diff --git a/keystore2/src/attestation_key_utils.rs b/keystore2/src/attestation_key_utils.rs
index b6a8e31..a8c1ca9 100644
--- a/keystore2/src/attestation_key_utils.rs
+++ b/keystore2/src/attestation_key_utils.rs
@@ -109,7 +109,7 @@
                     KeyType::Client,
                     KeyEntryLoadBits::BOTH,
                     caller_uid,
-                    |k, av| check_key_permission(KeyPerm::use_(), k, &av),
+                    |k, av| check_key_permission(KeyPerm::Use, k, &av),
                 )
                 .context("In load_attest_key_blob_and_cert: Failed to load key.")?;
 
diff --git a/keystore2/src/database.rs b/keystore2/src/database.rs
index ae2875c..d73cc8b 100644
--- a/keystore2/src/database.rs
+++ b/keystore2/src/database.rs
@@ -3704,8 +3704,8 @@
             alias: Some("key".to_string()),
             blob: None,
         };
-        const PVEC1: KeyPermSet = key_perm_set![KeyPerm::use_(), KeyPerm::get_info()];
-        const PVEC2: KeyPermSet = key_perm_set![KeyPerm::use_()];
+        const PVEC1: KeyPermSet = key_perm_set![KeyPerm::Use, KeyPerm::GetInfo];
+        const PVEC2: KeyPermSet = key_perm_set![KeyPerm::Use];
 
         // Reset totally predictable random number generator in case we
         // are not the first test running on this thread.
@@ -4181,7 +4181,7 @@
                 },
                 1,
                 2,
-                key_perm_set![KeyPerm::use_()],
+                key_perm_set![KeyPerm::Use],
                 |_k, _av| Ok(()),
             )
             .unwrap();
@@ -4191,7 +4191,7 @@
         let (_key_guard, key_entry) = db
             .load_key_entry(&granted_key, KeyType::Client, KeyEntryLoadBits::BOTH, 2, |k, av| {
                 assert_eq!(Domain::GRANT, k.domain);
-                assert!(av.unwrap().includes(KeyPerm::use_()));
+                assert!(av.unwrap().includes(KeyPerm::Use));
                 Ok(())
             })
             .unwrap();
@@ -4238,7 +4238,7 @@
             },
             OWNER_UID,
             GRANTEE_UID,
-            key_perm_set![KeyPerm::use_()],
+            key_perm_set![KeyPerm::Use],
             |_k, _av| Ok(()),
         )
         .unwrap();
@@ -4257,7 +4257,7 @@
                 |k, av| {
                     assert_eq!(Domain::APP, k.domain);
                     assert_eq!(OWNER_UID as i64, k.nspace);
-                    assert!(av.unwrap().includes(KeyPerm::use_()));
+                    assert!(av.unwrap().includes(KeyPerm::Use));
                     Ok(())
                 },
             )
@@ -5675,7 +5675,7 @@
             },
             OWNER as u32,
             123,
-            key_perm_set![KeyPerm::use_()],
+            key_perm_set![KeyPerm::Use],
             |_, _| Ok(()),
         )?;
 
diff --git a/keystore2/src/maintenance.rs b/keystore2/src/maintenance.rs
index eb06784..3f6cf36 100644
--- a/keystore2/src/maintenance.rs
+++ b/keystore2/src/maintenance.rs
@@ -227,9 +227,9 @@
                                 KeyEntryLoadBits::NONE,
                                 caller_uid,
                                 |k, av| {
-                                    check_key_permission(KeyPerm::use_(), k, &av)?;
-                                    check_key_permission(KeyPerm::delete(), k, &av)?;
-                                    check_key_permission(KeyPerm::grant(), k, &av)
+                                    check_key_permission(KeyPerm::Use, k, &av)?;
+                                    check_key_permission(KeyPerm::Delete, k, &av)?;
+                                    check_key_permission(KeyPerm::Grant, k, &av)
                                 },
                             )
                         })
@@ -245,7 +245,7 @@
             };
 
             db.borrow_mut().migrate_key_namespace(key_id_guard, destination, caller_uid, |k| {
-                check_key_permission(KeyPerm::rebind(), k, &None)
+                check_key_permission(KeyPerm::Rebind, k, &None)
             })
         })
     }
diff --git a/keystore2/src/permission.rs b/keystore2/src/permission.rs
index 0a8eec7..f280341 100644
--- a/keystore2/src/permission.rs
+++ b/keystore2/src/permission.rs
@@ -47,159 +47,49 @@
     KEYSTORE2_KEY_LABEL_BACKEND.lookup(&namespace.to_string())
 }
 
