Annotate most remaining HALs with _client/_server
This switches most remaining HALs to the _client/_server approach.
To unblock efforts blocked on majority of HALs having to use this
model, this change does not remove unnecessary rules from clients of
these HALs. That work will be performed in follow-up commits. This
commit only adds allow rules and thus does not break existing
functionality.
The HALs not yet on the _client/_server model after this commit are:
* Allocator HAL, because it's non-trivial to declare all apps except
isolated apps as clients of this HAL, which they are.
* Boot HAL, because it's still on the non-attributized model and I'm
waiting for update_engine folks to answer a couple of questions
which will let me refactor the policy of this HAL.
Test: mmm system/sepolicy
Test: Device boots, no new denials
Test: Device boots in recovery mode, no new denials
Bug: 34170079
Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
diff --git a/private/bluetooth.te b/private/bluetooth.te
index b2369c1..9c7182e 100644
--- a/private/bluetooth.te
+++ b/private/bluetooth.te
@@ -58,6 +58,7 @@
hal_client_domain(bluetooth, hal_bluetooth)
binder_call(bluetooth, hal_telephony)
+hal_client_domain(bluetooth, hal_telephony)
read_runtime_log_tags(bluetooth)
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index 5f7549d..0aff9f5 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -10,8 +10,11 @@
# Perform HwBinder IPC.
hwbinder_use(surfaceflinger)
binder_call(surfaceflinger, hal_graphics_allocator)
+hal_client_domain(surfaceflinger, hal_graphics_allocator)
binder_call(surfaceflinger, hal_graphics_composer)
+hal_client_domain(surfaceflinger, hal_graphics_composer)
binder_call(surfaceflinger, hal_configstore)
+hal_client_domain(surfaceflinger, hal_configstore)
# Perform Binder IPC.
binder_use(surfaceflinger)
diff --git a/private/system_server.te b/private/system_server.te
index 516ace4..58a25e2 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -176,18 +176,28 @@
hwallocator_use(system_server)
binder_call(system_server, hal_boot)
binder_call(system_server, hal_contexthub)
+hal_client_domain(system_server, hal_contexthub)
hal_client_domain(system_server, hal_fingerprint)
binder_call(system_server, hal_gnss)
+hal_client_domain(system_server, hal_gnss)
binder_call(system_server, hal_graphics_allocator)
binder_call(system_server, hal_ir)
+hal_client_domain(system_server, hal_ir)
binder_call(system_server, hal_light)
+hal_client_domain(system_server, hal_light)
binder_call(system_server, hal_memtrack)
+hal_client_domain(system_server, hal_memtrack)
binder_call(system_server, hal_power)
+hal_client_domain(system_server, hal_power)
hal_client_domain(system_server, hal_sensors)
binder_call(system_server, hal_thermal)
+hal_client_domain(system_server, hal_thermal)
binder_call(system_server, hal_usb)
+hal_client_domain(system_server, hal_usb)
binder_call(system_server, hal_vibrator)
+hal_client_domain(system_server, hal_vibrator)
binder_call(system_server, hal_vr)
+hal_client_domain(system_server, hal_vr)
hal_client_domain(system_server, hal_wifi)
hal_client_domain(system_server, hal_wifi_supplicant)