Remove hal_gatekeeper from gatekeeperd domain
HAL clients should not be annotated with hal_x and haldomain. This may
grant them too much access. Instead, the policy needed for using
in-process HALs should be directly embedded into the client's domain
rules.
This partially reverts the moving of rules out of gatekeeperd in
commit a9ce208680b3a9c1ddcf9bfce886909b66297964.
Test: Set up PIN-protected secure lock screen, unlock screen, reboot,
unlock. No SELinux denials in gatekeeperd or hal_gatekeeper*.
Bug: 34715716
Change-Id: If87c865461580ff861e7e228a96d315d319e1765
1 file changed