-/// ## Background
-///
-/// AIDL enums are represented as constants of the form:
-/// ```
-/// mod EnumName {
-///     pub type EnumName = i32;
-///     pub const Variant1: EnumName = <value1>;
-///     pub const Variant2: EnumName = <value2>;
-///     ...
-/// }
-///```
-/// This macro wraps the enum in a new type, e.g., `MyPerm` and maps each variant to an SELinux
-/// permission while providing the following interface:
-///  * From<EnumName> and Into<EnumName> are implemented. Where the implementation of From maps
-///    any variant not specified to the default.
-///  * Every variant has a constructor with a name corresponding to its lower case SELinux string
-///    representation.
-///  * `MyPerm.name()(&self)` returns the SELinux string representation of the
-///    represented permission.
-///
-/// ## Special behavior
-/// If the keyword `use` appears as an selinux name `use_` is used as identifier for the
-/// constructor function (e.g. `MePerm::use_()`) but the string returned by `name()` will
-/// still be `"use"`.
-///
-/// ## Example
-/// ```
-/// implement_permission!(
-///     /// MyPerm documentation.
-///     #[derive(Clone, Copy, Debug, PartialEq)]
-///     MyPerm from EnumName with default (None, none) {}
-///         Variant1,    selinux name: variant1;
-///         Variant2,    selinux name: variant1;
-///     }
-/// );
-/// ```
-macro_rules! implement_permission_aidl {
-    // This rule provides the public interface of the macro. And starts the preprocessing
-    // recursion (see below).
-    ($(#[$m:meta])* $name:ident from $aidl_name:ident with default ($($def:tt)*)
-        { $($element:tt)* })
-    => {
-        implement_permission_aidl!(@replace_use $($m)*, $name, $aidl_name, ($($def)*), [],
-            $($element)*);
-    };
-
-    // The following three rules recurse through the elements of the form
-    // `<enum variant>, selinux name: <selinux_name>;`
-    // preprocessing the input.
-
-    // The first rule terminates the recursion and passes the processed arguments to the final
-    // rule that spills out the implementation.
-    (@replace_use $($m:meta)*, $name:ident, $aidl_name:ident, ($($def:tt)*), [$($out:tt)*], ) => {
-        implement_permission_aidl!(@end $($m)*, $name, $aidl_name, ($($def)*) { $($out)* } );
-    };
-
-    // The second rule is triggered if the selinux name of an element is literally `use`.
-    // It produces the tuple `<enum variant>, use_, use;`
-    // and appends it to the out list.
-    (@replace_use $($m:meta)*, $name:ident, $aidl_name:ident, ($($def:tt)*), [$($out:tt)*],
-        $e_name:ident, selinux name: use; $($element:tt)*)
-    => {
-        implement_permission_aidl!(@replace_use $($m)*, $name, $aidl_name, ($($def)*),
-                              [$($out)* $e_name, use_, use;], $($element)*);
-    };
-
-    // The third rule is the default rule which replaces every input tuple with
-    // `<enum variant>, <selinux_name>, <selinux_name>;`
-    // and appends the result to the out list.
-    (@replace_use $($m:meta)*, $name:ident, $aidl_name:ident, ($($def:tt)*), [$($out:tt)*],
-        $e_name:ident, selinux name: $e_str:ident; $($element:tt)*)
-    => {
-        implement_permission_aidl!(@replace_use $($m)*, $name, $aidl_name, ($($def)*),
-                              [$($out)* $e_name, $e_str, $e_str;], $($element)*);
-    };
-
-    (@end $($m:meta)*, $name:ident, $aidl_name:ident,
-        ($def_name:ident, $def_selinux_name:ident) {
-            $($element_name:ident, $element_identifier:ident,
-                $selinux_name:ident;)*
-        })
-    =>
-    {
-        $(#[$m])*
-        pub struct $name(pub $aidl_name);
-
-        impl From<$aidl_name> for $name {
-            fn from (p: $aidl_name) -> Self {
-                match p {
-                    $aidl_name::$def_name => Self($aidl_name::$def_name),
-                    $($aidl_name::$element_name => Self($aidl_name::$element_name),)*
-                    _ => Self($aidl_name::$def_name),
-                }
-            }
-        }
-
-        impl From<$name> for $aidl_name {
-            fn from(p: $name) -> $aidl_name {
-                p.0
-            }
-        }
-
-        impl ClassPermission for $name {
-            fn name(&self) -> &'static str {
-                match self {
-                    Self($aidl_name::$def_name) => stringify!($def_selinux_name),
-                    $(Self($aidl_name::$element_name) => stringify!($selinux_name),)*
-                    _ => stringify!($def_selinux_name),
-                }
-            }
-            fn class_name(&self) -> &'static str {
-                "keystore2_key"
-            }
-        }
-
-        impl $name {
-            /// Creates an instance representing a permission with the same name.
-            pub const fn $def_selinux_name() -> Self { Self($aidl_name::$def_name) }
-            $(
-                /// Creates an instance representing a permission with the same name.
-                pub const fn $element_identifier() -> Self { Self($aidl_name::$element_name) }
-            )*
-        }
-    };
-}
-
-implement_permission_aidl!(
+implement_class!(
     /// KeyPerm provides a convenient abstraction from the SELinux class `keystore2_key`.
     /// At the same time it maps `KeyPermissions` from the Keystore 2.0 AIDL Grant interface to
-    /// the SELinux permissions. With the implement_permission macro, we conveniently
-    /// provide mappings between the wire type bit field values, the rust enum and the SELinux
-    /// string representation.
-    ///
-    /// ## Example
-    ///
-    /// In this access check `KeyPerm::get_info().to_selinux()` would return the SELinux representation
-    /// "info".
-    /// ```
-    /// selinux::check_permission(source_context, target_context, KeyPerm::get_info());
-    /// ```
-    #[derive(Clone, Copy, Debug, Eq, PartialEq)]
-    KeyPerm from KeyPermission with default (NONE, none) {
-        CONVERT_STORAGE_KEY_TO_EPHEMERAL,   selinux name: convert_storage_key_to_ephemeral;
-        DELETE,         selinux name: delete;
-        GEN_UNIQUE_ID,  selinux name: gen_unique_id;
-        GET_INFO,       selinux name: get_info;
-        GRANT,          selinux name: grant;
-        MANAGE_BLOB,    selinux name: manage_blob;
-        REBIND,         selinux name: rebind;
-        REQ_FORCED_OP,  selinux name: req_forced_op;
-        UPDATE,         selinux name: update;
-        USE,            selinux name: use;
-        USE_DEV_ID,     selinux name: use_dev_id;
+    /// the SELinux permissions.
+    #[repr(i32)]
+    #[selinux(class_name = keystore2_key)]
+    #[derive(Clone, Copy, Debug, PartialEq)]
+    pub enum KeyPerm {
+        /// Checked when convert_storage_key_to_ephemeral is called.
+        #[selinux(name = convert_storage_key_to_ephemeral)]
+        ConvertStorageKeyToEphemeral = KeyPermission::CONVERT_STORAGE_KEY_TO_EPHEMERAL.0,
+        /// Checked when the caller tries do delete a key.
+        #[selinux(name = delete)]
+        Delete = KeyPermission::DELETE.0,
+        /// Checked when the caller tries to use a unique id.
+        #[selinux(name = gen_unique_id)]
+        GenUniqueId = KeyPermission::GEN_UNIQUE_ID.0,
+        /// Checked when the caller tries to load a key.
+        #[selinux(name = get_info)]
+        GetInfo = KeyPermission::GET_INFO.0,
+        /// Checked when the caller attempts to grant a key to another uid.
+        /// Also used for gating key migration attempts.
+        #[selinux(name = grant)]
+        Grant = KeyPermission::GRANT.0,
+        /// Checked when the caller attempts to use Domain::BLOB.
+        #[selinux(name = manage_blob)]
+        ManageBlob = KeyPermission::MANAGE_BLOB.0,
+        /// Checked when the caller tries to create a key which implies rebinding
+        /// an alias to the new key.
+        #[selinux(name = rebind)]
+        Rebind = KeyPermission::REBIND.0,
+        /// Checked when the caller attempts to create a forced operation.
+        #[selinux(name = req_forced_op)]
+        ReqForcedOp = KeyPermission::REQ_FORCED_OP.0,
+        /// Checked when the caller attempts to update public key artifacts.
+        #[selinux(name = update)]
+        Update = KeyPermission::UPDATE.0,
+        /// Checked when the caller attempts to use a private or public key.
+        #[selinux(name = use)]
+        Use = KeyPermission::USE.0,
+        /// Checked when the caller attempts to use device ids for attestation.
+        #[selinux(name = use_dev_id)]
+        UseDevId = KeyPermission::USE_DEV_ID.0,
     }
 );
 
