selinux: Enhance Wayland SEPolicy rules

Introduce a new interface, wayland_stream_connect(), which allows
domains to connect to a Wayland compositor via UNIX stream
sockets. The interface grants permissions to search user runtime
directories and establish connections to sockets labeled with
wayland_runtime_t, enabling confined domains such as container
runtimes or applications to communicate with the Wayland display
server.

Extend Wayland socket labeling by adding a file context rule for
/run/wayland-*, ensuring sockets created directly under /run are
labeled as wayland_runtime_t. This addresses systems where
Wayland operates outside of per-user runtime directories,
providing consistent behavior across embedded and single-user
environments.

Signed-off-by: Kemal Rasim Sh <kshakir@qti.qualcomm.com>

Author: Kemal Rasim Sh

dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted/0002-wayland-Add-wayland_stream_connect-interface.patch

@@ -0,0 +1,55 @@
+From 86ee8eb9fb4226ba11e02254b12278c9de446f8a Mon Sep 17 00:00:00 2001
+From: Kemal Rasim Sh <kshakir@qti.qualcomm.com>
+Date: Fri, 19 Jun 2026 13:30:02 +0300
+Subject: [PATCH 2/3] wayland: Add wayland_stream_connect interface
+
+Add a new interface, wayland_stream_connect(), to allow domains to
+connect to a Wayland compositor via a UNIX stream socket.
+
+This interface grants the necessary permissions to search the user
+runtime directory and establish a stream connection to Wayland
+compositor sockets labeled with wayland_runtime_t.
+
+Typical usage includes enabling confined domains (such as container
+runtimes or applications) to communicate with the Wayland display server.
+
+Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/pull/1166]
+
+Signed-off-by: Kemal Rasim Sh <kshakir@qti.qualcomm.com>
+---
+ policy/modules/session/wayland.if | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/policy/modules/session/wayland.if b/policy/modules/session/wayland.if
+index 2812dcb30..bc4185c2a 100644
+--- a/policy/modules/session/wayland.if
++++ b/policy/modules/session/wayland.if
+@@ -99,3 +99,25 @@ interface(`wayland_client_sandboxed_domain',`
+ 
+ 	typeattribute $1 wayland_client_sandboxed;
+ ')
++
++#########################################
++## <summary>
++##	Connect to the Wayland compositor
++##	using a UNIX domain stream socket.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`wayland_stream_connect',`
++	gen_require(`
++		type wayland_runtime_t;
++	')
++
++	files_search_runtime($1)
++	userdom_search_user_runtime($1)
++	allow $1 wayland_runtime_t:sock_file write_sock_file_perms;
++	allow $1 wayland_runtime_t:unix_stream_socket connectto;
++')
+-- 
+2.43.0
+

dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted/0003-wayland-Label-sockets-under-run-with-wayland_runtime.patch

@@ -0,0 +1,31 @@
+From d4a85ae3abdbac8065b6389a103723755866af2c Mon Sep 17 00:00:00 2001
+From: Kemal Rasim Sh <kshakir@qti.qualcomm.com>
+Date: Mon, 22 Jun 2026 15:49:44 +0300
+Subject: [PATCH 3/3] wayland: Label sockets under /run with wayland_runtime_t
+
+On some embedded or single-user systems the Wayland socket
+(e.g. wayland-0) is created directly under /run instead of
+/run/user/<uid>/. The existing policy only covers per-user runtime
+directories, leaving these sockets unlabeled.
+
+Add a file context rule for /run/wayland-* to ensure such sockets are
+correctly labeled with wayland_runtime_t, aligning behavior across
+different system configurations.
+
+Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/pull/1166]
+
+Signed-off-by: Kemal Rasim Sh <kshakir@qti.qualcomm.com>
+---
+ policy/modules/session/wayland.fc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/session/wayland.fc b/policy/modules/session/wayland.fc
+index 73151efba..bd2ccc08e 100644
+--- a/policy/modules/session/wayland.fc
++++ b/policy/modules/session/wayland.fc
+@@ -1 +1,2 @@
+ /run/user/%{USERID}/wayland-.*	-s	gen_context(system_u:object_r:wayland_runtime_t,s0)
++/run/wayland-.*		-s	gen_context(system_u:object_r:wayland_runtime_t,s0)
+-- 
+2.43.0
+

dynamic-layers/selinux/recipes-security/refpolicy/refpolicy-targeted_git.bbappend

@@ -2,4 +2,6 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
 
 SRC_URI:append:qcom = " \
     file://0001-container-Allow-access-to-etc-cdi-for-CDI-configurat.patch \
+    file://0002-wayland-Add-wayland_stream_connect-interface.patch \
+    file://0003-wayland-Label-sockets-under-run-with-wayland_runtime.patch \
 "