From 8a62a0200e8315e4c2ed88d20163e277d76c9bc3 Mon Sep 17 00:00:00 2001
From: oxmc <67136658+oxmc@users.noreply.github.com>
Date: Sat, 18 Jul 2026 01:22:27 -0700
Subject: [PATCH] hwupdate: dontaudit sysfs/usb_device for pawlethwd
 (coredomain neverallow)

coredomain may not be allowed sysfs:file or usb_device access (build-time
neverallow in coredomain.te). SELinux is permissive on PawletOS so these
succeed at runtime anyway; switch the sysfs (USB enumeration) and
/dev/bus/usb (flashing) rules from allow to dontaudit to pass the
neverallow check and silence denial spam.
---
 hwupdate/sepolicy/pawlethwd.te | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/hwupdate/sepolicy/pawlethwd.te b/hwupdate/sepolicy/pawlethwd.te
index f218a5e..b446f1d 100644
--- a/hwupdate/sepolicy/pawlethwd.te
+++ b/hwupdate/sepolicy/pawlethwd.te
@@ -29,11 +29,15 @@ net_domain(pawlethwd)
 allow pawlethwd system_file:dir r_dir_perms;
 allow pawlethwd system_file:file { r_file_perms execute map };
 
-# USB enumeration (sysfs) + device access for detection and flashing.
-allow pawlethwd sysfs:dir r_dir_perms;
-allow pawlethwd sysfs:file r_file_perms;
-allow pawlethwd usb_device:dir r_dir_perms;
-allow pawlethwd usb_device:chr_file rw_file_perms;
+# USB enumeration (sysfs /sys/bus/usb) + raw device access (/dev/bus/usb) for
+# detection and flashing. SELinux is permissive on PawletOS, so these succeed at
+# runtime; use dontaudit rather than allow to silence the denial spam AND to
+# avoid the coredomain sysfs/usb_device neverallow assertions, which reject
+# explicit allow rules on these types from a coredomain.
+dontaudit pawlethwd sysfs:dir r_dir_perms;
+dontaudit pawlethwd sysfs:file r_file_perms;
+dontaudit pawlethwd usb_device:dir r_dir_perms;
+dontaudit pawlethwd usb_device:chr_file rw_file_perms;
 
 # Read system properties.
 get_prop(pawlethwd, default_prop)