先看錯誤：
type=1400 avc: denied { connectto } for pid=6884 scontext=u:r:?untrusted_app:s0:c512,c768 tcontext=u:r:bluetooth:s0 tclass=unix_stream_socket permissive=0

根據規(guī)則正常的修改：
allow ?untrusted_app bluetooth:unix_stream_socket connectto;

然而修改后發(fā)現(xiàn)沒生效落剪， 納尼唧垦！

后來發(fā)現(xiàn)這么一條規(guī)則：

mlsconstrain unix_stream_socket { connectto }
              (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);

這條導致即使上面驗證通過攘须， 這一條沒通過胰耗， 同樣不能執(zhí)行祟剔。
這條規(guī)則通過的3個條件:
l1 eq l2 -- l1 = s0:c512,c768 and l2 = s0 顯然不成立
t1 == mlstrustedsubject 顯然不成立
t2 == mlstrustedsubject 顯然不成立

如果想使這條生效：
type bluetooth, domain, mlstrustedsubject;

原因分析：
（PS: 5.1 不用加最后一句話, 6.0 需要加最后一句話 ）
5.1 : user=_app domain=untrusted_app type=app_data_file
6.0 : user=_app domain=untrusted_app type=app_data_file levelFrom=user

levelFrom=user 導致 Slevel 從 s0 變成 s0:c512,c768
5.1 沒有這句話傅事， 所以條件 l1 eq l2 成立。

The levelFrom and level components if present will be used to determine
the level component of the security context as follows:
a) if levelFrom=none then use current level.
b) else if levelFrom=app then compute a category pair based on a
derived app id with a starting base of c512,c768 base.
c) else if levelFrom=user then compute a category pair based on a
derived user id with a starting base of c0,c256 base.
d) else if levelFrom=all then compute a category pair based on a
derived app id with a starting base of c512,c768 base, and also
compute another category pair based on a derived user id with a
starting base of c0,c256 base.
e) else if level has a value use this as the context level.
The overall objective is that the computed levels should never be the same for
different apps, users, or a combination of both. By encoding each ID as a
category pair, up to 2^16 app IDs and up to 2^16 user IDs within the 1024
categories can be represented, including the levelFrom=all or mixed
usage of levelFrom=app and levelFrom=user without concern.