sanders: start that treble disaster

sepolicy/vendor/init.te

@@ -0,0 +1,55 @@
+# binder_call(init, mm-qcamerad);
+#binder_call(init, hwservicemanager);
+# binder_call(init, servicemanager);
+
+allow init hwservicemanager:binder call;
+allow init mm-qcamerad:binder transfer;
+allow init platform_app:binder transfer;
+
+allow init sysfs_devices_system_cpu:dir write;
+allow init sysfs_lowmemorykiller:dir write;
+allow init system_app:binder transfer;
+allow init system_data_file:file lock;
+
+allow init audio_device:chr_file { write ioctl };
+allow init input_device:chr_file rw_file_perms;
+allow init sensors_device:chr_file { write ioctl };
+allow init tee_device:chr_file { write ioctl };
+
+allow init servicemanager:binder { transfer call };
+allow init system_server:binder { transfer call };
+
+allow init property_socket:sock_file write;
+allow init socket_device:sock_file { create setattr unlink };
+
+allow init system_data_file:file { rename append };
+allow init firmware_file:dir mounton;
+
+allow init fm_radio_device:chr_file write;
+
+# ptt_socket_app
+allow init dnsproxyd_socket:sock_file write;
+allow init netd:unix_stream_socket connectto;
+allow init self:netlink_socket { read write getattr connect };
+
+allow init debugfs:file write;
+allow init persist_file:filesystem { getattr mount relabelfrom relabelto unmount };
+
+allow init self:capability sys_nice;
+
+allow init bt_firmware_file:filesystem { associate };
+allow init firmware_file:filesystem { associate };
+
+allow init sensors_device:chr_file { rw_file_perms create };
+
+allow init self:netlink_route_socket { bind create getopt nlmsg_read read setopt write };
+
+allow init self:capability2 { block_suspend };
+
+allow init hal_sensors_hwservice:hwservice_manager find;
+
+allow init { domain -lmkd -crash_dump }:process noatsecure;
+
+allow init hal_perf_hwservice:hwservice_manager find;
+allow init hidl_base_hwservice:hwservice_manager add;
+