# vendor/oxmc/vesperprofiled/sepolicy/vesperprofiled.te
# SELinux policy for the vesperprofiled system daemon (Android/AOSP).
#
# To activate, add to your device's BoardConfig.mk:
#   BOARD_SEPOLICY_DIRS += vendor/oxmc/vesperprofiled/sepolicy

# ── Type declarations ──────────────────────────────────────────────────────

type vesperprofiled,       domain;
type vesperprofiled_exec,  exec_type, file_type, system_file_type;
type vesperprofiled_data_file, file_type, data_file_type;
type vesperprofiled_service,   service_manager_type;

# ── Domain transition ──────────────────────────────────────────────────────

init_daemon_domain(vesperprofiled)

# ── Binder IPC ────────────────────────────────────────────────────────────

binder_use(vesperprofiled)
add_service(vesperprofiled, vesperprofiled_service)

# Allow system apps and shell to call into vesperprofiled via Binder
binder_call(system_app, vesperprofiled)
binder_call(shell, vesperprofiled)

# ── Profile data directory ────────────────────────────────────────────────

allow vesperprofiled vesperprofiled_data_file:dir  { create search getattr setattr add_name remove_name };
allow vesperprofiled vesperprofiled_data_file:file { create open read write getattr setattr unlink rename };

# ── System file access (CA certs for signature chain validation) ──────────

allow vesperprofiled system_file:dir  { search getattr };
allow vesperprofiled system_file:file { open read getattr };

# ── Network (ZTE HTTPS lookups) ───────────────────────────────────────────

allow vesperprofiled self:tcp_socket { create connect read write shutdown };
allow vesperprofiled self:udp_socket { create connect read write };
allow vesperprofiled port:tcp_socket name_connect;

# ── Logging ───────────────────────────────────────────────────────────────

allow vesperprofiled log_device:chr_file { open read write };

# ── System properties (ZTE state and MDM enrollment state) ───────────────

set_prop(vesperprofiled, vesperos_prop)
get_prop(vesperprofiled, vesperos_prop)

# ── DevicePolicyManager / KeyStore Binder calls ───────────────────────────

allow vesperprofiled device_policy_service:service_manager { find };
allow vesperprofiled keystore_service:service_manager      { find };
binder_call(vesperprofiled, system_server)
binder_call(vesperprofiled, keystore)

# ── Process self-permissions ──────────────────────────────────────────────

allow vesperprofiled self:process { fork sigchld };
allow vesperprofiled self:unix_stream_socket { create connect read write };