@@ -268,17 +158,17 @@
 ///
 /// ## Example
 /// ```
-/// let perms1 = key_perm_set![KeyPerm::use_(), KeyPerm::manage_blob(), KeyPerm::grant()];
-/// let perms2 = key_perm_set![KeyPerm::use_(), KeyPerm::manage_blob()];
+/// let perms1 = key_perm_set![KeyPerm::Use, KeyPerm::ManageBlob, KeyPerm::Grant];
+/// let perms2 = key_perm_set![KeyPerm::Use, KeyPerm::ManageBlob];
 ///
 /// assert!(perms1.includes(perms2))
 /// assert!(!perms2.includes(perms1))
 ///
 /// let i = perms1.into_iter();
 /// // iteration in ascending order of the permission's numeric representation.
-/// assert_eq(Some(KeyPerm::manage_blob()), i.next());
-/// assert_eq(Some(KeyPerm::grant()), i.next());
-/// assert_eq(Some(KeyPerm::use_()), i.next());
+/// assert_eq(Some(KeyPerm::ManageBlob), i.next());
+/// assert_eq(Some(KeyPerm::Grant), i.next());
+/// assert_eq(Some(KeyPerm::Use), i.next());
 /// assert_eq(None, i.next());
 /// ```
 #[derive(Copy, Clone, Debug, Eq, PartialEq, Ord, PartialOrd)]
@@ -309,7 +199,7 @@
                 let p = self.vec.0 & (1 << self.pos);
                 self.pos += 1;
                 if p != 0 {
-                    return Some(KeyPerm::from(KeyPermission(p)));
+                    return Some(KeyPerm::from(p));
                 }
             }
         }
@@ -318,7 +208,7 @@
 
 impl From<KeyPerm> for KeyPermSet {
     fn from(p: KeyPerm) -> Self {
-        Self((p.0).0 as i32)
+        Self(p as i32)
     }
 }
 
