Skip to content

kernel, ksud: implement clone_type sepolicy support#3530

Open
XiaoTong6666 wants to merge 1 commit into
tiann:mainfrom
XiaoTong6666:pr5
Open

kernel, ksud: implement clone_type sepolicy support#3530
XiaoTong6666 wants to merge 1 commit into
tiann:mainfrom
XiaoTong6666:pr5

Conversation

@XiaoTong6666

@XiaoTong6666 XiaoTong6666 commented Jun 20, 2026

Copy link
Copy Markdown
Contributor
  • Add clone_type/copy_perm parsing and kernel-side sepolicy patch support.
  • Clone attributes, roles, constraints, avtab rules, permissive state and filename transitions for the new type.
  • Keep clone_type failures from publishing partial policy updates and align live policy duplication with runtime buffer growth needs.

@XiaoTong6666 XiaoTong6666 force-pushed the pr5 branch 5 times, most recently from b3de570 to 66c65e2 Compare June 22, 2026 17:28
@5ec1cff 5ec1cff requested a review from Copilot June 24, 2026 03:58
Copilot AI reviewed Jun 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds clone_type / copy_perm SELinux policy statement support end-to-end (ksud parser + UAPI + kernel-side policy patching). It also adjusts kernel live-policy duplication to better handle buffer growth and updates handle_sepolicy() to avoid publishing partial policy updates on clone_type failure.

Changes:

  • Add copy_perm / clone_type parsing in ksud and serialize it as a new sepolicy command.
  • Extend the sepolicy UAPI with KSU_SEPOLICY_CMD_CLONE_TYPE and wire it into the kernel command dispatcher.
  • Implement kernel-side type cloning (attrs/roles/constraints/avtab/permissive/filename transitions) and improve live policy duplication/publish flow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
userspace/ksud/src/sepolicy.rs Adds parsing + serialization of copy_perm / clone_type statements into atomic sepolicy commands.
uapi/selinux.h Introduces new KSU_SEPOLICY_CMD_CLONE_TYPE command ID.
kernel/selinux/sepolicy.h Exposes ksu_clone_type() in the kernel SELinux policy patch API.
kernel/selinux/sepolicy.c Implements ksu_clone_type() cloning logic and updates live policy duplication to retry with a larger buffer.
kernel/selinux/rules.c Routes new command to ksu_clone_type() and updates policy patch publish flow to avoid partial updates on clone failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread kernel/selinux/sepolicy.c Outdated
Comment thread kernel/selinux/sepolicy.c Outdated
Comment thread kernel/selinux/sepolicy.c Outdated
Comment thread kernel/selinux/rules.c Outdated
Comment thread kernel/selinux/rules.c Outdated
@XiaoTong6666 XiaoTong6666 marked this pull request as draft June 24, 2026 05:29
@XiaoTong6666 XiaoTong6666 force-pushed the pr5 branch 5 times, most recently from 6dc8b61 to 80d3087 Compare June 24, 2026 08:42
@XiaoTong6666 XiaoTong6666 marked this pull request as ready for review June 24, 2026 10:06
backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Jun 24, 2026
@backslashxx
1
731edb9 
1|mojito:/ # cd /tmp
mojito:/tmp # ./ksud sepolicy apply x.rule
Error: No such file or directory (os error 2)
1|mojito:/tmp # echo "clone_type ksu ksuy" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksuy", dst: "ksu" })
mojito:/tmp # echo "clone_type ksuy ksu" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksuy" })
mojito:/tmp # echo "clone_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # echo "copy_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksux" })
mojito:/tmp #

dmesg

[  159.093536] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4065 comm: ksud
[  159.093543] KernelSU: ksu fd installed: 4 for pid 4065
[  159.093544] KernelSU: [4065] install ksu fd: 4
[  159.093619] KernelSU: clone_type: added type ksuy
[  159.093772] KernelSU: clone_type: attributes copied count=4
[  159.093773] KernelSU: clone_type: roles copied
[  159.093797] KernelSU: clone_type: constraints copied count=100
[  159.093798] KernelSU: clone_type: permissive copied=1
[  159.124292] KernelSU: clone_type: avtab copied count=36862
[  159.124302] KernelSU: clone_type: filename_trans copied count=0
[  159.124304] KernelSU: clone_type: ksu -> ksuy attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  159.124305] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  159.124308] KernelSU: selinux_hide: tracking type: :ksuy:
[  159.124834] KernelSU: ksu fd released
[  206.991570] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4069 comm: ksud
[  206.991576] KernelSU: ksu fd installed: 4 for pid 4069
[  206.991577] KernelSU: [4069] install ksu fd: 4
[  206.991634] KernelSU: clone_type: added type ksux
[  206.991767] KernelSU: clone_type: attributes copied count=4
[  206.991769] KernelSU: clone_type: roles copied
[  206.991793] KernelSU: clone_type: constraints copied count=100
[  206.991794] KernelSU: clone_type: permissive copied=1
[  207.030077] KernelSU: clone_type: avtab copied count=36862
[  207.030087] KernelSU: clone_type: filename_trans copied count=0
[  207.030089] KernelSU: clone_type: ksu -> ksux attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  207.030090] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  207.030094] KernelSU: selinux_hide: tracking type: :ksux:
[  207.030590] KernelSU: ksu fd released

