fix: avoid custom zygisk SELinux type on KSU

[larsmartens]

Summary

• remove the custom zygisk_file SELinux type from the module policy
• allow zygote to traverse/read/map the existing adb_data_file and system_file labels used by the staged NeoZygisk path
• label NeoZygisk daemon sockets as system_file instead of the unmapped custom type

Context

On the Pixel 7 Pro Android 16 KernelSU setup, NeoZygisk reports monitor: stopped(zygote crashed) and fails remote dlopen with a misleading libzygisk.so not found error. The file exists, has the correct arm64 ABI, and only depends on platform libraries.

The useful boot evidence is SELinux/KSU-side:

SELinux: Context u:object_r:zygisk_file:s0 is not valid (left unmapped).
ksud::sepolicy: apply sepolicy batch failed: Invalid argument (os error 22)
avc: denied { search } for comm="app_process64" name="adb" scontext=u:r:zygote:s0 tcontext=u:object_r:adb_data_file:s0 tclass=dir permissive=0

That points to policy batch rejection and missing zygote traversal rights, not a missing library, ABI mismatch, or missing dependency.

Validation

• ksud sepolicy check module/src/sepolicy.rule passes on device
• git diff --check passes
• GitHub Actions CI passed: https://github.com/larsmartens/NeoZygisk/actions/runs/27652887803
• Repacked release ZIP integrity check passes locally

Test artifact

Local test ZIP copied to Downloads on the device:

/sdcard/Download/NeoZygisk-v2.3-340-4e04c61-ksu-sepolicy-fix-release.zip

SHA256:

05c401eb21126a73820f436474ff0d5abfbed3f86842c6462125e0b5736e0459

Runtime test plan

Do not use manual zygisk-ptrace trace --restart for validation. Install the ZIP through KernelSU, reboot normally, then check:

• no zygisk_file unmapped-context warning
• no app_process64 name="adb" AVC denial
• NeoZygisk status no longer says monitor: stopped(zygote crashed)
• zygote maps include libzygisk.so
• Vector/LSPosed services remain running