[Keymint] Add sepolicy for keymint-citadel service
Bug: 179459878
Change-Id: Ia551606941f14c01a22e7e47b510f2edc88ef3b6
diff --git a/citadel/file_contexts b/citadel/file_contexts
index fd80454..9ee44e2 100644
--- a/citadel/file_contexts
+++ b/citadel/file_contexts
@@ -9,3 +9,4 @@
/vendor/bin/hw/citadeld u:object_r:citadeld_exec:s0
/vendor/bin/hw/init_citadel u:object_r:init_citadel_exec:s0
/vendor/bin/hw/wait_for_strongbox u:object_r:wait_for_strongbox_exec:s0
+/vendor/bin/hw/android.hardware.security.keymint-service.citadel u:object_r:hal_keymint_citadel_exec:s0
diff --git a/citadel/hal_keymint_citadel.te b/citadel/hal_keymint_citadel.te
new file mode 100644
index 0000000..130306a
--- /dev/null
+++ b/citadel/hal_keymint_citadel.te
@@ -0,0 +1,11 @@
+type hal_keymint_citadel, domain;
+type hal_keymint_citadel_exec, exec_type, vendor_file_type, file_type;
+
+vndbinder_use(hal_keymint_citadel)
+binder_call(hal_keymint_citadel, citadeld)
+allow hal_keymint_citadel citadeld_service:service_manager find;
+
+hal_server_domain(hal_keymint_citadel, hal_keymint)
+init_daemon_domain(hal_keymint_citadel)
+
+get_prop(hal_keymint_citadel, vendor_security_patch_level_prop)