@@ -353,7 +243,7 @@
 macro_rules! key_perm_set {
     () => { KeyPermSet(0) };
     ($head:expr $(, $tail:expr)* $(,)?) => {
-        KeyPermSet(($head.0).0 $(| ($tail.0).0)*)
+        KeyPermSet($head as i32 $(| $tail as i32)*)
     };
 }
 
@@ -398,10 +288,10 @@
         _ => return Err(KsError::sys()).context(format!("Cannot grant {:?}.", key.domain)),
     };
 
-    selinux::check_permission(caller_ctx, &target_context, KeyPerm::grant())
+    selinux::check_permission(caller_ctx, &target_context, KeyPerm::Grant)
         .context("Grant permission is required when granting.")?;
 
-    if access_vec.includes(KeyPerm::grant()) {
+    if access_vec.includes(KeyPerm::Grant) {
         return Err(selinux::Error::perm()).context("Grant permission cannot be granted.");
     }
 
@@ -490,7 +380,7 @@
                 .context("Domain::BLOB: Failed to lookup namespace.")?;
             // If DOMAIN_KEY_BLOB was specified, we check for the "manage_blob"
             // permission in addition to the requested permission.
-            selinux::check_permission(caller_ctx, &tctx, KeyPerm::manage_blob())?;
+            selinux::check_permission(caller_ctx, &tctx, KeyPerm::ManageBlob)?;
 
             tctx
         }
@@ -511,49 +401,49 @@
     use keystore2_selinux::*;
 
     const ALL_PERMS: KeyPermSet = key_perm_set![
-        KeyPerm::manage_blob(),
-        KeyPerm::delete(),
-        KeyPerm::use_dev_id(),
-        KeyPerm::req_forced_op(),
-        KeyPerm::gen_unique_id(),
-        KeyPerm::grant(),
-        KeyPerm::get_info(),
-        KeyPerm::rebind(),
-        KeyPerm::update(),
-        KeyPerm::use_(),
-        KeyPerm::convert_storage_key_to_ephemeral(),
+        KeyPerm::ManageBlob,
+        KeyPerm::Delete,
+        KeyPerm::UseDevId,
+        KeyPerm::ReqForcedOp,
+        KeyPerm::GenUniqueId,
+        KeyPerm::Grant,
+        KeyPerm::GetInfo,
+        KeyPerm::Rebind,
+        KeyPerm::Update,
+        KeyPerm::Use,
+        KeyPerm::ConvertStorageKeyToEphemeral,
     ];
 
     const SYSTEM_SERVER_PERMISSIONS_NO_GRANT: KeyPermSet = key_perm_set![
-        KeyPerm::delete(),
-        KeyPerm::use_dev_id(),
-        // No KeyPerm::grant()
-        KeyPerm::get_info(),
-        KeyPerm::rebind(),
-        KeyPerm::update(),
-        KeyPerm::use_(),
+        KeyPerm::Delete,
+        KeyPerm::UseDevId,
+        // No KeyPerm::Grant
+        KeyPerm::GetInfo,
+        KeyPerm::Rebind,
+        KeyPerm::Update,
+        KeyPerm::Use,
     ];
 
     const NOT_GRANT_PERMS: KeyPermSet = key_perm_set![
-        KeyPerm::manage_blob(),
-        KeyPerm::delete(),
-        KeyPerm::use_dev_id(),
-        KeyPerm::req_forced_op(),
-        KeyPerm::gen_unique_id(),
-        // No KeyPerm::grant()
-        KeyPerm::get_info(),
-        KeyPerm::rebind(),
-        KeyPerm::update(),
-        KeyPerm::use_(),
-        KeyPerm::convert_storage_key_to_ephemeral(),
+        KeyPerm::ManageBlob,
+        KeyPerm::Delete,
+        KeyPerm::UseDevId,
+        KeyPerm::ReqForcedOp,
+        KeyPerm::GenUniqueId,
+        // No KeyPerm::Grant
+        KeyPerm::GetInfo,
+        KeyPerm::Rebind,
+        KeyPerm::Update,
+        KeyPerm::Use,
+        KeyPerm::ConvertStorageKeyToEphemeral,
     ];
 
     const UNPRIV_PERMS: KeyPermSet = key_perm_set![
-        KeyPerm::delete(),
-        KeyPerm::get_info(),
-        KeyPerm::rebind(),
-        KeyPerm::update(),
-        KeyPerm::use_(),
+        KeyPerm::Delete,
+        KeyPerm::GetInfo,
+        KeyPerm::Rebind,
+        KeyPerm::Update,
+        KeyPerm::Use,
     ];
 
