[Sony Cross-Device General] munjeni:
This is sepolicy diff:

diff --git a/sepolicy.decomp b/sepolicy.decomp
index adfd554..f294f69 100644
--- a/sepolicy.decomp
+++ b/sepolicy.decomp
@@ -3116,6 +3116,8 @@ type startupprober_file, file_type;
type statusbar_service, app_api_service, system_server_service, service_manager_type;
type storage_file, file_type;
type storage_stub_file, file_type;
+type su, mlstrustedsubject, domain;
+type su_device, mlstrustedobject, domain;
type su_exec, file_type, exec_type;
type subsystem_ramdump, domain_deprecated, domain;
type subsystem_ramdump_exec, file_type, exec_type;
@@ -10097,6 +10099,7 @@ allow init storage_stub_file:fifo_file { setattr read create relabelfrom getattr
allow init storage_stub_file:file { setattr read create write relabelfrom getattr relabelto unlink open };
allow init storage_stub_file:lnk_file { setattr relabelfrom create getattr relabelto unlink };
allow init storage_stub_file:sock_file { setattr read create relabelfrom getattr relabelto unlink open };
+allow init su:process { sigkill share getpgid signull setkeycreate siginh getattr setcurrent setrlimit rlimitinh fork getsession setexec setpgid setsched sigstop ptrace noatsecure setsockcreate setfscreate execheap sigchld execstack signal transition setcap execmem getcap getsched dyntransition };
allow init subsystem_ramdump:process { siginh rlimitinh transition noatsecure };
allow init subsystem_ramdump_exec:file { read getattr open execute };
allow init subsystem_ramdump_tmpfs:blk_file relabelto;
@@ -10261,8 +10264,9 @@ allow init system_data_file:fifo_file { setattr read create relabelfrom getattr
allow init system_data_file:file { setattr read create write relabelfrom getattr relabelto unlink open };
allow init system_data_file:lnk_file { setattr relabelfrom create getattr relabelto unlink };
allow init system_data_file:sock_file { setattr read create relabelfrom getattr relabelto unlink open };
-allow init system_file:dir { relabelfrom mounton };
-allow init system_file:file { relabelfrom execute_no_trans };
+allow init system_file:dir { rename lock quotaon remove_name open append create write relabelfrom getattr rmdir read search mounton ioctl link unlink swapon add_name execute setattr audit_access reparent relabelto execmod };
+allow init system_file:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow init system_file:lnk_file { rename open execute execmod setattr read lock create quotaon getattr mounton write relabelfrom ioctl link relabelto unlink swapon audit_access append };
allow init system_file:system module_load;
allow init system_health_monitor_device:chr_file { read open setattr };
allow init system_ndebug_socket:blk_file relabelto;
@@ -11653,9 +11657,11 @@ allow kernel sdcardd:fd use;
allow kernel selinuxfs:dir { search read lock getattr ioctl open };
allow kernel selinuxfs:file { read lock getattr write ioctl open };
allow kernel shell_data_file:file { read write getattr open setattr };
+allow kernel su:fd use;
allow kernel sysfs:dir { search read lock getattr ioctl open };
allow kernel sysfs:file { read lock ioctl open getattr };
allow kernel sysfs:lnk_file { read lock ioctl open getattr };
+allow kernel system_data_file:file read;
allow kernel tad:fd use;
allow kernel tmpfs:chr_file write;
allow kernel touchfusion:process { siginh transition rlimitinh };
@@ -14640,6 +14646,7 @@ allow rmt_storage sysfs_wake_lock:file { read lock getattr write ioctl open appe
allow rmt_storage uio_device:chr_file { read lock getattr write ioctl open append };
allow rmts_file rmts_file:filesystem associate;
allow rootfs rootfs:filesystem associate;
+allow rootfs tmpfs:filesystem associate;
allow rpm_log_file rpm_log_file:filesystem associate;
allow rpm_stats_file rpm_stats_file:filesystem associate;
allow runas adbd:process sigchld;
@@ -16029,6 +16036,39 @@ allow startupprober system_file:dir { read open };
allow startupprober tad:unix_stream_socket connectto;
allow startupprober tad_socket:sock_file write;
allow startupprober tee_device:chr_file { read write ioctl open };
+allow su app_data_file:dir { rename lock quotaon remove_name open append create write relabelfrom getattr rmdir read search mounton ioctl link unlink swapon add_name execute setattr audit_access reparent relabelto execmod };
+allow su app_data_file:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su default_prop:file write;
+allow su default_prop:property_service set;
+allow su devpts:chr_file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su init:unix_stream_socket connectto;
+allow su kernel:process setsched;
+allow su kernel:security { load_policy read_policy };
+allow su labeledfs:filesystem { mount unmount };
+allow su logd:unix_stream_socket connectto;
+allow su logdr_socket:sock_file write;
+allow su properties_device:file write;
+allow su properties_serial:file write;
+allow su property_socket:sock_file write;
+allow su rootfs:file { read getattr entrypoint };
+allow su rootfs:filesystem remount;
+allow su selinuxfs:file { read write open };
+allow su shell_exec:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su su:capability { setuid setfcap sys_chroot net_bind_service sys_nice mknod fsetid kill net_admin sys_rawio audit_control sys_pacct sys_resource sys_ptrace dac_read_search sys_boot sys_admin audit_write net_raw setgid sys_time lease dac_override net_broadcast linux_immutable fowner sys_tty_config setpcap sys_module ipc_lock chown ipc_owner };
