Find hal_foo_hwservice -> you are hal_foo_client.
Before, it was possible to access a hwservice without declaring
that you were a client.
This introduces the following macro:
hal_attribute_hwservice_client(hal_foo, hal_foo_hwservice)
which makes sure the above implication holds using a neverallow rule.
Bug: 80319537
Test: boot + sanity
Change-Id: Iededae68f14f0f3bd412c1205aa3b650a54d55c6
diff --git a/public/hal_omx.te b/public/hal_omx.te
index cf03690..375f386 100644
--- a/public/hal_omx.te
+++ b/public/hal_omx.te
@@ -27,11 +27,13 @@
# via PDX. Thus, there is no need to use pdx_client macro.
allow hal_omx_server bufferhubd:fd use;
-allow hal_omx_client hal_codec2_hwservice:hwservice_manager find;
-allow hal_omx_client hal_omx_hwservice:hwservice_manager find;
+hal_attribute_hwservice_client(hal_omx, hal_omx_hwservice)
+hal_attribute_hwservice_client(hal_omx, hal_codec2_hwservice)
+
allow hal_omx_client hidl_token_hwservice:hwservice_manager find;
binder_call(hal_omx_client, hal_omx_server)
+binder_call(hal_omx_server, hal_omx_client)
###
### neverallow rules