     /// The su_key namespace as defined in su.te and keystore_key_contexts of the
@@ -634,7 +524,7 @@
         // attempts to grant the grant permission must always fail even when privileged.
         assert_perm_failed!(check_grant_permission(
             &system_server_ctx,
-            KeyPerm::grant().into(),
+            KeyPerm::Grant.into(),
             &key
         ));
         // unprivileged grant attempts always fail. shell does not have the grant permission.
@@ -654,7 +544,7 @@
         if is_su {
             assert!(check_grant_permission(&sctx, NOT_GRANT_PERMS, &key).is_ok());
             // attempts to grant the grant permission must always fail even when privileged.
-            assert_perm_failed!(check_grant_permission(&sctx, KeyPerm::grant().into(), &key));
+            assert_perm_failed!(check_grant_permission(&sctx, KeyPerm::Grant.into(), &key));
         } else {
             // unprivileged grant attempts always fail. shell does not have the grant permission.
             assert_perm_failed!(check_grant_permission(&sctx, UNPRIV_PERMS, &key));
@@ -669,7 +559,7 @@
         assert_perm_failed!(check_key_permission(
             0,
             &selinux::Context::new("ignored").unwrap(),
-            KeyPerm::grant(),
+            KeyPerm::Grant,
             &key,
             &Some(UNPRIV_PERMS)
         ));
@@ -677,7 +567,7 @@
         check_key_permission(
             0,
             &selinux::Context::new("ignored").unwrap(),
-            KeyPerm::use_(),
+            KeyPerm::Use,
             &key,
             &Some(ALL_PERMS),
         )
@@ -691,61 +581,31 @@
 
         let key = KeyDescriptor { domain: Domain::APP, nspace: 0, alias: None, blob: None };
 
-        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::use_(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::delete(), &key, &None).is_ok());
-        assert!(
-            check_key_permission(0, &system_server_ctx, KeyPerm::get_info(), &key, &None).is_ok()
-        );
-        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::rebind(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::update(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::grant(), &key, &None).is_ok());
-        assert!(
-            check_key_permission(0, &system_server_ctx, KeyPerm::use_dev_id(), &key, &None).is_ok()
-        );
-        assert!(
-            check_key_permission(0, &gmscore_app, KeyPerm::gen_unique_id(), &key, &None).is_ok()
-        );
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Use, &key, &None).is_ok());
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Delete, &key, &None).is_ok());
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::GetInfo, &key, &None).is_ok());
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Rebind, &key, &None).is_ok());
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Update, &key, &None).is_ok());
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::Grant, &key, &None).is_ok());
+        assert!(check_key_permission(0, &system_server_ctx, KeyPerm::UseDevId, &key, &None).is_ok());
+        assert!(check_key_permission(0, &gmscore_app, KeyPerm::GenUniqueId, &key, &None).is_ok());
 
-        assert!(check_key_permission(0, &shell_ctx, KeyPerm::use_(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &shell_ctx, KeyPerm::delete(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &shell_ctx, KeyPerm::get_info(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &shell_ctx, KeyPerm::rebind(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &shell_ctx, KeyPerm::update(), &key, &None).is_ok());
-        assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::grant(), &key, &None));
-        assert_perm_failed!(check_key_permission(
-            0,
-            &shell_ctx,
-            KeyPerm::req_forced_op(),
-            &key,
-            &None
-        ));
-        assert_perm_failed!(check_key_permission(
-            0,
-            &shell_ctx,
-            KeyPerm::manage_blob(),
-            &key,
-            &None
-        ));
-        assert_perm_failed!(check_key_permission(
-            0,
-            &shell_ctx,
-            KeyPerm::use_dev_id(),
-            &key,
-            &None
-        ));
-        assert_perm_failed!(check_key_permission(
-            0,
-            &shell_ctx,
-            KeyPerm::gen_unique_id(),
-            &key,
-            &None
-        ));
+        assert!(check_key_permission(0, &shell_ctx, KeyPerm::Use, &key, &None).is_ok());
+        assert!(check_key_permission(0, &shell_ctx, KeyPerm::Delete, &key, &None).is_ok());
+        assert!(check_key_permission(0, &shell_ctx, KeyPerm::GetInfo, &key, &None).is_ok());
+        assert!(check_key_permission(0, &shell_ctx, KeyPerm::Rebind, &key, &None).is_ok());
+        assert!(check_key_permission(0, &shell_ctx, KeyPerm::Update, &key, &None).is_ok());
+        assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::Grant, &key, &None));
+        assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::ReqForcedOp, &key, &None));
+        assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::ManageBlob, &key, &None));
+        assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::UseDevId, &key, &None));
+        assert_perm_failed!(check_key_permission(0, &shell_ctx, KeyPerm::GenUniqueId, &key, &None));
 
