wireplumber: add SELinux policy module

[tkanfade]

WirePlumber is the session manager for the PipeWire multimedia framework. On standard Linux desktops it runs as a user service (systemd --user). On embedded/headless platforms such as Qualcomm QLI 2.0 it runs as a system-wide service (User=pipewire under system systemd).

Without a dedicated policy WirePlumber falls back to the generic initrc_t domain. In initrc_t, SELinux blocks D-Bus method replies from modemmanager_t and bluetooth_t which are required for telephony and Bluetooth audio routing. The blocked replies cause WirePlumber to crash with SIGSEGV every ~25 seconds resulting in wpctl set-default and pw-play --target failures.

The policy uses a compile-time ifdef(`wireplumber_system_service') switch following the same pattern as pipewire.te to select between system-service and user-service mode at m4 build time.

The policy module is placed in apps/ consistent with pipewire.

The policy confines the wireplumber_t domain with:

• Domain transition via wireplumber_exec_t
• PipeWire socket communication via pipewire_stream_connect() (depends on pipewire policy PR pipewire: add policy for PipeWire multimedia daemon #1109)
• Runtime directory management (system: /run/wireplumber, user: XDG_RUNTIME_DIR/wireplumber)
• tmpfs/memfd shared memory for zero-copy audio buffers
• Config file mmap via files_map_usr_files()
• D-Bus system bus; dbus_system_domain when system service
• D-Bus communication with ModemManager, BlueZ and oFono
• udev runtime access for device monitoring
• systemd sessions, /etc/machine-id, procfs, sysfs
• /dev/snd inotify watch for device monitoring
• RTKit realtime scheduling support
• systemd journal logging

Also adds ofono_dbus_chat() interface to ofono.if to allow bidirectional D-Bus communication between a domain and oFono.

Note: This patch depends on the pipewire policy (PR #1109). Please merge PR #1109 before this patch, as wireplumber.te uses
pipewire_stream_connect() defined in pipewire.if.

[WavyEbuilder]

This should also probably be $1_wireplumber_t for the user instances. We also seem to be missing domain transitions and rbac allows for the user, staff, and sysadm roles. How was this patch tested? I'm also a bit concerned that this won't work as expected, especially given that a huge amount of domain transitions seem to be missing.

[pebenito]

This should also probably be $1_wireplumber_t for the user instances. We also seem to be missing domain transitions and rbac allows for the user, staff, and sysadm roles. How was this patch tested? I'm also a bit concerned that this won't work as expected, especially given that a huge amount of domain transitions seem to be missing.

Having a derived domain typically depends on some specific need we can't specify otherwise, most commonly transitions out of the derived domain to another derived domain or back to the user domain. For example:

user_t -> user_foo_t -> user_t

user_t -> user_foo_t -> user_bar_t

Absent these types of issues, UBAC separations are typically sufficient.