Merge "Fix perfetto CTS test"
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index e8ac336..44d2d63 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -22,6 +22,7 @@
     biometric_service
     bpf_progs_loaded_prop
     bugreport_service
+    cameraserver_data_file
     content_capture_service
     content_suggestions_service
     cpu_variant_prop
@@ -31,6 +32,7 @@
     device_config_input_native_boot_prop
     device_config_netd_native_prop
     device_config_reset_performed_prop
+    device_config_runtime_prop
     device_config_service
     face_service
     face_vendor_data_file
@@ -80,6 +82,7 @@
     network_stack_tmpfs
     overlayfs_file
     permissionmgr_service
+    postinstall_apex_mnt_dir
     recovery_socket
     role_service
     rs
diff --git a/private/file_contexts b/private/file_contexts
index 01c5bb0..89c11bd 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -28,6 +28,7 @@
 /config             u:object_r:rootfs:s0
 /mnt                u:object_r:tmpfs:s0
 /postinstall        u:object_r:postinstall_mnt_dir:s0
+/postinstall/apex   u:object_r:postinstall_apex_mnt_dir:s0
 /proc               u:object_r:rootfs:s0
 /sys                u:object_r:sysfs:s0
 /apex               u:object_r:apex_mnt_dir:s0
@@ -456,6 +457,7 @@
 /data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
 /data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
 /data/misc/camera(/.*)?         u:object_r:camera_data_file:s0
+/data/misc/cameraserver(/.*)?   u:object_r:cameraserver_data_file:s0
 /data/misc/carrierid(/.*)?      u:object_r:radio_data_file:s0
 /data/misc/dhcp(/.*)?           u:object_r:dhcp_data_file:s0
 /data/misc/dhcp-6\.8\.2(/.*)?     u:object_r:dhcp_data_file:s0
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 1cf7efb..87b9cb3 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -195,6 +195,7 @@
 genfscon tracefs /events/sched/sched_wakeup/                             u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/sched/sched_blocked_reason/                     u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/sched/sched_cpu_hotplug/                        u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/sched/sched_process_exit/                       u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/cgroup/                                         u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/power/cpu_frequency/                            u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/power/cpu_idle/                                 u:object_r:debugfs_tracing:s0
@@ -210,11 +211,18 @@
 genfscon tracefs /events/binder/binder_lock/                             u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/binder/binder_locked/                           u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/binder/binder_unlock/                           u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/binder/binder_transaction_alloc_buf/            u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/lowmemorykiller/                                u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/sync/                                           u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/fence/                                          u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/filemap/mm_filemap_add_to_page_cache/           u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/filemap/mm_filemap_delete_from_page_cache/      u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/rss_stat/                                  u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/ion_heap_grow/                             u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/kmem/ion_heap_shrink/                           u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/oom/oom_score_adj_update/                       u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/task/task_rename/                               u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/task/task_newtask/                              u:object_r:debugfs_tracing:s0
 
 genfscon debugfs /tracing/trace_clock                                            u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/buffer_size_kb                                         u:object_r:debugfs_tracing:s0
@@ -226,6 +234,7 @@
 genfscon debugfs /tracing/events/sched/sched_wakeup/                             u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/sched/sched_blocked_reason/                     u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/sched/sched_cpu_hotplug/                        u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/sched/sched_process_exit/                               u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/cgroup/                                         u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/power/cpu_frequency/                            u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/power/cpu_idle/                                 u:object_r:debugfs_tracing:s0
@@ -241,11 +250,18 @@
 genfscon debugfs /tracing/events/binder/binder_lock/                             u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/binder/binder_locked/                           u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/binder/binder_unlock/                           u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/binder/binder_transaction_alloc_buf/                    u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/lowmemorykiller/                                u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/sync/                                           u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/fence/                                          u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/filemap/mm_filemap_add_to_page_cache/           u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/filemap/mm_filemap_delete_from_page_cache/      u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/kmem/rss_stat/                                          u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/kmem/ion_heap_grow/                                     u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/kmem/ion_heap_shrink/                                   u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/oom/oom_score_adj_update/                               u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/task/task_rename/                                       u:object_r:debugfs_tracing:s0
+genfscon debugfs /events/task/task_newtask/                                      u:object_r:debugfs_tracing:s0
 
 genfscon debugfs /kcov								 u:object_r:debugfs_kcov:s0
 
diff --git a/private/netd.te b/private/netd.te
index 92b124f..0421d4a 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -16,3 +16,7 @@
 