         // Also make sure that the permission fails if the caller is not the owner.
         assert_perm_failed!(check_key_permission(
             1, // the owner is 0
             &system_server_ctx,
-            KeyPerm::use_(),
+            KeyPerm::Use,
             &key,
             &None
         ));
@@ -753,18 +613,18 @@
         assert!(check_key_permission(
             1,
             &system_server_ctx,
-            KeyPerm::use_(),
+            KeyPerm::Use,
             &key,
-            &Some(key_perm_set![KeyPerm::use_()])
+            &Some(key_perm_set![KeyPerm::Use])
         )
         .is_ok());
         // But fail if the grant did not cover the requested permission.
         assert_perm_failed!(check_key_permission(
             1,
             &system_server_ctx,
-            KeyPerm::use_(),
+            KeyPerm::Use,
             &key,
-            &Some(key_perm_set![KeyPerm::get_info()])
+            &Some(key_perm_set![KeyPerm::GetInfo])
         ));
 
         Ok(())
@@ -780,42 +640,24 @@
             blob: None,
         };
 
-        assert!(check_key_permission(0, &sctx, KeyPerm::use_(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &sctx, KeyPerm::delete(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &sctx, KeyPerm::get_info(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &sctx, KeyPerm::rebind(), &key, &None).is_ok());
-        assert!(check_key_permission(0, &sctx, KeyPerm::update(), &key, &None).is_ok());
+        assert!(check_key_permission(0, &sctx, KeyPerm::Use, &key, &None).is_ok());
+        assert!(check_key_permission(0, &sctx, KeyPerm::Delete, &key, &None).is_ok());
+        assert!(check_key_permission(0, &sctx, KeyPerm::GetInfo, &key, &None).is_ok());
+        assert!(check_key_permission(0, &sctx, KeyPerm::Rebind, &key, &None).is_ok());
+        assert!(check_key_permission(0, &sctx, KeyPerm::Update, &key, &None).is_ok());
 
         if is_su {
-            assert!(check_key_permission(0, &sctx, KeyPerm::grant(), &key, &None).is_ok());
-            assert!(check_key_permission(0, &sctx, KeyPerm::manage_blob(), &key, &None).is_ok());
-            assert!(check_key_permission(0, &sctx, KeyPerm::use_dev_id(), &key, &None).is_ok());
-            assert!(check_key_permission(0, &sctx, KeyPerm::gen_unique_id(), &key, &None).is_ok());
-            assert!(check_key_permission(0, &sctx, KeyPerm::req_forced_op(), &key, &None).is_ok());
+            assert!(check_key_permission(0, &sctx, KeyPerm::Grant, &key, &None).is_ok());
+            assert!(check_key_permission(0, &sctx, KeyPerm::ManageBlob, &key, &None).is_ok());
+            assert!(check_key_permission(0, &sctx, KeyPerm::UseDevId, &key, &None).is_ok());
+            assert!(check_key_permission(0, &sctx, KeyPerm::GenUniqueId, &key, &None).is_ok());
+            assert!(check_key_permission(0, &sctx, KeyPerm::ReqForcedOp, &key, &None).is_ok());
         } else {
-            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::grant(), &key, &None));
-            assert_perm_failed!(check_key_permission(
-                0,
-                &sctx,
-                KeyPerm::req_forced_op(),
-                &key,
-                &None
-            ));
-            assert_perm_failed!(check_key_permission(
-                0,
-                &sctx,
-                KeyPerm::manage_blob(),
-                &key,
-                &None
-            ));
-            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::use_dev_id(), &key, &None));
-            assert_perm_failed!(check_key_permission(
-                0,
-                &sctx,
-                KeyPerm::gen_unique_id(),
-                &key,
-                &None
-            ));
+            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::Grant, &key, &None));
+            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::ReqForcedOp, &key, &None));
+            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::ManageBlob, &key, &None));
+            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::UseDevId, &key, &None));
+            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::GenUniqueId, &key, &None));
         }
         Ok(())
     }
@@ -831,9 +673,9 @@
         };
 
