[WIP] sepolicy: add device-specific rules

Change-Id: I0b0f65dde54c52cbaf8d38361fd200a54dfebf88