for:
tiann#3530
tiann@80d3087

ximi-mojito-test/android_kernel_xiaomi_mojito@76e1df0...37e3d0b
backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Jun 24, 2026
@backslashxx
1
60c9b95 
1|mojito:/ # cd /tmp
mojito:/tmp # ./ksud sepolicy apply x.rule
Error: No such file or directory (os error 2)
1|mojito:/tmp # echo "clone_type ksu ksuy" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksuy", dst: "ksu" })
mojito:/tmp # echo "clone_type ksuy ksu" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksuy" })
mojito:/tmp # echo "clone_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # echo "copy_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksux" })
mojito:/tmp #

dmesg

[  159.093536] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4065 comm: ksud
[  159.093543] KernelSU: ksu fd installed: 4 for pid 4065
[  159.093544] KernelSU: [4065] install ksu fd: 4
[  159.093619] KernelSU: clone_type: added type ksuy
[  159.093772] KernelSU: clone_type: attributes copied count=4
[  159.093773] KernelSU: clone_type: roles copied
[  159.093797] KernelSU: clone_type: constraints copied count=100
[  159.093798] KernelSU: clone_type: permissive copied=1
[  159.124292] KernelSU: clone_type: avtab copied count=36862
[  159.124302] KernelSU: clone_type: filename_trans copied count=0
[  159.124304] KernelSU: clone_type: ksu -> ksuy attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  159.124305] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  159.124308] KernelSU: selinux_hide: tracking type: :ksuy:
[  159.124834] KernelSU: ksu fd released
[  206.991570] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4069 comm: ksud
[  206.991576] KernelSU: ksu fd installed: 4 for pid 4069
[  206.991577] KernelSU: [4069] install ksu fd: 4
[  206.991634] KernelSU: clone_type: added type ksux
[  206.991767] KernelSU: clone_type: attributes copied count=4
[  206.991769] KernelSU: clone_type: roles copied
[  206.991793] KernelSU: clone_type: constraints copied count=100
[  206.991794] KernelSU: clone_type: permissive copied=1
[  207.030077] KernelSU: clone_type: avtab copied count=36862
[  207.030087] KernelSU: clone_type: filename_trans copied count=0
[  207.030089] KernelSU: clone_type: ksu -> ksux attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  207.030090] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  207.030094] KernelSU: selinux_hide: tracking type: :ksux:
[  207.030590] KernelSU: ksu fd released

for:
tiann#3530
tiann@80d3087

ximi-mojito-test/android_kernel_xiaomi_mojito@76e1df0...37e3d0b

https://github.com/ximi-libra-test/android_kernel_xiaomi_libra/commits/3d815de1a968e6b5aebd2a88bd79b3b253d7b227
backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Jun 24, 2026
@backslashxx
1
8b12a58 
1|mojito:/ # cd /tmp
mojito:/tmp # ./ksud sepolicy apply x.rule
Error: No such file or directory (os error 2)
1|mojito:/tmp # echo "clone_type ksu ksuy" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksuy", dst: "ksu" })
mojito:/tmp # echo "clone_type ksuy ksu" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksuy" })
mojito:/tmp # echo "clone_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # echo "copy_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksux" })
mojito:/tmp #

dmesg

[  159.093536] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4065 comm: ksud
[  159.093543] KernelSU: ksu fd installed: 4 for pid 4065
[  159.093544] KernelSU: [4065] install ksu fd: 4
[  159.093619] KernelSU: clone_type: added type ksuy
[  159.093772] KernelSU: clone_type: attributes copied count=4
[  159.093773] KernelSU: clone_type: roles copied
[  159.093797] KernelSU: clone_type: constraints copied count=100
[  159.093798] KernelSU: clone_type: permissive copied=1
[  159.124292] KernelSU: clone_type: avtab copied count=36862
[  159.124302] KernelSU: clone_type: filename_trans copied count=0
[  159.124304] KernelSU: clone_type: ksu -> ksuy attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  159.124305] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  159.124308] KernelSU: selinux_hide: tracking type: :ksuy:
[  159.124834] KernelSU: ksu fd released
[  206.991570] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4069 comm: ksud
[  206.991576] KernelSU: ksu fd installed: 4 for pid 4069
[  206.991577] KernelSU: [4069] install ksu fd: 4
[  206.991634] KernelSU: clone_type: added type ksux
[  206.991767] KernelSU: clone_type: attributes copied count=4
[  206.991769] KernelSU: clone_type: roles copied
[  206.991793] KernelSU: clone_type: constraints copied count=100
[  206.991794] KernelSU: clone_type: permissive copied=1
[  207.030077] KernelSU: clone_type: avtab copied count=36862
[  207.030087] KernelSU: clone_type: filename_trans copied count=0
[  207.030089] KernelSU: clone_type: ksu -> ksux attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  207.030090] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  207.030094] KernelSU: selinux_hide: tracking type: :ksux:
[  207.030590] KernelSU: ksu fd released