         if is_su {
-            check_key_permission(0, &sctx, KeyPerm::use_(), &key, &None)
+            check_key_permission(0, &sctx, KeyPerm::Use, &key, &None)
         } else {
-            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::use_(), &key, &None));
+            assert_perm_failed!(check_key_permission(0, &sctx, KeyPerm::Use, &key, &None));
             Ok(())
         }
     }
@@ -847,7 +689,7 @@
             check_key_permission(
                 0,
                 &selinux::Context::new("ignored").unwrap(),
-                KeyPerm::use_(),
+                KeyPerm::Use,
                 &key,
                 &None
             )
@@ -862,16 +704,16 @@
     #[test]
     fn key_perm_set_all_test() {
         let v = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::use_dev_id(),
-            KeyPerm::req_forced_op(),
-            KeyPerm::gen_unique_id(),
-            KeyPerm::grant(),
-            KeyPerm::get_info(),
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_() // Test if the macro accepts missing comma at the end of the list.
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::UseDevId,
+            KeyPerm::ReqForcedOp,
+            KeyPerm::GenUniqueId,
+            KeyPerm::Grant,
+            KeyPerm::GetInfo,
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use // Test if the macro accepts missing comma at the end of the list.
         ];
         let mut i = v.into_iter();
         assert_eq!(i.next().unwrap().name(), "delete");
@@ -889,11 +731,11 @@
     #[test]
     fn key_perm_set_sparse_test() {
         let v = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::req_forced_op(),
-            KeyPerm::gen_unique_id(),
-            KeyPerm::update(),
-            KeyPerm::use_(), // Test if macro accepts the comma at the end of the list.
+            KeyPerm::ManageBlob,
+            KeyPerm::ReqForcedOp,
+            KeyPerm::GenUniqueId,
+            KeyPerm::Update,
+            KeyPerm::Use, // Test if macro accepts the comma at the end of the list.
         ];
         let mut i = v.into_iter();
         assert_eq!(i.next().unwrap().name(), "gen_unique_id");
@@ -912,23 +754,23 @@
     #[test]
     fn key_perm_set_include_subset_test() {
         let v1 = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::use_dev_id(),
-            KeyPerm::req_forced_op(),
-            KeyPerm::gen_unique_id(),
-            KeyPerm::grant(),
-            KeyPerm::get_info(),
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::UseDevId,
+            KeyPerm::ReqForcedOp,
+            KeyPerm::GenUniqueId,
+            KeyPerm::Grant,
+            KeyPerm::GetInfo,
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use,
         ];
         let v2 = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use,
         ];
         assert!(v1.includes(v2));
         assert!(!v2.includes(v1));
@@ -936,18 +778,18 @@
     #[test]
     fn key_perm_set_include_equal_test() {
         let v1 = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use,
         ];
         let v2 = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use,
         ];
         assert!(v1.includes(v2));
         assert!(v2.includes(v1));
@@ -955,33 +797,29 @@
     #[test]
     fn key_perm_set_include_overlap_test() {
         let v1 = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::grant(), // only in v1
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::Grant, // only in v1
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use,
         ];
         let v2 = key_perm_set![
-            KeyPerm::manage_blob(),
-            KeyPerm::delete(),
-            KeyPerm::req_forced_op(), // only in v2
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
+            KeyPerm::ManageBlob,
+            KeyPerm::Delete,
+            KeyPerm::ReqForcedOp, // only in v2
+            KeyPerm::Rebind,
+            KeyPerm::Update,
+            KeyPerm::Use,
         ];
         assert!(!v1.includes(v2));
         assert!(!v2.includes(v1));
     }
     #[test]
     fn key_perm_set_include_no_overlap_test() {
-        let v1 = key_perm_set![KeyPerm::manage_blob(), KeyPerm::delete(), KeyPerm::grant(),];
-        let v2 = key_perm_set![
-            KeyPerm::req_forced_op(),
-            KeyPerm::rebind(),
-            KeyPerm::update(),
-            KeyPerm::use_(),
-        ];
+        let v1 = key_perm_set![KeyPerm::ManageBlob, KeyPerm::Delete, KeyPerm::Grant,];
+        let v2 =
+            key_perm_set![KeyPerm::ReqForcedOp, KeyPerm::Rebind, KeyPerm::Update, KeyPerm::Use,];
         assert!(!v1.includes(v2));
         assert!(!v2.includes(v1));
     }
diff --git a/keystore2/src/security_level.rs b/keystore2/src/security_level.rs
index 74aba3c..ee725eb 100644
--- a/keystore2/src/security_level.rs
+++ b/keystore2/src/security_level.rs
@@ -216,10 +216,10 @@
         let scoping_blob: Vec<u8>;
         let (km_blob, key_properties, key_id_guard, blob_metadata) = match key.domain {
             Domain::BLOB => {
-                check_key_permission(KeyPerm::use_(), key, &None)
+                check_key_permission(KeyPerm::Use, key, &None)
                     .context("In create_operation: checking use permission for Domain::BLOB.")?;
                 if forced {
-                    check_key_permission(KeyPerm::req_forced_op(), key, &None).context(
+                    check_key_permission(KeyPerm::ReqForcedOp, key, &None).context(
                         "In create_operation: checking forced permission for Domain::BLOB.",
                     )?;
                 }
@@ -248,9 +248,9 @@
                                 KeyEntryLoadBits::KM,
                                 caller_uid,
                                 |k, av| {
-                                    check_key_permission(KeyPerm::use_(), k, &av)?;
+                                    check_key_permission(KeyPerm::Use, k, &av)?;
                                     if forced {
-                                        check_key_permission(KeyPerm::req_forced_op(), k, &av)?;
+                                        check_key_permission(KeyPerm::ReqForcedOp, k, &av)?;
                                     }
                                     Ok(())
                                 },
@@ -415,7 +415,7 @@
         }
 
         if params.iter().any(|kp| kp.tag == Tag::INCLUDE_UNIQUE_ID) {
-            check_key_permission(KeyPerm::gen_unique_id(), key, &None).context(concat!(
+            check_key_permission(KeyPerm::GenUniqueId, key, &None).context(concat!(
                 "In add_certificate_parameters: ",
                 "Caller does not have the permission to generate a unique ID"
             ))?;
@@ -487,7 +487,7 @@
 