 # Allow netd to write to statsd.
 unix_socket_send(netd, statsdw, statsd)
+
+# Allow netd to send callbacks to network_stack
+binder_call(netd, network_stack)
+
diff --git a/private/network_stack.te b/private/network_stack.te
index 9d2f2fb..4b88756 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -17,6 +17,9 @@
 # The DhcpClient uses packet_sockets
 allow network_stack self:packet_socket create_socket_perms_no_ioctl;
 
+# Monitor neighbors via netlink.
+allow network_stack self:netlink_route_socket nlmsg_write;
+
 allow network_stack app_api_service:service_manager find;
 allow network_stack netd_service:service_manager find;
 allow network_stack radio_service:service_manager find;
diff --git a/private/otapreopt_chroot.te b/private/otapreopt_chroot.te
index 070cac6..aea2faa 100644
--- a/private/otapreopt_chroot.te
+++ b/private/otapreopt_chroot.te
@@ -1,6 +1,6 @@
 typeattribute otapreopt_chroot coredomain;
 
-# Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
+# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox.
 domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)
 
 # Allow otapreopt_chroot to create loop devices with /dev/loop-control.
@@ -23,10 +23,14 @@
 
 # Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex.
 allow otapreopt_chroot tmpfs:filesystem mount;
-# Allow otapreopt_chroot to manipulate the tmpfs filesystem mounted in /postinstall/apex.
-allow otapreopt_chroot tmpfs:dir create_dir_perms;
+# Allow otapreopt_chroot to restore the security context of /postinstall/apex.
+allow otapreopt_chroot tmpfs:dir relabelfrom;
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto;
+
+# Allow otapreopt_chroot to manipulate directory /postinstall/apex.
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms;
 # Allow otapreopt_chroot to mount APEX packages in /postinstall/apex.
-allow otapreopt_chroot tmpfs:dir mounton;
+allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton;
 
 # Allow otapreopt_chroot to access /dev/block (needed to detach loop
 # devices used by ext4 images from APEX packages).
diff --git a/private/property_contexts b/private/property_contexts
index 3296a04..303832d 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -172,6 +172,7 @@
 persist.device_config.attempted_boot_count        u:object_r:device_config_boot_count_prop:s0
 persist.device_config.input_native_boot. u:object_r:device_config_input_native_boot_prop:s0
 persist.device_config.netd_native.           u:object_r:device_config_netd_native_prop:s0
+persist.device_config.runtime.           u:object_r:device_config_runtime_prop:s0
 
 apexd.                  u:object_r:apexd_prop:s0
 persist.apexd.          u:object_r:apexd_prop:s0
diff --git a/private/service_contexts b/private/service_contexts
index ba06542..82abfbc 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -151,6 +151,7 @@
 radio.phonesubinfo                        u:object_r:radio_service:s0
 radio.phone                               u:object_r:radio_service:s0
 radio.sms                                 u:object_r:radio_service:s0
+rcs                                       u:object_r:radio_service:s0
 recovery                                  u:object_r:recovery_service:s0
 restrictions                              u:object_r:restrictions_service:s0
 role                                      u:object_r:role_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index 6fa2ae6..1893494 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -585,6 +585,7 @@
 set_prop(system_server, device_config_input_native_boot_prop)
 set_prop(system_server, device_config_netd_native_prop)
 set_prop(system_server, device_config_activity_manager_native_boot_prop)
+set_prop(system_server, device_config_runtime_prop)
 
