refpolicy: Introduce SELinux domain and policies for pd-mapper service

[gyenugul]

Introduce a new SELinux domain for the Qualcomm pd-mapper service to ensure proper labeling, isolation, and access control under the targeted refpolicy.

Changes include:

• Adding a new policy patch defining the pd-mapper domain
• Adding SELinux policy rules granting pd-mapper.service the necessary permissions to access sysfs nodes, socket creation and communication.
• Extending the refpolicy-targeted recipe via bbappend to integrate the domain

Patch addresses the following AVC Denials as well:

• type=AVC msg=audit(387.087:312): avc: denied { read } for pid=1610 comm="pd-mapper" name="remoteproc2" dev="sysfs" ino=58235 scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=lnk_file permissive=1
• type=AVC msg=audit(387.087:312): avc: denied { read } for pid=1610 comm="pd-mapper" name="firmware" dev="sysfs" ino=58238 scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1
• type=AVC msg=audit(387.087:312): avc: denied { open } for pid=1610 comm="pd-mapper" path="/sys/devices/platform/soc@0/2a300000.remoteproc/remoteproc/remoteproc2/firmware" dev="sysfs" ino=58238 scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1
• type=AVC msg=audit(387.091:313): avc: denied { create } for pid=1610 comm="pd-mapper" scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:system_r:qcom_pd_mapper_t:s0 tclass=qipcrtr_socket permissive=1
• type=AVC msg=audit(387.091:314): avc: denied { setopt } for pid=1610 comm="pd-mapper" scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:system_r:qcom_pd_mapper_t:s0 tclass=qipcrtr_socket permissive=1
• type=AVC msg=audit(387.091:315): avc: denied { getattr } for pid=1610 comm="pd-mapper" scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:system_r:qcom_pd_mapper_t:s0 tclass=qipcrtr_socket permissive=1
• type=AVC msg=audit(387.091:316): avc: denied { write } for pid=1610 comm="pd-mapper" scontext=system_u:system_r:qcom_pd_mapper_t:s0 tcontext=system_u:system_r:qcom_pd_mapper_t:s0 tclass=qipcrtr_socket permissive=1

[sasikuma-qti]

change looks good to me.

[lumag]

Could you please clarify, what makes it inappropriate? Have you tried sending it upstream?
In the end, pd-mapper, tqftpserv and rmtfs are normal services, packaged in several distros, etc.