1 type gatekeeperd, domain; 2 type gatekeeperd_exec, exec_type, file_type; 3 4 # gatekeeperd 5 binder_service(gatekeeperd) 6 binder_use(gatekeeperd) 7 8 ### Rules needed when Gatekeeper HAL runs inside gatekeeperd process. 9 ### These rules should eventually be granted only when needed. 10 allow gatekeeperd tee_device:chr_file rw_file_perms; 11 allow gatekeeperd ion_device:chr_file r_file_perms; 12 # Load HAL implementation 13 allow gatekeeperd system_file:dir r_dir_perms; 14 ### 15 16 ### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process. 17 ### These rules should eventually be granted only when needed. 18 hal_client_domain(gatekeeperd, hal_gatekeeper) 19 ### 20 21 # need to find KeyStore and add self 22 add_service(gatekeeperd, gatekeeper_service) 23 24 # Need to add auth tokens to KeyStore 25 use_keystore(gatekeeperd) 26 allow gatekeeperd keystore:keystore_key { add_auth }; 27 28 # For permissions checking 29 allow gatekeeperd system_server:binder call; 30 allow gatekeeperd permission_service:service_manager find; 31 32 # for SID file access 33 allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms; 34 allow gatekeeperd gatekeeper_data_file:file create_file_perms; 35 36 # For hardware properties retrieval 37 allow gatekeeperd hardware_properties_service:service_manager find; 38 39 r_dir_file(gatekeeperd, cgroup) 40