for:
tiann#3530
tiann@80d3087

ximi-mojito-test/android_kernel_xiaomi_mojito@76e1df0...37e3d0b

https://github.com/ximi-libra-test/android_kernel_xiaomi_libra/commits/3d815de1a968e6b5aebd2a88bd79b3b253d7b227
backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Jun 24, 2026
@backslashxx
1
3b19798 
1|mojito:/ # cd /tmp
mojito:/tmp # ./ksud sepolicy apply x.rule
Error: No such file or directory (os error 2)
1|mojito:/tmp # echo "clone_type ksu ksuy" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksuy", dst: "ksu" })
mojito:/tmp # echo "clone_type ksuy ksu" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksuy" })
mojito:/tmp # echo "clone_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # echo "copy_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksux" })
mojito:/tmp #

dmesg

[  159.093536] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4065 comm: ksud
[  159.093543] KernelSU: ksu fd installed: 4 for pid 4065
[  159.093544] KernelSU: [4065] install ksu fd: 4
[  159.093619] KernelSU: clone_type: added type ksuy
[  159.093772] KernelSU: clone_type: attributes copied count=4
[  159.093773] KernelSU: clone_type: roles copied
[  159.093797] KernelSU: clone_type: constraints copied count=100
[  159.093798] KernelSU: clone_type: permissive copied=1
[  159.124292] KernelSU: clone_type: avtab copied count=36862
[  159.124302] KernelSU: clone_type: filename_trans copied count=0
[  159.124304] KernelSU: clone_type: ksu -> ksuy attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  159.124305] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  159.124308] KernelSU: selinux_hide: tracking type: :ksuy:
[  159.124834] KernelSU: ksu fd released
[  206.991570] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4069 comm: ksud
[  206.991576] KernelSU: ksu fd installed: 4 for pid 4069
[  206.991577] KernelSU: [4069] install ksu fd: 4
[  206.991634] KernelSU: clone_type: added type ksux
[  206.991767] KernelSU: clone_type: attributes copied count=4
[  206.991769] KernelSU: clone_type: roles copied
[  206.991793] KernelSU: clone_type: constraints copied count=100
[  206.991794] KernelSU: clone_type: permissive copied=1
[  207.030077] KernelSU: clone_type: avtab copied count=36862
[  207.030087] KernelSU: clone_type: filename_trans copied count=0
[  207.030089] KernelSU: clone_type: ksu -> ksux attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  207.030090] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  207.030094] KernelSU: selinux_hide: tracking type: :ksux:
[  207.030590] KernelSU: ksu fd released

for:
tiann#3530
tiann@80d3087

ximi-mojito-test/android_kernel_xiaomi_mojito@76e1df0...37e3d0b

https://github.com/ximi-libra-test/android_kernel_xiaomi_libra/commits/3d815de1a968e6b5aebd2a88bd79b3b253d7b227
backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Jun 24, 2026
@backslashxx
1
281e868 
1|mojito:/ # cd /tmp
mojito:/tmp # ./ksud sepolicy apply x.rule
Error: No such file or directory (os error 2)
1|mojito:/tmp # echo "clone_type ksu ksuy" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksuy", dst: "ksu" })
mojito:/tmp # echo "clone_type ksuy ksu" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksuy" })
mojito:/tmp # echo "clone_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # echo "copy_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksux" })
mojito:/tmp #