+allow su su:dir { rename lock quotaon remove_name open append create write relabelfrom getattr rmdir read search mounton ioctl link unlink swapon add_name execute setattr audit_access reparent relabelto execmod };
+allow su su:fifo_file { rename open execute execmod setattr read lock create quotaon getattr mounton write relabelfrom ioctl link relabelto unlink swapon audit_access append };
+allow su su:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su su:lnk_file { rename open execute execmod setattr read lock create quotaon getattr mounton write relabelfrom ioctl link relabelto unlink swapon audit_access append };
+allow su su:process { sigkill share getpgid signull setkeycreate siginh getattr setcurrent setrlimit rlimitinh fork getsession setexec setpgid setsched sigstop ptrace noatsecure setsockcreate setfscreate execheap sigchld execstack signal transition setcap execmem getcap getsched dyntransition };
+allow su su:unix_dgram_socket { lock accept connect shutdown append create write relabelfrom getattr getopt listen setopt read ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
+allow su su:unix_stream_socket { lock accept connect shutdown append connectto create write relabelfrom getattr getopt listen acceptfrom setopt read newconn ioctl recv_msg name_bind send_msg setattr bind recvfrom sendto relabelto };
+allow su su_device:dir { rename lock quotaon remove_name open append create write relabelfrom getattr rmdir read search mounton ioctl link unlink swapon add_name execute setattr audit_access reparent relabelto execmod };
+allow su su_device:sock_file { rename open execute execmod setattr read lock create quotaon getattr mounton write relabelfrom ioctl link relabelto unlink swapon audit_access append };
+allow su toolbox_exec:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su untrusted_app_devpts:chr_file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su zygote_exec:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
+allow su zygote_exec:lnk_file { rename open execute execmod setattr read lock create quotaon getattr mounton write relabelfrom ioctl link relabelto unlink swapon audit_access append };
+allow su_device tmpfs:filesystem associate;
allow subsystem_ramdump ecryptfs:dir { rename search setattr read lock create reparent getattr write ioctl rmdir remove_name open add_name };
allow subsystem_ramdump ecryptfs:file { rename setattr read lock create getattr write ioctl unlink open append };
allow subsystem_ramdump init:process sigchld;
@@ -16722,7 +16762,7 @@ allow system_server device_policy_file:file { rename setattr read lock create ge
allow system_server device_policy_file:lnk_file { rename setattr read lock create getattr write ioctl unlink open append };
allow system_server device_policy_file:sock_file { rename setattr read lock create getattr write ioctl unlink open append };
allow system_server devicemonitor_prop:property_service set;
-allow system_server dex2oat_exec:file execute;
+allow system_server dex2oat_exec:file { rename lock quotaon execute_no_trans open append create write relabelfrom getattr entrypoint read mounton ioctl link unlink swapon execute setattr audit_access relabelto execmod };
allow system_server dhcp_data_file:dir { search read lock getattr ioctl open };
allow system_server dhcp_data_file:file { read lock ioctl open getattr };
allow system_server dhcp_data_file:lnk_file { read lock ioctl open getattr };
@@ -17652,6 +17692,7 @@ allow untrusted_app sysfs_hwrandom:dir search;
allow untrusted_app sysfs_hwrandom:file { read lock ioctl open getattr };
allow untrusted_app system_app_data_file:file { read write getattr };
allow untrusted_app tun_device:chr_file { read write ioctl getattr append };
+allow untrusted_app untrusted_app:capability setgid;
allow untrusted_app untrusted_app:dir { search read lock getattr ioctl open };
allow untrusted_app untrusted_app:fd use;
allow untrusted_app untrusted_app:fifo_file { read lock getattr write ioctl open append };
@@ -21965,6 +22006,8 @@ role r types blkid;
role r types brcm_uim;
role r types chargemon;
role r types kobjeventd;
+role r types su;
+role r types su_device;

Definitelly nothing wrong! This confirms that magisk didn't broke sepolicy! Now is questionable why we see avc denials related to /vendor ! I realy have no idea how magisk working and to be honest I realy don't care since I do not use magisk, but probably magisk uses something from /vendor folder and in our case (devices who have vendor symlink in ramdisk) it cause boot loop. I'm in hope magisk devs do something about that since PoC is apsolutly unrelated to that bug. i'm not going to fix this sorry, thats a job for magisk devs to figure out why ramdisks which have vendor symlink instead of real folder have bootloop. You can link our page to magisk devs, hope he do something about that. I have contacted main dev but didn't received reply ;) Hope you guys stop reporting isue in our thread, definitelly PoC is not related to boot loops which you have, problem is magisk! If you not believing install magisk on unmodified boot image, the same isue you will get, so definitelly unrelated to our thread, so please any further isues related to magisk use magisk thread for reporting it! Magisk devs probably didn't know about this thread, so he probably don't know anything about boot loop isue on your kernels, so if you realy need to help devs please post isues into right thread where devs clearly see your post! Don't forget to link our page in your post!

Edit:

I have reported isue to the right thread https://xdaforums.com/showpost.php?p=73557969&postcount=18385