commit b87876937b8ed73063fd44800beb86f3dd7079be
author Jeff Vander Stoep <jeffv@google.com> Fri Apr 21 15:57:07 2017 -0700
committer Jeff Vander Stoep <jeffv@google.com> Mon Apr 24 13:43:22 2017 -0700
tree a2e626a3483f7f4263878f4845e830aab904450f
parent 393c8e9438a055e202e2693b91e8931b496695dd

Retain neverallow rules in CIL files

Fixes issue where attributes used exlusively in neverallow
rules were removed from policy.

For on-device compile use the -N flag to skip neverallow tests.

Policy size increases:
vendor/etc/selinux/nonplat_sepolicy.cil 547849 -> 635637
vendor/etc/selinux/precompiled_sepolicy 440248 -> 441076
system/etc/selinux/plat_sepolicy.cil    567664 -> 745230

For a total increase in system/vendor: 266182.

Boot time changes:
Pixel uses precompiled policy so boot time is not impacted.
When forcing on-device compile on Marlin selinux policy compile
time increases 510-520 ms -> 550-560 ms.

Bug: 37357742
Test: Build and boot Marlin.
Test: Verify both precompiled and on-device compile work.
Change-Id: Ib3cb53d376a96e34f55ac27d651a6ce2fabf6ba7