[Moto G4 Plus ROMs, Kernels, Recoveries, & Other De] hackintosh5:
Got the sepolicy

I have the sepolicy file_contexts ready!

#*#*#ile_contexts:#*#*#

#weird, https://github.com/m-mullins/InitRoot_Harpia/blob/master/initrdimg-harpia/file_contexts#L330 says that all msm_.* devices are for audio (msm_audio_cal)

/dev/uio[0-9]*	u:object_r:uio_device:s0
/system/bin/qseecomd	u:object_r:tee_exec:s0
/dev/qseecom	u:object_r:tee_device:s0
/dev/mmi_sys_temp	u:object_r:thermal_device:s0
/dev/kgsl-3d0	u:object_r:gpu_device:s0
/dev/stml0xx	u:object_r:sensor_hub_device:s0
/dev/video[0-9]*	u:object_r:video_device:s0
/dev/msm_.*	u:object_r:audio_device:s0
/dev/v4l-subdev.*	u:object_r:camera_device:s0

and here is allow statements (anything with device:chr_file will need to be changed/removed as it is a security risk and potentially fixed by the above)

#============= audioserver ==============
allow audioserver device:chr_file ioctl;
allow audioserver init:binder call;

#============= cameraserver ==============
allow cameraserver camera_data_file:sock_file write;
allow cameraserver device:chr_file { ioctl open read write };
allow cameraserver init:unix_dgram_socket sendto;

#============= init ==============
allow init cameraserver:fd use;
allow init device:chr_file { ioctl open read write };
allow init hal_graphics_allocator_default:fd use;
allow init ion_device:chr_file { ioctl write };
allow init priv_app:binder transfer;
allow init property_socket:sock_file write;
allow init radio:binder call;
allow init self:binder call;
allow init self:capability2 block_suspend;
allow init self:netlink_route_socket read;
allow init self:netlink_socket read;
allow init self:socket { read write };
allow init servicemanager:binder call;
allow init system_app:binder transfer;
allow init system_data_file:file lock;
allow init system_server:binder { call transfer };
allow init video_device:chr_file ioctl;

#============= platform_app ==============
allow platform_app device:chr_file { ioctl read write };

#============= priv_app ==============
allow priv_app init:binder call;
allow priv_app init:unix_stream_socket { read write };

#============= radio ==============
allow radio init:binder call;
allow radio socket_device:sock_file write;

#============= servicemanager ==============
allow servicemanager init:binder transfer;
allow servicemanager init:dir search;
allow servicemanager init:file { open read };
allow servicemanager init:process getattr;

#============= surfaceflinger ==============
allow surfaceflinger device:chr_file { ioctl read write };
allow surfaceflinger sysfs:file write;

#============= system_app ==============
allow system_app init:binder call;
allow system_app init:unix_stream_socket { read write };

#============= system_server ==============
allow system_server device:chr_file { ioctl read write };
allow system_server init:binder { call transfer };
allow system_server init:unix_stream_socket { read write };

#============= untrusted_app ==============
allow untrusted_app device:chr_file { ioctl open read write };
allow untrusted_app init:binder call;
allow untrusted_app proc_stat:file { getattr open read };

#============= untrusted_app_25 ==============
allow untrusted_app_25 config_gz:file getattr;
allow untrusted_app_25 device:chr_file { ioctl read write };
allow untrusted_app_25 init:binder call;
allow untrusted_app_25 proc:file { getattr open read };
allow untrusted_app_25 proc_interrupts:file getattr;
allow untrusted_app_25 proc_iomem:file getattr;
allow untrusted_app_25 proc_stat:file { getattr open read };
allow untrusted_app_25 proc_sysrq:file getattr;
allow untrusted_app_25 proc_timer:file getattr;
allow untrusted_app_25 proc_zoneinfo:file getattr;
allow untrusted_app_25 sysfs:file { getattr open read };

EDIT: By the way all I did to get the SEPolicy to build is go to BuildConfig.mk in DevTree and uncomment the two lines below SELinux. Then whenever there was a build error go to the offending line (will be shown about half a page up from the fail message) and edit that file. The error will be a missing definition that got moved to private, so just comment out all lines with the offending context (which will be stated in the error message). I'm just adding this so that others can replicate my attempt at building. Note that in one file, I had to comment the entire file.

EDIT 2: we also need a property_contexts addition for a few props. I'm working on it.