diff --git a/private/canhalconfigurator.te b/private/canhalconfigurator.te
index 9ba60ac..171f68a 100644
--- a/private/canhalconfigurator.te
+++ b/private/canhalconfigurator.te
@@ -4,4 +4,8 @@
 
 # This allows the configurator to look up the CAN HAL controller via
 # hwservice_manager and communicate with it.
-hal_client_domain(canhalconfigurator, hal_can_controller)
+allow canhalconfigurator hal_can_controller_hwservice:hwservice_manager find;
+binder_call(canhalconfigurator, hal_can_controller);
+allow canhalconfigurator hidl_manager_hwservice:hwservice_manager find;
+hwbinder_use(canhalconfigurator);
+get_prop(canhalconfigurator, hwservicemanager_prop);
diff --git a/public/hal_can.te b/public/hal_can.te
index 959d1d9..c75495b 100644
--- a/public/hal_can.te
+++ b/public/hal_can.te
@@ -1,9 +1,9 @@
 # CAN controller
 binder_call(hal_can_controller_client, hal_can_controller_server)
-binder_call(hal_can_controller_server, hal_can_controller_client)
-hal_attribute_hwservice(hal_can_controller, hal_can_controller_hwservice)
+add_hwservice(hal_can_controller_server, hal_can_controller_hwservice)
+allow hal_can_controller_client hal_can_controller_hwservice:hwservice_manager find;
 
 # CAN bus
 binder_call(hal_can_bus_client, hal_can_bus_server)
-binder_call(hal_can_bus_server, hal_can_bus_client)
-hal_attribute_hwservice(hal_can_bus, hal_can_bus_hwservice)
+add_hwservice(hal_can_bus_server, hal_can_bus_hwservice)
+allow hal_can_bus_client hal_can_bus_hwservice:hwservice_manager find;
diff --git a/vendor/hal_vehicle_default.te b/vendor/hal_vehicle_default.te
index 56a47b7..dcb03a8 100644
--- a/vendor/hal_vehicle_default.te
+++ b/vendor/hal_vehicle_default.te
@@ -7,4 +7,6 @@
 init_daemon_domain(hal_vehicle_default)
 
 # communication with CAN bus HAL
-hal_client_domain(hal_vehicle_default, hal_can_bus)
+allow hal_vehicle_default hal_can_bus_hwservice:hwservice_manager find;
+allow hal_vehicle_default hal_can_socketcan:binder { call transfer };
+allow hal_can_socketcan hal_vehicle_default:binder { call transfer };