AOSP 11 SElinux - still not able to allow my app an access to a serial port sue to avc denied

I am struggling now for a little too long with SElinux. I got into this point:

1. I have added my custom sepolicy folder, which I am including in BoardConfig.mk.

2. In this folder, I have added my seapp_contexts file, which adds this line:

user=_app isPrivApp=true domain=myown_app seinfo=platform name=com.serialtestapp.dwm type=privapp_data_file levelFrom=all

3. I have an app that uses /dev/ttymxc0. With adb shell setenforce 0, the app works and communicates with the serial port. WIth Selinux on, I get various avc errors and audit2allow throws rules that are violating neverallow rules and the app is not working.

4. My app Android.mk looks like this:

LOCAL_PATH := $(call my-dir)

include $(CLEAR_VARS)

LOCAL_MODULE_TAGS := optional

LOCAL_MODULE := serialtest

LOCAL_CERTIFICATE := platform

LOCAL_SRC_FILES := myapp.apk

LOCAL_MODULE_CLASS := APPS

LOCAL_PRIVILEGED_MODULE := true

LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)

include $(BUILD_PREBUILT)

5. I have written a file myown_app.te, which looks like this:

type myown_app, domain;

permissive myown_app;

app_domain(myown_app)

allow myown_app... like 50 rows of some needed things that audit2allow threw back, important ones are:

allow myown_app serial_service:service_manager find;

allow mywon_app proc:file { getattr read open };

allow mywon_app sysfs:file { getattr read open };

The questions...

When I write the line in myown_app.te like this:

type myown_app, domain;

Then my AOSP build fails on a neverallow rule, which is the serial_service:service_manager find.

If I change the line to:

type myown_app, domain, coredomain;

Then it allows me to allow serial_service:service_manager find, but it will now become breaking the neverallow rules for coredomain sysfs:file and proc:file... So what is the coredomain, what is domain, I just want my app to access a serial port... Nothing more, and I need the SElinux to be turned on. Why coredomain allows me to use the serial_service:service_manager find, but not sysfs and proc things, for domain I cant use the service_manager, but I can use sysfs and proc... I dont know what more I need to do, my app is signed with platform key, its a priv-app, I have whitelisted all of the permissions from the app xml manifest in my AOSP on privapp_permissions.xml. Please help.