security-selinux-expert

Resolve SELinux avc denied errors in Android 15 by capturing denial logs, drafting minimal allow rules based on audit2allow_safe guidance, validating against neverallow rules, and applying correct file_context labels before rerunning sepolicy tests.

Add allow rules for vendor daemons without violating neverallow policies by scoping edits to vendor or device sepolicy directories, using audit2allow_safe for checks, and validating compliance against existing neverallow constraints before building.

Use audit2allow to generate initial SELinux policy for property contexts and binder paths, but validate the generated rules against neverallow constraints and manually ensure proper file_context labeling.

Android builds fail with SELinux neverallow violations when onboarding new HAL services if allow rules are placed in incorrect system or vendor sepolicy directories, bypassing required Treble-compliant guardrails and coordination.

Label new files in Android sepolicy to resolve property access failures by defining file_context labels within the appropriate system or vendor sepolicy scope, ensuring new service types align with existing property and service contexts.

Rerun CTS tests after modifying Android 15 sepolicy rules to verify that newly added allow rules and file_context labels do not regress the overall security posture or trigger new denials.