# pawlet-cache (os.pawlet.cache) — platform-signed app, LAN content-cache resolver.
# Bound by bg_upd (and later OTA/media resolvers) via IPawletCacheService.
#
# Rules below were reconciled against every real code path in this repo
# (CacheOrchestrator, MdnsDiscovery, CentralLookupClient, PolicyOverride,
# PawletCacheService) — traced source-to-sepolicy, not live avc denials, same
# caveat as bg_upd.te. No gaps found: NsdManager discovery routes through
# system_server + servicediscovery_service (both already granted below),
# CentralLookupClient is plain HTTPS (net_domain), and both policy file tiers
# (pawletcache_policy_file, vendor_configs_file) already match Constants.kt's
# POLICY_OVERRIDE_PATH/VENDOR_POLICY_PATH exactly.

type pawlet_cache, domain, coredomain;
app_domain(pawlet_cache)

type pawlet_cache_data_file, file_type, data_file_type, app_data_file_type;

# Central lookup (HTTPS) + cache server asset fetches happen in bg_upd, not
# here — pawlet_cache itself only needs network for central lookup requests
# made during discovery and for NSD's underlying mDNS multicast traffic.
net_domain(pawlet_cache)

allow pawlet_cache pawlet_cache_data_file:dir create_dir_perms;
allow pawlet_cache pawlet_cache_data_file:file create_file_perms;

# NsdManager discovery/resolve calls route through system_server to mdnsd.
binder_call(pawlet_cache, system_server)
allow pawlet_cache servicediscovery_service:service_manager find;

# Callers bind IPawletCacheService — see bg_upd.te's binder_call(bg_upd, pawlet_cache).

# Enterprise policy override, written by pawletprofiled
# (git.oxmc.me/PawletOS/profiled — see PolicyOverride.kt). Write-side
# sepolicy rule lives in that repo's pawletprofiled.te.
type pawletcache_policy_file, file_type, data_file_type;
allow pawlet_cache pawletcache_policy_file:file { read open getattr };
allow pawlet_cache pawletcache_policy_file:dir { read open getattr search };

# OEM/vendor-baked default policy (read-only, build-time) — see
# vendor-config/README.md and sepolicy/file_contexts. Lives under
# /vendor/etc/pawletcache, labeled vendor_configs_file by AOSP's default
# file_contexts pattern; no per-domain allow rule needed since every domain
# already has blanket read access to vendor_configs_file platform-wide.