security-selinux-expert

What problem does it solve?

SELinux denial logs, neverallow violations, and mislabeled paths can halt Android builds and block new services, and this skill keeps you inside the verified sepolicy trees and guardrails so you can resolve each denial without regressing Android 15 security posture.

Core Features & Use Cases

• Precision Path Scope: The L1 router and frontmatter-defined scope keep edits within system/sepolicy public/private, vendor, device, and property/service contexts so you never stray into unintended directories.
• Resolution Workflow: Capture avc: denied logs, draft minimal allow rules with the audit2allow_safe guidance, check for existing types, validate against neverallow rules, label new files, and rerun sepolicy or CTS tests before declaring success.
• Guardrails & Use Case: Mandatory forbidden actions, handoff rules for new daemons or HAL services, and the references/selinux_policy_guide.md ensure that onboarding vendor daemons or resolving binder/property denials stays Treble-compliant and coordinated with other subsystem experts.

Quick Start

Request the security-selinux-expert to analyze your latest avc: denied log, propose minimal allow rules with proper file_context labels, and confirm neverallow compliance before rerunning the SELinux tests.