-hwservicemanager.       u:object_r:hwservicemanager_prop:s0
-
-# Common default properties for vendor and odm.
-init.svc.odm.           u:object_r:vendor_default_prop:s0
-init.svc.vendor.        u:object_r:vendor_default_prop:s0
-ro.hardware.            u:object_r:vendor_default_prop:s0
-ro.odm.                 u:object_r:vendor_default_prop:s0
-ro.vendor.              u:object_r:vendor_default_prop:s0
-odm.                    u:object_r:vendor_default_prop:s0
-persist.odm.            u:object_r:vendor_default_prop:s0
-persist.vendor.         u:object_r:vendor_default_prop:s0
-vendor.                 u:object_r:vendor_default_prop:s0

prebuilts/api/28.0/private/racoon.te

@@ -1,3 +0,0 @@
-typeattribute racoon coredomain;
-
-init_daemon_domain(racoon)

prebuilts/api/28.0/private/radio.te

@@ -1,5 +0,0 @@
-typeattribute radio coredomain;
-
-app_domain(radio)
-
-read_runtime_log_tags(radio)

prebuilts/api/28.0/private/recovery.te

@@ -1 +0,0 @@
-typeattribute recovery coredomain;