[PATCH] ofono: introduce dedicated SELinux domain ofono_t

Currently, the ofono daemon runs in the generic `initrc_t` domain.
While functional, this configuration lacks proper process isolation
and violates the principle of least privilege.

Define a dedicated domain (`ofono_t`) to confine the service, ensuring
it operates in a restricted environment isolated from other init
processes.

Grant the necessary permissions to resolve AVC denials observed during
the transition to enforcing mode:

*   DBus: Allow service registration on the system bus and communication
    with `org.bluez`.
*   Network: Allow `net_admin` capability and netlink socket creation
    (route and kobject_uevent) for rmnet and udev handling.
*   Filesystem: Authorize read access to configuration files in `/etc`
    and `/usr`, and traversal of `/sys` and `/run/udev`.
*   Logging: Allow write access to `/dev/log` for syslog integration.

Signed-off-by: Wei Deng <[email protected]>
---
 policy/modules/services/ofono.fc |  1 +
 policy/modules/services/ofono.if |  1 +
 policy/modules/services/ofono.te | 83 ++++++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+)
 create mode 100644 policy/modules/services/ofono.fc
 create mode 100644 policy/modules/services/ofono.if
 create mode 100644 policy/modules/services/ofono.te

diff --git a/policy/modules/services/ofono.fc b/policy/modules/services/ofono.fc
new file mode 100644
index 000000000..7b62f91a0
--- /dev/null
+++ b/policy/modules/services/ofono.fc
@@ -0,0 +1 @@
+/usr/sbin/ofonod    --   gen_context(system_u:object_r:ofono_exec_t,s0)
diff --git a/policy/modules/services/ofono.if b/policy/modules/services/ofono.if
new file mode 100644
index 000000000..7d99d1aa8
--- /dev/null
+++ b/policy/modules/services/ofono.if
@@ -0,0 +1 @@
+## <summary>ofono</summary>
diff --git a/policy/modules/services/ofono.te b/policy/modules/services/ofono.te
new file mode 100644
index 000000000..faa48f1ed
--- /dev/null
+++ b/policy/modules/services/ofono.te
@@ -0,0 +1,83 @@
+policy_module(ofono, 1.0)
+
+########################################
+#
+# Declarations
+#
+
+type ofono_t;
+type ofono_exec_t;
+
+init_daemon_domain(ofono_t, ofono_exec_t)
+
+########################################
+#
+# Local Policy
+#
+
+# 1. Self Rules (Capabilities & Sockets)
+# --------------------------------------
+allow ofono_t self:capability net_admin;
+
+# Socket permissions
+allow ofono_t self:bluetooth_socket create_stream_socket_perms;
+allow ofono_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow ofono_t self:netlink_route_socket create_netlink_socket_perms;
+allow ofono_t self:unix_dgram_socket { connect create write };
+
+# 2. File System Access
+# ---------------------
+# Generic sysfs access using standard interface
+dev_read_sysfs(ofono_t)
+
+# Read configuration files in /etc
+files_read_etc_files(ofono_t)
+
+# Read files in /usr
+files_read_usr_files(ofono_t)
+allow ofono_t usr_t:file map;
+
+# Udev runtime access
+gen_require(`
+    type udev_runtime_t;
+')
+allow ofono_t udev_runtime_t:dir search_dir_perms;
+allow ofono_t udev_runtime_t:file read_file_perms;
+
+# 3. Logging
+# ----------
+logging_send_syslog_msg(ofono_t)
+
+# Access to devlog
+gen_require(`
+    type devlog_t;
+')
+allow ofono_t devlog_t:sock_file write_sock_file_perms;
+
+# 4. IPC / DBus / Network
+# -----------------------
+# Connect to the system DBus
+dbus_system_bus_client(ofono_t)
+
+gen_require(`
+    type system_dbusd_t;
+    type system_dbusd_runtime_t;
+    class dbus { acquire_svc send_msg };
+')
+
+# DBus specific service interactions
+allow ofono_t system_dbusd_t:dbus { acquire_svc send_msg };
+
+# Manual socket handling for system_dbusd
+allow ofono_t system_dbusd_runtime_t:dir search_dir_perms;
+allow ofono_t system_dbusd_runtime_t:sock_file write_sock_file_perms;
+
+# Bluetooth interactions via DBus
+gen_require(`
+    type bluetooth_t;
+')
+allow bluetooth_t ofono_t:dbus send_msg;
+allow ofono_t bluetooth_t:dbus send_msg;
+
+# Init interactions
+init_dbus_chat(ofono_t)
-- 
2.25.1