1# HwBinder IPC from client to server, and callbacks 2binder_call(hal_neuralnetworks_client, hal_neuralnetworks_server) 3binder_call(hal_neuralnetworks_server, hal_neuralnetworks_client) 4 5hal_attribute_hwservice(hal_neuralnetworks, hal_neuralnetworks_hwservice) 6allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find; 7allow hal_neuralnetworks hal_allocator:fd use; 8allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find; 9allow hal_neuralnetworks hal_graphics_allocator:fd use; 10 11# Allow NN HAL service to use a client-provided fd residing in /data/data/. 12allow hal_neuralnetworks_server app_data_file:file { read write getattr map }; 13allow hal_neuralnetworks_server privapp_data_file:file { read write getattr map }; 14 15# Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/. 16allow hal_neuralnetworks_server shell_data_file:file { read write getattr map }; 17 18# Allow NN HAL service to read a client-provided ION memory fd. 19allow hal_neuralnetworks_server ion_device:chr_file r_file_perms; 20 21# Allow NN HAL service to use a client-provided fd residing in /storage 22allow hal_neuralnetworks_server storage_file:file { getattr map read }; 23 24# Allow NN HAL service to read a client-provided fd residing in /data/app/. 25allow hal_neuralnetworks_server apk_data_file:file { getattr map read }; 26 27# Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product 28# property to determine whether to deny NNAPI extensions use for apps 29# on product partition (apps in GSI are not allowed to use NNAPI extensions). 30get_prop(hal_neuralnetworks_client, nnapi_ext_deny_product_prop); 31# This property is only expected to be found in /product/build.prop, 32# allow to be set only by init. 33neverallow { domain -init } nnapi_ext_deny_product_prop:property_service set; 34 35# Define sepolicy for NN AIDL HAL service 36hal_attribute_service(hal_neuralnetworks, hal_neuralnetworks_service) 37binder_call(hal_neuralnetworks_server, servicemanager) 38 39binder_use(hal_neuralnetworks_server) 40 41allow hal_neuralnetworks_server dumpstate:fifo_file write; 42