Introduce new sepolicy strategy for legacy devices

The existing sepolicy patching strategy looks like this:

1. 2SI: use LD_PRELOAD to hijack `security_load_policy`
2. Split policy: devices using split policy implies it also needs to
   do early mount, which means fstab is stored in device tree.
   So we do the following:
   - Hijack the fstab node in the device tree in sysfs
   - Wait for init to mount selinuxfs for us
   - Hijack selinuxfs to intercept sepolicy loading
3. Monolithic policy: directly patch `/sepolicy`

Method #1 and #2 both has the magiskinit pre-init daemon handling
the sepolicy patching and loading process, while method #3 gives us
zero control over sepolicy loading process. Downsides:

a. Pre-init daemon bypasses the need to guess which sepolicy init
   will load, because the original init will literally send the stock
   sepolicy file directly to us with this approach.
b. If we want to add more features/functionalities during the sepolicy
   patching process, we will leave out devices using method #3

In order to solve these issues, we completely redesign the sepolicy
patching strategy for non-2SI devices. Instead of limiting usage of
pre-init daemon to early mount devices, we always intercept the
sepolicy loading process regardless of the Android version and device
setup. This will give us a unified implementation for sepolicy patching,
and will make it easier to develop further new features down the line.

native/src/sepolicy/include/sepolicy.hpp

@@ -21,3 +21,4 @@
 #define SELINUX_POLICY      SELINUX_MNT "/policy"
 #define SELINUX_LOAD        SELINUX_MNT "/load"
 #define SELINUX_VERSION     SELINUX_MNT "/policyvers"
+#define SELINUX_REQPROT     SELINUX_MNT "/checkreqprot"

native/src/sepolicy/rules.rs

@@ -104,8 +104,11 @@ impl SePolicy {
             // For tmpfs overlay on 2SI, Zygisk on lower Android versions and AVD scripts
             allow(["init", "zygote", "shell"], ["tmpfs"], ["file"], all);
 
+            // Allow magiskinit daemon to log to kmsg
+            allow(["kernel"], ["rootfs", "tmpfs"], ["chr_file"], ["write"]);
+
             // Allow magiskinit daemon to handle mock selinuxfs
-            allow(["kernel"], ["tmpfs"], ["fifo_file"], ["write"]);
+            allow(["kernel"], ["tmpfs"], ["fifo_file"], ["open", "read", "write"]);
 
             // For relabelling files
             allow(["rootfs"], ["labeledfs", "tmpfs"], ["filesystem"], ["associate"]);