refpolicy: Add SELinux policy for tqftpserv

policy/modules/services/tqftpserv.fc

@@ -0,0 +1,4 @@
+# File contexts for Qualcomm tqftpserv TFTP service.
+# Label the tqftpserv binary to trigger domain transition on exec.
+
+/usr/bin/tqftpserv	--	gen_context(system_u:object_r:qcom_tqftpserv_exec_t,s0)

policy/modules/services/tqftpserv.if

@@ -0,0 +1,3 @@
+## <summary>tqftpserv - Qualcomm TFTP server for modem remote filesystem access</summary>
+## <desc>
+## </desc>

policy/modules/services/tqftpserv.te

@@ -0,0 +1,23 @@
+########################################
+#
+# Declarations
+#
+
+type qcom_tqftpserv_t;
+type qcom_tqftpserv_exec_t;
+init_daemon_domain(qcom_tqftpserv_t, qcom_tqftpserv_exec_t)
+
+########################################
+#
+# qcom_tqftpserv local policy
+#
+
+# QRTR socket for modem IPC (EFS remote filesystem protocol)
+allow qcom_tqftpserv_t self:qipcrtr_socket create_socket_perms;
+
+# Generic socket operations
+allow qcom_tqftpserv_t self:socket create_socket_perms;
+
+# net_admin: network socket management
+# dac_read_search: read modem-requested EFS/data paths
+allow qcom_tqftpserv_t self:capability { net_admin dac_read_search };