tpm2: fix tpm2-abrmd D-Bus communication under enforcing mode

[khalidfaisal17]

tpm2-abrmd was crashing on every D-Bus activation attempt under SELinux enforcing mode, causing all tpm2-tools commands to fall back to direct TPM device access with a GDBus warning.

AVC log confirmed the root denial:

avc: denied { read write } for comm="dbus-daemon"
scontext=system_u:system_r:system_dbusd_t:s0
tcontext=system_u:system_r:tpm2_abrmd_t:s0
tclass=unix_stream_socket permissive=0

tpm2-abrmd uses socketpair(PF_LOCAL, SOCK_STREAM) to create a connected fd pair per client, then passes one end to dbus-daemon via SCM_RIGHTS (D-Bus fd-passing). dbus-daemon needs { read write } on that inherited anonymous socket to relay TPM commands. This is not a connectto — the socket is already connected when the fd is received.

Files changed:

• policy/modules/services/tpm2.if — add tpm2_rw_abrmd_stream_sockets() granting rw_socket_perms on tpm2_abrmd_t:unix_stream_socket
• policy/modules/services/dbus.te — call tpm2_rw_abrmd_stream_sockets(system_dbusd_t) inside the existing optional_policy block alongside tpm2_rw_abrmd_pipes()
• policy/modules/services/tpm2.te — add files_read_etc_files (D-Bus config), miscfiles_read_localization (GLib init), and init_dbus_chat (systemd Type=dbus activation) for tpm2_abrmd_t
• policy/modules/system/unconfined.te — add tpm2_dbus_chat_abrmd(unconfined_t) in an optional_policy block for interactive root sessions

[khalidfaisal17]

Hi Reviewers,

Can you please approve the workflow checks so that this change go through it.

[pebenito]

cc @dsugar100 for additional thoughts.

[khalidfaisal17]

Hi Reviewers;

Kindly approve the changes; Its already validated.

[pebenito]

This was supposed to be removed, it has reappeared. See previous discussion in init.te.

[khalidfaisal17]

Re-added with justification. On this platform adbd (Android Debug Bridge daemon) runs as initrc_t, confirmed on device:

# ps -eZ | grep adbd
system_u:system_r:initrc_t:s0  1649  ?  00:00:00 adbd

Without this, tpm2_abrmd_t cannot send the D-Bus reply back to initrc_t — the reply is silently dropped and the caller times out. No AVC is logged for the dropped reply, making it non-obvious.

The placement follows the existing pattern in this block (firewalld, networkmanager, modemmanager, policykit) and the nested optional_policy ensures it only applies when the tpm2 module is loaded.

[pebenito]

This was discussed in other PRs, but we are not handling this in refpolicy. The rule will need to remain in you downstream policy until an adbd domain is added here.

[khalidfaisal17]

Updated the patch as discussed here!!
Kindly review and approve!