 # BootReceiver to read ro.boot.bootreason
 get_prop(system_server, bootloader_boot_reason_prop)
@@ -947,6 +948,7 @@
   device_config_activity_manager_native_boot_prop
   device_config_input_native_boot_prop
   device_config_netd_native_prop
+  device_config_runtime_prop
 }:property_service set;
 
 # system_server should never be executing dex2oat. This is either
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
index 7bf5f99..7cccbac 100644
--- a/private/untrusted_app_25.te
+++ b/private/untrusted_app_25.te
@@ -50,7 +50,7 @@
 # for targetApi<=25. This is also allowed for targetAPIs 26, 27,
 # and 28 in untrusted_app_27.te.
 allow untrusted_app_25 app_data_file:file execute_no_trans;
-userdebug_or_eng(`auditallow untrusted_app_25 app_data_file:file { execute execute_no_trans };')
+auditallow untrusted_app_25 app_data_file:file { execute execute_no_trans };
 
 # The ability to invoke dex2oat. Historically required by ART, now only
 # allowed for targetApi<=28 for compat reasons.
diff --git a/private/untrusted_app_27.te b/private/untrusted_app_27.te
index be155c9..0c9c684 100644
--- a/private/untrusted_app_27.te
+++ b/private/untrusted_app_27.te
@@ -30,7 +30,7 @@
 # The ability to call exec() on files in the apps home directories
 # for targetApi 26, 27, and 28.
 allow untrusted_app_27 app_data_file:file execute_no_trans;
-userdebug_or_eng(`auditallow untrusted_app_27 app_data_file:file { execute execute_no_trans };')
+auditallow untrusted_app_27 app_data_file:file { execute execute_no_trans };
 
 # The ability to invoke dex2oat. Historically required by ART, now only
 # allowed for targetApi<=28 for compat reasons.
diff --git a/private/zygote.te b/private/zygote.te
index e23f36e..073b7f8 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -126,6 +126,9 @@
 get_prop(zygote, overlay_prop)
 get_prop(zygote, exported_overlay_prop)
 
+# Allow the zygote to access feature flag properties.
+get_prop(zygote, device_config_runtime_prop)
+
 # ingore spurious denials
 dontaudit zygote self:global_capability_class_set sys_resource;
 
diff --git a/public/cameraserver.te b/public/cameraserver.te
index ba45228..fee4bdb 100644
--- a/public/cameraserver.te
+++ b/public/cameraserver.te
@@ -57,6 +57,16 @@
 allow cameraserver shell:unix_stream_socket { read write };
 allow cameraserver shell:fifo_file { read write };
 
+# Allow to talk with media codec
+allow cameraserver mediametrics_service:service_manager find;
+hal_client_domain(cameraserver, hal_omx)
+hal_client_domain(cameraserver, hal_allocator)
+
+userdebug_or_eng(`
+  allow cameraserver cameraserver_data_file:dir { add_name write search remove_name };
+  allow cameraserver cameraserver_data_file:file { create write open read unlink };
+')
+
 # Allow shell commands from ADB for CTS testing/dumping
 userdebug_or_eng(`
   allow cameraserver su:fd use;
diff --git a/public/dex2oat.te b/public/dex2oat.te
index 7ae1b34..1ea0420 100644
--- a/public/dex2oat.te
+++ b/public/dex2oat.te
@@ -53,7 +53,7 @@
 allow dex2oat postinstall_file:file { execute getattr open };
 
 # Allow dex2oat access to /postinstall/apex.
-allow dex2oat tmpfs:dir search;
+allow dex2oat postinstall_apex_mnt_dir:dir { getattr search };
 
