1# hwservice types. By default most of the HALs are protected_hwservice, which means 2# access from untrusted apps is prohibited. 3type default_android_hwservice, hwservice_manager_type, protected_hwservice; 4type fwk_camera_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 5type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 6type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 7type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 8type fwk_stats_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 9type fwk_automotive_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 10type hal_atrace_hwservice, hwservice_manager_type, protected_hwservice; 11type hal_audio_hwservice, hwservice_manager_type, protected_hwservice; 12type hal_audiocontrol_hwservice, hwservice_manager_type, protected_hwservice; 13type hal_authsecret_hwservice, hwservice_manager_type, protected_hwservice; 14type hal_bluetooth_hwservice, hwservice_manager_type, protected_hwservice; 15type hal_bootctl_hwservice, hwservice_manager_type, protected_hwservice; 16type hal_broadcastradio_hwservice, hwservice_manager_type, protected_hwservice; 17type hal_camera_hwservice, hwservice_manager_type, protected_hwservice; 18type hal_can_bus_hwservice, hwservice_manager_type, protected_hwservice; 19type hal_can_controller_hwservice, hwservice_manager_type, protected_hwservice; 20type hal_confirmationui_hwservice, hwservice_manager_type, protected_hwservice; 21type hal_contexthub_hwservice, hwservice_manager_type, protected_hwservice; 22type hal_dumpstate_hwservice, hwservice_manager_type, protected_hwservice; 23type hal_evs_hwservice, hwservice_manager_type, protected_hwservice; 24type hal_face_hwservice, hwservice_manager_type, protected_hwservice; 25type hal_fingerprint_hwservice, hwservice_manager_type, protected_hwservice; 26type hal_gatekeeper_hwservice, hwservice_manager_type, protected_hwservice; 27type hal_gnss_hwservice, hwservice_manager_type, protected_hwservice; 28type hal_graphics_composer_hwservice, hwservice_manager_type, protected_hwservice; 29type hal_health_hwservice, hwservice_manager_type, protected_hwservice; 30type hal_health_storage_hwservice, hwservice_manager_type, protected_hwservice; 31type hal_input_classifier_hwservice, hwservice_manager_type, protected_hwservice; 32type hal_ir_hwservice, hwservice_manager_type, protected_hwservice; 33type hal_keymaster_hwservice, hwservice_manager_type, protected_hwservice; 34type hal_light_hwservice, hwservice_manager_type, protected_hwservice; 35type hal_lowpan_hwservice, hwservice_manager_type, protected_hwservice; 36type hal_memtrack_hwservice, hwservice_manager_type, protected_hwservice; 37type hal_nfc_hwservice, hwservice_manager_type, protected_hwservice; 38type hal_oemlock_hwservice, hwservice_manager_type, protected_hwservice; 39type hal_power_hwservice, hwservice_manager_type, protected_hwservice; 40type hal_power_stats_hwservice, hwservice_manager_type, protected_hwservice; 41type hal_secure_element_hwservice, hwservice_manager_type, protected_hwservice; 42type hal_sensors_hwservice, hwservice_manager_type, protected_hwservice; 43type hal_telephony_hwservice, hwservice_manager_type, protected_hwservice; 44type hal_tetheroffload_hwservice, hwservice_manager_type, protected_hwservice; 45type hal_thermal_hwservice, hwservice_manager_type, protected_hwservice; 46type hal_tv_cec_hwservice, hwservice_manager_type, protected_hwservice; 47type hal_tv_input_hwservice, hwservice_manager_type, protected_hwservice; 48type hal_tv_tuner_hwservice, hwservice_manager_type, protected_hwservice; 49type hal_usb_gadget_hwservice, hwservice_manager_type, protected_hwservice; 50type hal_usb_hwservice, hwservice_manager_type, protected_hwservice; 51type hal_vehicle_hwservice, hwservice_manager_type, protected_hwservice; 52type hal_vibrator_hwservice, hwservice_manager_type, protected_hwservice; 53type hal_vr_hwservice, hwservice_manager_type, protected_hwservice; 54type hal_weaver_hwservice, hwservice_manager_type, protected_hwservice; 55type hal_wifi_hostapd_hwservice, hwservice_manager_type, protected_hwservice; 56type hal_wifi_hwservice, hwservice_manager_type, protected_hwservice; 57type hal_wifi_supplicant_hwservice, hwservice_manager_type, protected_hwservice; 58type system_net_netd_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 59type system_suspend_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 60type system_wifi_keystore_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice; 61 62# Following is the hwservices that are explicitly not marked with protected_hwservice. 63# These are directly accessible from untrusted apps. 64# - same process services: because they by definition run in the process 65# of the client and thus have the same access as the client domain in which 66# the process runs 67# - coredomain_hwservice: are considered safer than ordinary hwservices which 68# are from vendor partition 69# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been 70# designed for use by any domain. 71# - hal_graphics_allocator_hwservice: because these operations are also offered 72# by surfaceflinger Binder service, which apps are permitted to access 73# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec 74# Binder service which apps were permitted to access. 75# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice. 76# - hal_drm_hwservice: versions > API 29 are designed specifically with 77# untrusted app access in mind. 78type fwk_bufferhub_hwservice, hwservice_manager_type, coredomain_hwservice; 79type hal_cas_hwservice, hwservice_manager_type; 80type hal_codec2_hwservice, hwservice_manager_type; 81type hal_configstore_ISurfaceFlingerConfigs, hwservice_manager_type; 82type hal_drm_hwservice, hwservice_manager_type; 83type hal_graphics_allocator_hwservice, hwservice_manager_type; 84type hal_graphics_mapper_hwservice, hwservice_manager_type, same_process_hwservice; 85type hal_neuralnetworks_hwservice, hwservice_manager_type; 86type hal_omx_hwservice, hwservice_manager_type; 87type hal_renderscript_hwservice, hwservice_manager_type, same_process_hwservice; 88type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice; 89type hidl_base_hwservice, hwservice_manager_type; 90type hidl_manager_hwservice, hwservice_manager_type, coredomain_hwservice; 91type hidl_memory_hwservice, hwservice_manager_type, coredomain_hwservice; 92type hidl_token_hwservice, hwservice_manager_type, coredomain_hwservice; 93 94### 95### Neverallow rules 96### 97 98# hwservicemanager handles registering or looking up named services. 99# It does not make sense to register or lookup something which is not a 100# hwservice. Trigger a compile error if this occurs. 101neverallow domain ~hwservice_manager_type:hwservice_manager { add find }; 102