         // generate_key requires the rebind permission.
         // Must return on error for security reasons.
-        check_key_permission(KeyPerm::rebind(), &key, &None).context("In generate_key.")?;
+        check_key_permission(KeyPerm::Rebind, &key, &None).context("In generate_key.")?;
 
         let attestation_key_info = match (key.domain, attest_key_descriptor) {
             (Domain::BLOB, _) => None,
@@ -601,7 +601,7 @@
         };
 
         // import_key requires the rebind permission.
-        check_key_permission(KeyPerm::rebind(), &key, &None).context("In import_key.")?;
+        check_key_permission(KeyPerm::Rebind, &key, &None).context("In import_key.")?;
 
         let params = self
             .add_certificate_parameters(caller_uid, params, &key)
@@ -685,7 +685,7 @@
         };
 
         // Import_wrapped_key requires the rebind permission for the new key.
-        check_key_permission(KeyPerm::rebind(), &key, &None).context("In import_wrapped_key.")?;
+        check_key_permission(KeyPerm::Rebind, &key, &None).context("In import_wrapped_key.")?;
 
         let (wrapping_key_id_guard, mut wrapping_key_entry) = DB
             .with(|db| {
@@ -695,7 +695,7 @@
                         KeyType::Client,
                         KeyEntryLoadBits::KM,
                         caller_uid,
-                        |k, av| check_key_permission(KeyPerm::use_(), k, &av),
+                        |k, av| check_key_permission(KeyPerm::Use, k, &av),
                     )
                 })
             })
@@ -876,7 +876,7 @@
             )?;
 
         // convert_storage_key_to_ephemeral requires the associated permission
-        check_key_permission(KeyPerm::convert_storage_key_to_ephemeral(), storage_key, &None)
+        check_key_permission(KeyPerm::ConvertStorageKeyToEphemeral, storage_key, &None)
             .context("In convert_storage_key_to_ephemeral: Check permission")?;
 
         let km_dev = &self.keymint;
@@ -935,7 +935,7 @@
             .ok_or(error::Error::Km(ErrorCode::INVALID_ARGUMENT))
             .context("In IKeystoreSecurityLevel delete_key: No key blob specified")?;
 
-        check_key_permission(KeyPerm::delete(), key, &None)
+        check_key_permission(KeyPerm::Delete, key, &None)
             .context("In IKeystoreSecurityLevel delete_key: Checking delete permissions")?;
 
         let km_dev = &self.keymint;
diff --git a/keystore2/src/service.rs b/keystore2/src/service.rs
index c6d466d..70f5c71 100644
--- a/keystore2/src/service.rs
+++ b/keystore2/src/service.rs
@@ -138,7 +138,7 @@
                         KeyType::Client,
                         KeyEntryLoadBits::PUBLIC,
                         caller_uid,
-                        |k, av| check_key_permission(KeyPerm::get_info(), k, &av),
+                        |k, av| check_key_permission(KeyPerm::GetInfo, k, &av),
                     )
                 })
             })
@@ -190,7 +190,7 @@
                     KeyEntryLoadBits::NONE,
                     caller_uid,
                     |k, av| {
-                        check_key_permission(KeyPerm::update(), k, &av)
+                        check_key_permission(KeyPerm::Update, k, &av)
                             .context("In update_subcomponent.")
                     },
                 )
@@ -236,7 +236,7 @@
             };
 
             // Security critical: This must return on failure. Do not remove the `?`;
-            check_key_permission(KeyPerm::rebind(), &key, &None)
+            check_key_permission(KeyPerm::Rebind, &key, &None)
                 .context("Caller does not have permission to insert this certificate.")?;
 
             db.store_new_certificate(
@@ -269,7 +269,7 @@
         // If the first check fails we check if the caller has the list permission allowing to list
         // any namespace. In that case we also adjust the queried namespace if a specific uid was
         // selected.
-        match check_key_permission(KeyPerm::get_info(), &k, &None) {
+        match check_key_permission(KeyPerm::GetInfo, &k, &None) {
             Err(e) => {
                 if let Some(selinux::Error::PermissionDenied) =
                     e.root_cause().downcast_ref::<selinux::Error>()
@@ -309,7 +309,7 @@
         DB.with(|db| {
             LEGACY_MIGRATOR.with_try_migrate(key, caller_uid, || {
                 db.borrow_mut().unbind_key(key, KeyType::Client, caller_uid, |k, av| {
-                    check_key_permission(KeyPerm::delete(), k, &av).context("During delete_key.")
+                    check_key_permission(KeyPerm::Delete, k, &av).context("During delete_key.")
                 })
             })
         })
@@ -341,7 +341,7 @@
     fn ungrant(&self, key: &KeyDescriptor, grantee_uid: i32) -> Result<()> {
         DB.with(|db| {
             db.borrow_mut().ungrant(key, ThreadState::get_calling_uid(), grantee_uid as u32, |k| {
-                check_key_permission(KeyPerm::grant(), k, &None)
+                check_key_permission(KeyPerm::Grant, k, &None)
             })
         })
         .context("In KeystoreService::ungrant.")