private/coredomain.te

get_prop(coredomain, pm_prop)
get_prop(coredomain, exported_pm_prop)

full_treble_only(`
neverallow {
    coredomain

    # for chowning
    -init

    # generic access to sysfs_type
    -ueventd
    -vold
} sysfs_leds:file *;
')