1# ============================================================================== 2# Type Declaration 3# ============================================================================== 4type merged_hal_service, domain; 5#type merged_hal_service, domain; 6type merged_hal_service_exec, exec_type, file_type, vendor_file_type; 7 8init_daemon_domain(merged_hal_service) 9 10hwbinder_use(merged_hal_service) 11hal_server_domain(merged_hal_service, hal_vibrator) 12hal_server_domain(merged_hal_service, hal_light) 13hal_server_domain(merged_hal_service, hal_power) 14hal_server_domain(merged_hal_service, hal_thermal) 15hal_server_domain(merged_hal_service, hal_memtrack) 16 17#mtk libs_hidl_service permissions 18hal_server_domain(merged_hal_service, mtk_hal_lbs) 19vndbinder_use(merged_hal_service) 20#r_dir_file(merged_hal_service, system_file) 21unix_socket_connect(merged_hal_service, agpsd, mtk_agpsd); 22allow merged_hal_service mtk_agpsd:unix_dgram_socket sendto; 23 24#mtk_gnss permissions 25hal_server_domain(merged_hal_service, hal_gnss); 26allow merged_hal_service mnld_data_file:sock_file create_file_perms; 27allow merged_hal_service mnld_data_file:sock_file rw_file_perms; 28allow merged_hal_service mnld_data_file:dir create_file_perms; 29allow merged_hal_service mnld_data_file:dir rw_dir_perms; 30allow merged_hal_service mnld:unix_dgram_socket sendto; 31 32#graphics allocator permissions 33hal_server_domain(merged_hal_service, hal_graphics_allocator) 34allow merged_hal_service gpu_device:dir search; 35allow merged_hal_service sw_sync_device:chr_file rw_file_perms; 36allow merged_hal_service debugfs_ion:dir search; 37allow merged_hal_service debugfs_tracing:file write; 38allow merged_hal_service debugfs_tracing:file open; 39 40#for ape hidl permissions 41hal_server_domain(merged_hal_service,hal_mtkcodecservice) 42allow merged_hal_service hidl_allocator_hwservice:hwservice_manager find; 43allow merged_hal_service hidl_memory_hwservice:hwservice_manager find; 44hal_client_domain(merged_hal_service, hal_allocator) 45 46#for default drm permissions 47hal_server_domain(merged_hal_service, hal_drm) 48allow merged_hal_service mediacodec:fd use; 49allow merged_hal_service { appdomain -isolated_app }:fd use; 50allow merged_hal_service debugfs_tracing:file write; 51 52# Date : WK18.23 53# Operation : P Migration 54# Purpose : add grant permission for Thermal HAL mtktz and proc 55allow merged_hal_service proc_mtktz:dir search; 56allow merged_hal_service proc_mtktz:file {open read getattr}; 57allow merged_hal_service proc_stat:file {open read getattr }; 58 59#for uevent handle 60allow merged_hal_service self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 61 62#for thermal sysfs 63allow merged_hal_service sysfs_therm:file w_file_perms; 64allow merged_hal_service sysfs_therm:file r_file_perms; 65allow merged_hal_service sysfs_therm:dir search; 66 67 68# Date : WK19.11 69# Operation : Q Migration 70allowxperm merged_hal_service proc_ged:file ioctl { proc_ged_ioctls }; 71 72# Date: 2019/06/14 73# Operation : Migration 74allow merged_hal_service nvram_agent_binder_hwservice:hwservice_manager find; 75