# pawlet-cache (os.pawlet.cache) — platform-signed app, LAN content-cache resolver.
# Bound by bg_upd (and later OTA/media resolvers) via IPawletCacheService.
#
# Seeded in permissive mode, same caveat as bg_upd.te: shaped from the actual
# code paths (NsdManager discovery, HTTPS central lookup, policy override file
# read) but not yet validated against real avc denials on-device.

type pawlet_cache, domain, coredomain;
app_domain(pawlet_cache)
permissive pawlet_cache;

type pawlet_cache_data_file, file_type, data_file_type, app_data_file_type;

# Central lookup (HTTPS) + cache server asset fetches happen in bg_upd, not
# here — pawlet_cache itself only needs network for central lookup requests
# made during discovery and for NSD's underlying mDNS multicast traffic.
net_domain(pawlet_cache)

allow pawlet_cache pawlet_cache_data_file:dir create_dir_perms;
allow pawlet_cache pawlet_cache_data_file:file create_file_perms;

# NsdManager discovery/resolve calls route through system_server to mdnsd.
binder_call(pawlet_cache, system_server)
allow pawlet_cache servicediscovery_service:service_manager find;

# Callers bind IPawletCacheService — see bg_upd.te's binder_call(bg_upd, pawlet_cache).

# Enterprise policy override, written by pawletprofiled
# (git.oxmc.me/PawletOS/profiled — see PolicyOverride.kt). Write-side
# sepolicy rule lives in that repo's pawletprofiled.te.
type pawletcache_policy_file, file_type, data_file_type;
allow pawlet_cache pawletcache_policy_file:file { read open getattr };
allow pawlet_cache pawletcache_policy_file:dir { read open getattr search };

# OEM/vendor-baked default policy (read-only, build-time) — see
# vendor-config/README.md. vendor_file_type is required for a type to live
# under /vendor per Treble's vendor/system sepolicy split.
type pawletcache_vendor_config_file, file_type, vendor_file_type;
allow pawlet_cache pawletcache_vendor_config_file:file { read open getattr };
allow pawlet_cache pawletcache_vendor_config_file:dir { read open getattr search };