 # Allow dex2oat access to files in /data/ota.
 allow dex2oat ota_data_file:dir ra_dir_perms;
diff --git a/public/file.te b/public/file.te
index 2d26610..a9f4523 100644
--- a/public/file.te
+++ b/public/file.te
@@ -281,6 +281,8 @@
 type postinstall_mnt_dir, file_type;
 # Files inside the /postinstall mountpoint are all labeled as postinstall_file.
 type postinstall_file, file_type;
+# /postinstall/apex: Mount point used for APEX images within /postinstall.
+type postinstall_apex_mnt_dir, file_type;
 
 # /data/misc subdirectories
 type adb_keys_file, file_type, data_file_type, core_data_file_type;
@@ -291,6 +293,7 @@
 type bootstat_data_file, file_type, data_file_type, core_data_file_type;
 type boottrace_data_file, file_type, data_file_type, core_data_file_type;
 type camera_data_file, file_type, data_file_type, core_data_file_type;
+type cameraserver_data_file, file_type, data_file_type, core_data_file_type;
 type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
 type incident_data_file, file_type, data_file_type, core_data_file_type;
 type keychain_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/public/flags_heatlh_check.te b/public/flags_heatlh_check.te
index 835a82a..5070393 100644
--- a/public/flags_heatlh_check.te
+++ b/public/flags_heatlh_check.te
@@ -4,6 +4,7 @@
 
 set_prop(flags_health_check, device_config_boot_count_prop)
 set_prop(flags_health_check, device_config_reset_performed_prop)
+set_prop(flags_health_check, device_config_runtime_prop)
 set_prop(flags_health_check, device_config_input_native_boot_prop)
 set_prop(flags_health_check, device_config_netd_native_prop)
 set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
diff --git a/public/netd.te b/public/netd.te
index 72d8483..a3e6464 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -144,7 +144,7 @@
 
 # apps may not interact with netd over binder.
 neverallow { appdomain -network_stack } netd:binder call;
-neverallow netd { appdomain userdebug_or_eng(`-su') }:binder call;
+neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call;
 
 # persist.netd.stable_secret contains RFC 7217 secret key which should never be
 # leaked to other processes. Make sure it never leaks.
diff --git a/public/postinstall_dexopt.te b/public/postinstall_dexopt.te
index 46a02dd..2fac3e3 100644
--- a/public/postinstall_dexopt.te
+++ b/public/postinstall_dexopt.te
@@ -13,8 +13,8 @@
 allow postinstall_dexopt proc_filesystems:file { getattr open read };
 allow postinstall_dexopt tmpfs:file read;
 
-# Read data from /postinstall/apex.
-allow postinstall_dexopt tmpfs:dir { read search };
+# Allow access to /postinstall/apex.
+allow postinstall_dexopt postinstall_apex_mnt_dir:dir { getattr search };
 
 # Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access
 # here and having to relabel the directory.
diff --git a/public/property.te b/public/property.te
index 379c4d3..04ee593 100644
--- a/public/property.te
+++ b/public/property.te
@@ -33,6 +33,7 @@
 type device_config_reset_performed_prop, property_type;
 type device_config_input_native_boot_prop, property_type;
 type device_config_netd_native_prop, property_type;
+type device_config_runtime_prop, property_type;
 type device_logging_prop, property_type;
 type dhcp_prop, property_type, core_property_type;
 type dumpstate_options_prop, property_type;
@@ -405,6 +406,7 @@
     -device_config_boot_count_prop
     -device_config_input_native_boot_prop
     -device_config_netd_native_prop
+    -device_config_runtime_prop
     -heapprofd_enabled_prop
     -heapprofd_prop
     -hwservicemanager_prop
diff --git a/public/vendor_init.te b/public/vendor_init.te
index d9dc72f..a468dd9 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -179,6 +179,7 @@
       -device_config_reset_performed_prop
       -device_config_input_native_boot_prop
       -device_config_netd_native_prop
+      -device_config_runtime_prop
       -restorecon_prop
       -netd_stable_secret_prop
       -firstboot_prop