Add sepolicies to allow hal_health_default to load BPFs.
Bug: 203462310
Test: Ensure that the BPF filter can be loaded
Change-Id: Ib507d4c1718dd56fb336501ed7598de7b44a687b
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 7644cac..d7b27b5 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -40,7 +40,17 @@
neverallow { domain -bpfloader } *:bpf { map_create prog_load };
-neverallow { domain -bpfloader -gpuservice -mediaprovider_app -netd -netutils_wrapper -network_stack -system_server } *:bpf prog_run;
+neverallow {
+ domain
+ -bpfloader
+ -gpuservice
+ -hal_health_server
+ -mediaprovider_app
+ -netd
+ -netutils_wrapper
+ -network_stack
+ -system_server
+} *:bpf prog_run;
neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };