commit b554a950f41452e2ad9d3b4d44aa0231a98e9a2e
author Tri Vo <trong@google.com> Tue Oct 15 22:27:28 2019 +0000
committer Tri Vo <trong@google.com> Tue Oct 15 22:27:28 2019 +0000
tree ce085668b5a048fb123dcf8ad216f476b021e94f
parent 5527d706c7a8d7038d3b5144e3e56d9c09e869fa

Reland "sepolicy: rework ashmem_device permissions"

Only allow apps targetting < Q and ephemeral apps to open /dev/ashmem.
Ephemeral apps are not distinguishable based on target API. So allow
ephemeral_app to open /dev/ashmem for compatibility reasons.

For sake of simplicity, allow all domains /dev/ashmem permissions other
than "open". Reason being that once we can remove "open" access
everywhere, we can remove the device altogether along with  other
permission.

Bug: 134434505
Test: boot crosshatch; browse internet, take picture;
no ashmem_device denials

Change-Id: Ie2464c23d799550722580a21b4f6f344983b43ba