dmesg

[  159.093536] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4065 comm: ksud
[  159.093543] KernelSU: ksu fd installed: 4 for pid 4065
[  159.093544] KernelSU: [4065] install ksu fd: 4
[  159.093619] KernelSU: clone_type: added type ksuy
[  159.093772] KernelSU: clone_type: attributes copied count=4
[  159.093773] KernelSU: clone_type: roles copied
[  159.093797] KernelSU: clone_type: constraints copied count=100
[  159.093798] KernelSU: clone_type: permissive copied=1
[  159.124292] KernelSU: clone_type: avtab copied count=36862
[  159.124302] KernelSU: clone_type: filename_trans copied count=0
[  159.124304] KernelSU: clone_type: ksu -> ksuy attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  159.124305] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  159.124308] KernelSU: selinux_hide: tracking type: :ksuy:
[  159.124834] KernelSU: ksu fd released
[  206.991570] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4069 comm: ksud
[  206.991576] KernelSU: ksu fd installed: 4 for pid 4069
[  206.991577] KernelSU: [4069] install ksu fd: 4
[  206.991634] KernelSU: clone_type: added type ksux
[  206.991767] KernelSU: clone_type: attributes copied count=4
[  206.991769] KernelSU: clone_type: roles copied
[  206.991793] KernelSU: clone_type: constraints copied count=100
[  206.991794] KernelSU: clone_type: permissive copied=1
[  207.030077] KernelSU: clone_type: avtab copied count=36862
[  207.030087] KernelSU: clone_type: filename_trans copied count=0
[  207.030089] KernelSU: clone_type: ksu -> ksux attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  207.030090] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  207.030094] KernelSU: selinux_hide: tracking type: :ksux:
[  207.030590] KernelSU: ksu fd released

for:
tiann#3530
tiann@80d3087

ximi-mojito-test/android_kernel_xiaomi_mojito@76e1df0...37e3d0b

https://github.com/ximi-libra-test/android_kernel_xiaomi_libra/commits/3d815de1a968e6b5aebd2a88bd79b3b253d7b227
backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Jun 25, 2026
@backslashxx
1
46b0191 
1|mojito:/ # cd /tmp
mojito:/tmp # ./ksud sepolicy apply x.rule
Error: No such file or directory (os error 2)
1|mojito:/tmp # echo "clone_type ksu ksuy" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksuy", dst: "ksu" })
mojito:/tmp # echo "clone_type ksuy ksu" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksuy" })
mojito:/tmp # echo "clone_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
mojito:/tmp # echo "copy_perm ksu ksux" > x.rule
mojito:/tmp # ./ksud sepolicy apply x.rule
CloneType(CloneType { src: "ksu", dst: "ksux" })
mojito:/tmp #

dmesg

[  159.093536] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4065 comm: ksud
[  159.093543] KernelSU: ksu fd installed: 4 for pid 4065
[  159.093544] KernelSU: [4065] install ksu fd: 4
[  159.093619] KernelSU: clone_type: added type ksuy
[  159.093772] KernelSU: clone_type: attributes copied count=4
[  159.093773] KernelSU: clone_type: roles copied
[  159.093797] KernelSU: clone_type: constraints copied count=100
[  159.093798] KernelSU: clone_type: permissive copied=1
[  159.124292] KernelSU: clone_type: avtab copied count=36862
[  159.124302] KernelSU: clone_type: filename_trans copied count=0
[  159.124304] KernelSU: clone_type: ksu -> ksuy attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  159.124305] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  159.124308] KernelSU: selinux_hide: tracking type: :ksuy:
[  159.124834] KernelSU: ksu fd released
[  206.991570] KernelSU: sys_reboot: magic: 0xdeadbeef id: 0xcafebabe pid: 4069 comm: ksud
[  206.991576] KernelSU: ksu fd installed: 4 for pid 4069
[  206.991577] KernelSU: [4069] install ksu fd: 4
[  206.991634] KernelSU: clone_type: added type ksux
[  206.991767] KernelSU: clone_type: attributes copied count=4
[  206.991769] KernelSU: clone_type: roles copied
[  206.991793] KernelSU: clone_type: constraints copied count=100
[  206.991794] KernelSU: clone_type: permissive copied=1
[  207.030077] KernelSU: clone_type: avtab copied count=36862
[  207.030087] KernelSU: clone_type: filename_trans copied count=0
[  207.030089] KernelSU: clone_type: ksu -> ksux attrs=4 constraints=100 avtab=36862 filename_trans=0 permissive=1
[  207.030090] KernelSU: sepol: cmd #0 success, cmd=10 subcmd=0.
[  207.030094] KernelSU: selinux_hide: tracking type: :ksux:
[  207.030590] KernelSU: ksu fd released

for:
tiann#3530
tiann@327f175

ximi-mojito-test/android_kernel_xiaomi_mojito@76e1df0...37e3d0b

https://github.com/ximi-libra-test/android_kernel_xiaomi_libra/commits/3d815de1a968e6b5aebd2a88bd79b3b253d7b227

Update supercall.h
@XiaoTong6666
kernel, ksud: implement clone_type sepolicy support
e816589 
- Add clone_type/copy_perm parsing and kernel-side sepolicy patch support.
- Clone attributes, roles, constraints, avtab rules, permissive state and filename transitions for the new type.
- Keep clone_type failures from publishing partial policy updates and align live policy duplication with runtime buffer growth needs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@XiaoTong6666