Allow the NFC process to access hwservicemanager.
Add a macro to make this easier for other processes
as well.
Change-Id: I489d0ce042fe5ef88dc767a6fbdb9b795be91601
(cherry picked from commit c2b9c1561e4bd7ac86d78b44ca7927994e781da0)
diff --git a/nfc.te b/nfc.te
index 5b7f4b9..05dabaa 100644
--- a/nfc.te
+++ b/nfc.te
@@ -4,6 +4,9 @@
net_domain(nfc)
binder_service(nfc)
+# hwbinder access
+hwbinder_use(nfc)
+
# Set NFC properties
set_prop(nfc, nfc_prop)
diff --git a/te_macros b/te_macros
index 1e70c4c..f22e009 100644
--- a/te_macros
+++ b/te_macros
@@ -187,6 +187,20 @@
')
#####################################
+# hwbinder_use(domain)
+# Allow domain to use HwBinder IPC.
+define(`hwbinder_use', `
+# Call the hwservicemanager and transfer references to it.
+allow $1 hwservicemanager:binder { call transfer };
+# hwservicemanager performs getpidcon on clients.
+allow hwservicemanager $1:dir search;
+allow hwservicemanager $1:file { read open };
+allow hwservicemanager $1:process getattr;
+# rw access to /dev/hwbinder and /dev/ashmem is presently granted to
+# all domains in domain.te.
+')
+
+#####################################
# binder_call(clientdomain, serverdomain)
# Allow clientdomain to perform binder IPC to serverdomain.
define(`binder_call', `