1typeattribute gatekeeperd coredomain; 2 3init_daemon_domain(gatekeeperd) 4 5# For checking whether GSI is running 6get_prop(gatekeeperd, gsid_prop) 7 8# gatekeeperd 9binder_service(gatekeeperd) 10binder_use(gatekeeperd) 11 12### Rules needed when Gatekeeper HAL runs inside gatekeeperd process. 13### These rules should eventually be granted only when needed. 14allow gatekeeperd ion_device:chr_file r_file_perms; 15# Load HAL implementation 16allow gatekeeperd system_file:dir r_dir_perms; 17### 18 19### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process. 20### These rules should eventually be granted only when needed. 21hal_client_domain(gatekeeperd, hal_gatekeeper) 22### 23 24# need to find KeyStore and add self 25add_service(gatekeeperd, gatekeeper_service) 26 27# Need to add auth tokens to KeyStore 28use_keystore(gatekeeperd) 29allow gatekeeperd keystore:keystore2 { add_auth }; 30allow gatekeeperd authorization_service:service_manager find; 31 32 33# For permissions checking 34allow gatekeeperd system_server:binder call; 35allow gatekeeperd permission_service:service_manager find; 36 37# for SID file access 38allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms; 39allow gatekeeperd gatekeeper_data_file:file create_file_perms; 40 41# For hardware properties retrieval 42allow gatekeeperd hardware_properties_service:service_manager find; 43 44r_dir_file(gatekeeperd, cgroup) 45r_dir_file(gatekeeperd, cgroup_v2) 46