title: SELinux policy definition for Android system service: how to setup?
body: <p>I had earlier written a standalone daemon to access a custom device (/dev/mydev0). Looking at AOSP source, I figured I needed setup policies in following files to make it work:</p>
  
  <p>new file device.te containing:</p>
  
  <pre><code>type mydev_device, dev_type;
  </code></pre>
  
  <p>new file mydevsrvc.te containing</p>
  
  <pre><code># service flash_recovery in init.rc
  type mydevsrvc_type, domain;
  type mydevsrvc_type_exec, exec_type, file_type;
  
  init_daemon_domain(mydevsrvc_type)
  
  allow mydevsrvc_type mydev_device:chr_file rw_file_perms;
  </code></pre>
  
  <p>edited file_contexts to add:</p>
  
  <pre><code>/dev/mydev[0-9]*    u:object_r:mydev_device:s0
  </code></pre>
  
  <p>edited service_contexts to add:</p>
  
  <pre><code>mydevsrvc                  u:object_r:mydevsrvc_type:s0
  </code></pre>
  
  <p>And started the daemon by editing init.flo.rc to include these lines:</p>
  
  <pre><code>service mydevsrvc /system/bin/mydevsrvc
      class main
      user system
      group system
      seclabel u:r:mydevsrvc_type:s0
      oneshot
  </code></pre>
  
  <p>Now, I need to access the device in android apps, so I must change the daemon into an android system service.</p>
  
  <p>I can startup the service (thread) using BOOT_COMPLETED intent as explained in <a href="https://stackoverflow.com/questions/7690350/android-start-service-on-boot">a previous question</a></p>
  
  <p>I am not able to figure out how to setup SELinux policies so that this java service is also able to access the dev file.</p>
  
  <p>[Update] I have continued using privileged daemon for this purpose. My java service connects to daemon through sockets. I don't have a better solution.</p>