title: Is it possible to connect SELinux policy with Android permissions?
body: <p>I'd like to grant Android permissions (e.g. android.permission.DELETE_PACKAGES, which has protectionLevel=system|signature) to apps signed by a given signature and/or with a given package name from SELinux policies, but so far I haven't found a way that works.  The mac_permissions.xml file used to accept an allow-permission tag that accepted Android permission strings, but <a href="https://android.googlesource.com/platform/frameworks/base/+/lollipop-mr1-cts-release/services/core/java/com/android/server/pm/SELinuxMMAC.java" rel="nofollow">based on the Lollipop code</a> that parses it, that tag doesn't seem to be supported anymore.  I tried using it anyway, and it definitely seemed to be ignored by the system.  </p>
  
  <p>Ideally, I'd only have to add/modify SELinux policy files as opposed to core AndroidManifest files that declare the restricted permissions and specify their protection levels.  Assume that apps with the given signature/package wouldn't otherwise be granted said permissions by PackageManager because they lack any of the special privileges that Android permission protection levels recognize (signed by platform cert, installed in /system, etc.), and that the permission is a system permission (i.e. declared by the <a href="https://android.googlesource.com/platform/frameworks/base/+/lollipop-mr1-cts-release/core/res/AndroidManifest.xml" rel="nofollow">frameworks/base/core/res AndroidManifest</a>) that is declared at OS build time.</p>
  
  <p>Is there a way to allow a given app signature/package to use a given Android permission from SELinux?  </p>