1# Rules common to all binder service domains 2 3# Allow dumpstate and incidentd to collect information from binder services 4allow binderservicedomain { dumpstate incidentd }:fd use; 5allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr }; 6allow binderservicedomain { dumpstate incidentd }:fifo_file { getattr write }; 7allow binderservicedomain shell_data_file:file { getattr write }; 8 9# Allow dumpsys to work from adb shell or the serial console 10allow binderservicedomain devpts:chr_file rw_file_perms; 11allow binderservicedomain console_device:chr_file rw_file_perms; 12 13# Receive and write to a pipe received over Binder from an app. 14allow binderservicedomain appdomain:fd use; 15allow binderservicedomain appdomain:fifo_file write; 16 17# allow all services to run permission checks 18allow binderservicedomain permission_service:service_manager find; 19 20allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify }; 21 22use_keystore(binderservicedomain) 23