use device/qcom/sepolicy instead