# vendor/oxmc/PawletProfiled/sepolicy/pawletprofiled.te
# SELinux policy for the PawletProfiled priv-app / device owner.
#
# Supersedes the native-daemon policy that used to live in the Linux
# pawletprofiled repo (init_daemon_domain-based) — that pattern doesn't
# apply to an app; this one uses app_domain like other PawletOS priv-apps
# (see android_packages_apps_PawletCache/sepolicy/pawlet_cache.te).
#
# To activate, add to your device's BoardConfig.mk:
#   BOARD_SEPOLICY_DIRS += vendor/oxmc/PawletProfiled/sepolicy

type pawletprofiled, domain, coredomain;
app_domain(pawletprofiled)
permissive pawletprofiled;

type pawletprofiled_data_file, file_type, data_file_type, app_data_file_type;

net_domain(pawletprofiled)

allow pawletprofiled pawletprofiled_data_file:dir create_dir_perms;
allow pawletprofiled pawletprofiled_data_file:file create_file_perms;

# ── Profile store + preinstalled profiles ─────────────────────────────────
# /data/system/pawletos/{profiles,preinstalled,profile_ca.pem} — same paths
# the Linux daemon uses, so profile UUIDs and layout stay consistent across
# platforms even though nothing else about the implementation is shared.
type pawletos_system_file, file_type, data_file_type;
allow pawletprofiled pawletos_system_file:dir create_dir_perms;
allow pawletprofiled pawletos_system_file:file create_file_perms;

# ── Device policy / device owner ──────────────────────────────────────────
binder_call(pawletprofiled, system_server)
allow pawletprofiled device_policy_service:service_manager find;
allow pawletprofiled keystore_service:service_manager find;

# ── Content-cache runtime override (PawletOS-specific) ────────────────────
# Type declared in android_packages_apps_PawletCache/sepolicy/pawlet_cache.te
# (both dirs land in BOARD_SEPOLICY_DIRS) — see ContentCacheHandler.kt.
allow pawletprofiled pawletcache_policy_file:dir { create search getattr add_name };
allow pawletprofiled pawletcache_policy_file:file create_file_perms;

# ── Secure settings writes (WRITE_SECURE_SETTINGS) ────────────────────────
allow pawletprofiled system_server:binder call;

# ── Boot-completed / persistent process ───────────────────────────────────
allow pawletprofiled self:process { fork sigchld };