Android permission cannot init repo: `scontext=u:r:untrusted_app:s0:c223,c256,c512,c768 tcontext=u:object_r:app_data_file:s0:c223,c256,c512,c768 tclass=file permissive=0`

I'm using Tauri to develop git-based mobile code editor. When trying to initiate a git repo, I got this strange message:

06-22 12:20:13.301 12486 12501 I smbcloud.Movibe: Compiler allocated 5042KB to compile void android.view.ViewRootImpl.performTraversals()
06-22 12:20:15.455 12486 12486 W JavaBridge: type=1400 audit(0.0:252): avc:  denied  { link } for  name="HEAD.lock" dev="dm-55" ino=361855 scontext=u:r:untrusted_app:s0:c223,c256,c512,c768 tcontext=u:object_r:app_data_file:s0:c223,c256,c512,c768 tclass=file permissive=0 app=xyz.smbcloud.Movibe
06-22 12:20:15.508 12486 12486 E Tauri/Console: File: http://tauri.localhost/src/components/Sidebar.tsx - Line 74 - Msg: Failed to create project: Failed to create project

I setup the FS permission like so:

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android">
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

init.rs

use git2::{Error, Repository};
use log::debug;
use std::path::Path;

/// Initializes a new git repository at the given path.
/// Returns Ok(()) if successful, or Err(git2::Error) if initialization fails.
pub fn init_repo(repo_path: &Path) -> Result<(), Error> {
    debug!("Initializing git repository at {:?}", repo_path);
    let result = Repository::init(repo_path);
    match &result {
        Ok(_) => debug!("Successfully initialized git repository at {:?}", repo_path),
        Err(e) => debug!(
            "Failed to initialize git repository at {:?}: {:?}",
            repo_path, e
        ),
    }
    result.map(|_| ())
}

tauri command:

#[tauri::command]
pub fn create_project(app: AppHandle) -> String {
    debug!("create_project called");
    // Get the app data directory safely
    let app_data_dir = match app.path().app_data_dir() {
        Ok(path) => path,
        Err(_) => {
            debug!("Failed to get app_data_dir");
            return String::from("ERROR");
        }
    };

    // Generate uuid project name
    let project_name = Uuid::new_v4().to_string();
    let project_path = app_data_dir.join(&project_name);
    debug!("Generated project_path: {:?}", project_path);

    match fc::create_directory(project_path.to_str().unwrap_or("")) {
        Ok(_) => {
            debug!("Directory created at {:?}", project_path);
            // Initialize git repository
            if let Err(e) = init_repo(&project_path) {
                debug!("Failed to initialize git repo: {:?}", e);
                return String::from("ERROR");
            }
            // Return the full project path as a string
            let path_str = project_path.to_string_lossy().to_string();
            debug!("Project created successfully at {}", path_str);
            path_str
        }
        Err(e) => {
            debug!("Failed to create directory: {:?}", e);
            String::from("ERROR")
        }
    }
}

default capabilities:

{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "run-app-default",
  "description": "Capability for the main window",
  "windows": ["main"],
  "permissions": [
    "core:default",
    "opener:default",
    "dialog:allow-open",
    "dialog:allow-save",
    "dialog:allow-message",
    "dialog:allow-ask",
    "dialog:allow-confirm",
    "notification:default",
    "fs:allow-read-file",
    "fs:allow-write-file",
    "fs:allow-read-dir",
    "fs:allow-copy-file",
    "fs:allow-mkdir",
    "fs:allow-remove",
    "fs:allow-rename",
    "fs:allow-exists",
    "log:default",
    "os:default",
    "fs:default"
  ]
}

mobile capabilities:

{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "run-app-mobile",
  "description": "Permissions to run the app (mobile only)",
  "windows": [
    "main"
  ],
  "platforms": [
    "android",
    "iOS"
  ],
  "permissions": [
    "os:default",
    "log:default",
    "fs:default"
  ]
}

Any help or pointers greatly appreciate.

Start with the reported init.rs wrapper and the create_project Tauri command, then compare the Android SELinux denial with the app_data_dir path used by Repository::init. The issue would need to establish whether the failure belongs in git2-rs or the application’s Android permissions and configuration before a repository change can be defined.